• On The Insider: Judge Bans Real Housewives Sex Tape
September 19, 2007 5:04 AM PDT

A game of cat and mouse: The iPhone, Steve Jobs and an army of blind hackers

by Chris Soghoian

With Steve Jobs' recent announcement of his intention to fight off the independent iPhone developers, the question that must be asked is how will Apple try to defeat the hackers: Frequent and disruptive software updates, or lawsuits? Will Apple risk losing its most frequently (ab)used legal tool, the Digital Millennium Copyright Act, to try to punish the developers of the iPhone unlocking tools?



The wait is over. After being teased over the past few weeks with rumors that Apple would turn a blind eye to iPhone hacking or *gasp* even encourage it, the news is in and it ain't good for the hackers.

At the official U.K. launch of the iPhone Tuesday, CEO Steve Jobs made it clear that Apple will fight attempts to use the popular device on unauthorized networks. "It's a cat-and-mouse game," said Jobs. "We try to stay ahead. People will try to break in, and it's our job to stop them breaking in."

anySIM iPhone unlocker

(Credit: iPhone Dev Team/Hackintosh)

For the loose-knit community of iPhone developers, the last few months have been an around-the-clock hacking session. As a result, programmers have released a plethora of applications. Some, including an instant-messaging tool, a general purpose application installer and even a Nintendo game emulator, can be seen simply as developers releasing applications that Apple just didn't get around to writing itself. Other hacks, such as the much hyped iPhone Dev Team's anySIM unlocking tool, or the numerous free-ringtone tutorials that have been floating around the Net, can be more accurately described as a developer-lead attack upon Apple's revenue streams.

Apple has sunk a significant amount of developer time and marketing dollars into creating a product so drool-worthy that fans spent days queuing outside stores around the nation. Because of the significant hype surrounding the device, and the millions of customers who would flock to whichever wireless carrier with whom Apple signed an exclusive distribution deal, Jobs and his negotiation team were able to extract highly favorable, if not downright obscene amounts of money from the wireless carriers. While AT&T agreed to give Apple up to $11 per month for new customers who came to the carrier due to an iPhone purchase, some media reports are suggesting that Jobs was able to extract 40 percent of the monthly subscription fees that U.K. network O2 is charging its customers.

O2 is charging customers between $70 and $110 for its different monthly iPhone plans. With an 18-month contract, Apple is looking at between $500 to $800 in revenue share per customer. While the approximately $250 that AT&T will give Apple for a new customer over the lifetime of a 2-year contract is rather paltry in comparison, it still provides enough of a financial incentive for Apple to do all that it possibly can to lock the devices down, and keep hackers from unlocking the platform. Furthermore, if keeping open-source tinkerers away from the guts of the iPhone can also protect Apple's new, but potentially hugely profitable venture into the mobile phone ringtone market (99 cents per ringtone for each song already purchased), even better for Mr. Jobs and his stockholders.

Now that Jobs has declared war on the iPhone hackers, the only question that remains is the approach that Apple will take: software updates that'll break the iPhone hacks, or lawsuits against the trouble-making developers. To answer this question, we to look to the law and, most importantly, the Digital Millennium Copyright Act.

The most powerful weapon in Apple's legal arsenal is the Digital Millennium Copyright Act (DMCA). This law, much hated by open-source developers and much loved by copyright holders and mega corporations, was passed by a unanimous vote in the U.S. Senate before being signed into law by President Bill Clinton in 1998.

DRM protest outside Apple store

(Credit: Quinn Norton)

The DMCA is fairly complicated, but there are two main parts that seriously threaten researchers, hackers and hobbyists. First, the law makes it a crime to circumvent the technological locks that control access to copyrighted works. Second, the law makes it a crime for anyone to "traffic" or share such circumvention tools. That is, it's a crime to break the encryption protecting a copyrighted work, and it's an additional crime to share the software that breaks the encryption with anyone else.

While the law was originally intended to protect music and movie owners who were scared of infringement in the Digital Age, it has been used to try to block the sale of third-party printer cartridges, universal garage door openers, and even Web sites that publish leaked copies of scanned fliers for post-Thanksgiving "black Friday" sales. A few years ago, a number of prepaid mobile phone companies started using the DMCA to go after people who were buying their subsidized phones, stripping off the software and re-selling them to others.

When it passed the DMCA, Congress empowered the Librarian of Congress to issue exemptions to the anti-circumvention provision of the law. This power is intended to protect the public from access-control technologies that substantially interfere with their right to make non-infringing uses of copyrighted works. Current exemptions include the right for users to hack restrictive e-book digital rights management technology to allow for inter-operation with screen-readers and other helpful technologies used by blind and disabled people.

In 2006, Stanford professor (and now EFF cyber-lawyer) Jennifer Granick petitioned the Librarian of Congress to permit mobile phone customers to hack their own phones. Citing a need to reduce environmental waste due to prematurely disposed locked phones, and the needs of business travelers to be able to communicate around the world without carrying a phone for each country, the Copyright Office agreed with Granick, and granted mobile phone customers an exemption to the anti-circumvention rule.

That should be the end of it, right? An exception to the anti-circumvention rule exists for mobile-phone inter-network interoperability, and thus Apple should have no DMCA-related leg to stand on. The problem lies in the fact that the DMCA has two nasty provisions: the anti-circumvention rule and the anti-trafficking rule. As crazy as it may sound, while it's perfectly legal for a blind programmer to reverse engineer Adobe's e-book technology, it's illegal for her to share it with another, perhaps less technically savvy blind friend. As far as the law is currently concerned, if you don't have the technical skills to reverse engineer, you're not permitted to free your e-books or your mobile phone.

Unless this legal snafu is some kind of incentive-via-necessity based plan to turn every blind American into a reverse-engineering uber-hacker, the law is clearly broken. It is most likely an unfortunate oversight on the part of the 100 senators who unanimously voted for the DMCA, perhaps without fully understanding how it would be used in the future. Thus, we now find ourselves in a situation where it is perfectly legal to hack your own iPhone, but most probably illegal to share software with others that will automate the process.

With the DMCA most likely on Apple's side, Steve Jobs and his band of merry lawyers should have already filed a number of lawsuits against the iPhone Dev Team for its anySIM unlocking tool. Given the noticeable absence of lawsuits, one has to ask: Why hasn't Apple sued?

Apple likes the DMCA, a lot. Were there some sort of DMCA frequent-flier mile scheme, Steve Jobs would have earned himself at least a few free flights to Tahiti. While Apple is on solid legal ground when it goes after programmers for reverse engineering the Mac OS to run on cheap Dell PCs, any sort of DMCA action against the iPhone Dev Team would be far more problematic. Despite the fact that the Librarian of Congress does not have the power to create exemptions to the anti-trafficking provision of the DMCA, Congress clearly did not intend to create this artificial barrier between those with programming skills and those without. Quite simply, the law is broken. If Apple begins filing DMCA iPhone lawsuits, it could soon find itself in the unpleasant position where the courts--or worse, Congress--end up re-evaluating the merit and legality of the DMCA.

My suspicion is that Apple will not want to risk losing the golden egg-laying DMCA goose, and thus, will stick to frequent software updates for the iPhone that break community written applications. Why sue when you can patch?

Christopher Soghoian delves into the areas of security, privacy, technology policy and cyber-law. He is a student fellow at Harvard University's Berkman Center for Internet and Society , and is a PhD candidate at Indiana University's School of Informatics. His academic work and contact information can be found by visiting www.dubfire.net/chris/. He is a member of the CNET Blog Network, and is not an employee of CNET. Disclosure.
Recent posts from Surveillance State
YouTube's new 'nocookie' feature continues to serve cookies
Is the White House changing its YouTube tune?
Recovery.gov blocked search engine tracking
Obama's BlackBerry brings personal safety risks
White House expands use of search-blocking code
Activists call for a mashup-friendly Recovery.gov
White House yanks 'YouTube' from privacy policy
White House acts to limit YouTube cookie tracking
Add a Comment (Log in or register) (6 Comments)
  • prev
  • 1
  • next
iPhone Hacks
by Craig Landrum September 19, 2007 9:39 AM PDT
As pointed out in the article, there is a difference between the ability to add
new applications to the iPhone and unlocking the carrier restriction. The
general feeling among all of my fellow programmers can be summarized as:
new apps=good, unlocking carrier=bad. Unlocking the tie-in to AT&T clearly
robs Apple (and AT&T) of revenue they have every right to expect, while
developing new applications is widely viewed as simply fair competition.

I suspect that Apple will come down hard on the tie-in breakers while turning
a blind eye to simply developing new apps that do no harm. The iPhone is a
device that puts a great deal of power in the palm of your hand and while
Apple did a great job with the initial software, they know better than most
companies that it is simply good business to foster the creativity of your user
base.
Reply to this comment
Pick and choose what is good and what is evil?
by elguappo September 20, 2007 1:39 PM PDT
Hi Craig,

I had to ask you this. Adding new Apps is good and unlocking the tie-in is bad? You finished your paragraph by saying...

"Unlocking the tie-in to AT&T clearly
robs Apple (and AT&T) of revenue they have every right to expect, while
developing new applications is widely viewed as simply fair competition."

Its your use of the term "fair competition" that made me post this. You justify adding apps as fair competition but using the phone you own with any carrier you choose is bad? Its very clear that Apple stands to make alot more $$ from the monthly subscription agreement they made with AT&T. If Apple did not cut this deal with AT&T then why would Jobs care what carrier his cool phone is used on? He wants a piece of the carriers pie..greed...Where is the fair competition in allowing us to choose what carrier suits our needs best? Apple and this approach actually stiffles fair competition. This entire deal smells bad.

Sorry Craig. I see how you can choose what is good vrs. bad in this senario as you explained, but in all honesty when a vendor limits a consumers choice this robs the user - you and I - from even considering the competition.

Not too fair if you ask me.
Circumvention vs. Authorized Use
by jrzagar September 19, 2007 12:45 PM PDT
Go back and look at Chamberlain v. Skylink and you'll see some wonderful gems:

The Copyright Act authorizes consumers to access the copy of
a protected work that they purchased. If the copy has been
obtained legitimately, then consumers are immune from
circumvention liability under §1201(a)(1).

Copyright holders are not permitted to prohibit consumers from making use of "protected works" that have been obtained legitimately.

Apple's DMCA claims, if they ever raise them, will fail in exactly the same way as Chamberlains' did...
Reply to this comment
Choices for all out there
by elguappo September 19, 2007 1:20 PM PDT
I have used the iPhone and I am not sure what all the buzz is about. You want a phone that does everything an iPhone does and more? Want touch screen? HTC with Windows Mobile or LG Prada. Want wi-fi...please its 2007!

I am flabbergasted at how people buy into Apples marketing so easily. If you want cell phone freedom don't buy the iPhone. It is that easy. Jobs has made it extremely clear that if you want to play with Apple you play by his rules. Want a play list from iTunes on to a Creative MP3 player...can't do it, use an iPod. Want your choice of carriers for your cell phone? Don't buy an iPhone.

It about choices plain and simple. If you want to be lead like a herd of cattle, buy the iPhone. Just stop complaining about its limitations and Jobs predictable reactions.
Reply to this comment
Another Great Geek Journalist!
by bdonohue1 September 20, 2007 11:04 AM PDT
Outstanding piece. I am continually amazed by the journalistic skills of members of the geek press like this guy, Declan McCullagh, and Ryan Paul over at Ars. I'm a political blogger, and I can tell you that there is more real journalism in the geek media than you'd find in all the major news networks put together. If you follow tech, you have more informational riches than those of us in the political sphere can dream of.
Reply to this comment
Very well thought through
by rjwill246 September 22, 2007 9:34 AM PDT
Despite some people's negative opinions of the iPhone, my friends and I who
have used it for some weeks, would beg to differ about there being a
comparable other phone, like the Prada. This is a portable device with phone
capabilities and in that sense, it is hard to imagine that it won't keep evolving
into the ephemeral Newton that many of us have wanted recreated-- and
about which SJ is more than fully aware.

As for the phone hacks-- very understandable for 3rd party applications, but
as you point out, Apple and their contracted carriers have given up a lot of
concessions in order to carry this phone and they DO have a right to expect to
be protected when it comes to unlocking the phone. Balance that against the
gouging charges for roaming and one runs into a serious conflict of
consumer and carrier interest. Because it is possible to run up a few
thousand dollars in a few days of traveling, carriers should cooperate and
make roaming seamless and with no "tax" to assault the hapless traveler. I
would like to see local rules invoked in the contract apply universally and thus
free the traveler from the extant draconian roaming charges, as well as the
hidden connection fees that EDGE keeps racking up, simply by being "on."
Talk about taking advantage of travelers and business folk!!!

Right now, Apple and its partners have made traveling using the iPhone a
financial hazard unless you have a separate phone and /or SIM card for each
country. That is absurd and ought to be addressed in a near future up-date.
Reply to this comment
(6 Comments)
  • prev
  • 1
  • next
advertisement

Making sense of Windows 7 upgrades

faq The basics and the fine print on Microsoft's options for those eyeing the next operating system from Redmond.
• Full Windows 7 coverage

Road Trip 2009: Big Sky Country

CNET News reporter Daniel Terdiman takes his car full of gadgets to the Rockies and the Great Plains in search of tech, science, nature, and more.
• America's Fortress: Cheyenne Mountain

About Surveillance State

Christopher Soghoian delves into the areas of security, privacy, technology policy and cyber-law. He is a student fellow at Harvard University's Berkman Center for Internet and Society, and is a PhD candidate at Indiana University's School of Informatics. His academic work and contact information can be found by visiting www.dubfire.net/chris/. He is a member of the CNET Blog Network and is not an employee of CNET. Disclosure.

Add this feed to your online news reader

Surveillance State topics

advertisement
advertisement

Inside CNET News

Scroll Left Scroll Right