ZDNet UK / News and Analysis / Business of IT / IT Strategy

HP backs down on DMCA warning

By Declan McCullagh, CNet, 2 August, 2002 07:45

Daily Newsletters

Sign up to ZDNet UK's daily newsletter.

Topics

Hacking, Flaw, HP, Unix, DMCA, Security, Legal

NEWS
Hewlett-Packard has backed away from legal threats it made against security analysts who publicised flaws in the company's software. In a statement released late on Thursday, HP emphasised that it would not use a controversial copyright law, the Digital Millennium Copyright Act (DMCA), to pursue a loosely organised team of researchers who demonstrated a bug in the company's Tru64 Unix operating system. "We can say emphatically that HP will not use the DMCA to stifle research or impede the flow of information that would benefit our customers and improve their system security," the statement said. As previously reported, HP invoked the DMCA and computer crime laws when threatening to sue a collective of researchers who released a utility allowing a Tru64 user to gain full administrator privileges. An HP vice president sent a letter on Monday warning the SnoSoft researchers that they "could be fined up to $500,000 (£320,000) and imprisoned for up to five years". HP's dramatic warning appears to have been the first time the DMCA was invoked to stifle research related to computer security. Previously it had been used by copyright holders to pursue people who distribute computer programs that unlock copyrighted content such as DVDs or encrypted e-books. This time, public outcry among programmers, researchers and technologists was quick and fierce, prompting HP to back down from its stark warning earlier in the week. "Let's just say it's been significant," Martin Fink, general manager for HP's Linux Systems Operation, said in an interview on Thursday. "The fact that customers care is a good thing. And that's why we need to make sure what the true HP position is." Fink said security researchers should have no fear of legal warnings from HP "if you reveal security threats using industry standard security practice". He said the DMCA was "not a part" of HP's corporate culture. "I am glad that HP backed down," Adriel Desautels, co-founder of SnoSoft, said Thursday evening, "but I would still like to know how exactly they planned on using the DMCA against SnoSoft. I am happy that we appear to be coming to a peaceful resolve." HP said that it had been alerted to the security vulnerability in Tru64 Unix on 18 July and would have a fix available to customers no later than Saturday. On 19 July, a researcher at SnoSoft posted a note to SecurityFocus.com's popular Bugtraq mailing list with a hyperlink to a computer program letting a Tru64 user take over the system. SnoSoft says the post by a group member called "Phased" was unauthorised. That public disclosure drew the ire of Kent Ferson, a vice president in HP's Unix systems unit, who alleged in his letter on Monday that the post violated the DMCA and the Computer Fraud and Abuse Act. "HP hereby requests that you cooperate with us to remove the buffer overflow exploit from securityfocus.com and to take all steps necessary to prevent the further dissemination by SnoSoft and its agents of this and similar exploits of Tru64 Unix," Ferson wrote. "If SnoSoft and its members fail to cooperate with HP, then this will be considered further evidence of SnoSoft's bad faith." The letter's invocation of the DMCA was a last-minute addition by an outside lawyer, HP said. Fink, HP's Linux manager, said on Thursday that he could not discuss whether his employer would pursue other legal action against SnoSoft that did not rely on DMCA. The HP statement said, "We won't comment on the specifics of our discussions with SnoSoft. However, we take our customers' security requirements very seriously and have a strong track record following industry-standard security practices." HP's initial letter accused SnoSoft of attempts at extortion in violation of Massachusetts state law. Until Wednesday, SnoSoft's home page stressed that it had a policy of "full disclosure" of security threats -- unless that company retains SnoSoft as consultants. "If someone hires us to do research we can not disclose that information since the information becomes theirs -- they purchase it," said Snosoft's Desautels. SnoSoft said in a statement that it intends to "continue serving the community by finding and reporting security vulnerabilities in a broad spectrum of operating systems, software applications, and other hardware and software systems." Bruce Perens, the open-source evangelist whom HP hired two years ago, said HP's final statement "is acceptable". "The important thing is that HP was not attempting to establish a precedent, that use of DMCA to intimidate people who report security problems was not corporate policy," Perens said in an interview. "Obviously I did not want HP to be the poster child for abuse of the DMCA." Perens said that some executives did not realise what a "hot button" the DMCA was. "Certainly the engineering staff all spoke up about that," he said. "At the high point there was an email to (HP chief executive Carly Fiorina) every 90 seconds." One explanation for the company's lack of appreciation for the DMCA's controversial nature could be the culture clash that developed when Compaq Computer and HP were joined. The vice president who sent the DMCA threat, Ferson, came from Compaq. But Fink, HP's Linux manager, says that's not likely. "Not everybody in a 150,000 person company deals with the complexity of the DMCA and what real impact it has in the industry at large. This wasn't anything to do with culture clash or anything like that."
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Related stories

HP threatens researchers with DMCA

Heart of England NHS begins massive digitisation plan

Hard-drive woes hit PC shipments in fourth quarter

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

fgvrg56

Unfortunately main issue is that ASUS is refusing to accept that they make some mistake on this version of asus Transformer prime. 1 - GPS sensor...

3 minutes ago by fgvrg56 on Asus Eee Pad Transformer Prime Wi-Fi & GPS problems?
Ben Woods

@Marcus A fair question. Just talked with Archos which said it was working on an announcement for next week....

1 hour ago by Ben Woods on Archos confirms G9 Ice Cream Sandwich update schedule
Marcus Karlsson

Any update on this, considering the claimed "first week of February"?

2 hours ago by Marcus Karlsson via Facebook on Archos confirms G9 Ice Cream Sandwich update schedule
apexwm

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

11 hours ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility
txtrainguy

Replying to an old topic that I'm currently facing with my CEO (who is on a Mac). Our servers are primarily Windows Servers, office is about...

17 hours ago by txtrainguy on Windows Server 2008 drops the ball for Mac compatibility
k0tcs3

Sure, that makes perfect sense. Pay wrong-doers money and thank them for breaching your security and pointing out your flaws, that would surely...

17 hours ago by k0tcs3 on US indicts Romanian over NASA climate change hack
Random_Error

I think he's referring specifically to Android apps, as Apple do regulate their App Store, but Google seem to let any old crap onto the Android store!

18 hours ago by Random_Error on RIM: BlackBerry will keep 'garbage' apps out of store
Paul Fezziwig

Keep the crap apps out?! How will they compete with Android and Apple's claim to fame of having so many life changing apps? I wonder if the media...

23 hours ago by Paul Fezziwig via Facebook on RIM: BlackBerry will keep 'garbage' apps out of store
Aigars Mahinovs

It has been shown time after time that if there is an author store that sells the songs at even 1$ per song and gives you a high-quality digital...

24 hours ago by Aigars Mahinovs via Facebook on Copyright isn't working, says European Commission
awbMaven

""As a result of Butyka's alleged conduct, researchers were unable to use the computers for more than two months while NASA removed the malicious...

1 day ago by awbMaven on US indicts Romanian over NASA climate change hack
subhorup

It simultaneously worries me and uplifts me that a self-proclaimed group of internet activists name themselves after Indian mythical figures....

1 day ago by subhorup on Anonymous activists release PCAnywhere source code
naviathan

It's actually far easier to work anonymously on the internet than you think. With tools like Tor bouncing your traffic around the world before...

2 days ago by naviathan on Anonymous activists release PCAnywhere source code
Agnostic_OS

1000272134 and bluedalmatian with you both there but then I'm still in 10.04 land (and happy with it)

2 days ago by Agnostic_OS on Ten factors that make Ubuntu 11.10 a hit
apexwm

Interesting article and definitely see your points on the products mentioned. One of the top products for our Help Desk (approximately 20% of all...

2 days ago by apexwm on Ten flawed products that derail productivity
Paul Hutchinson

Absolutely - this should obviously not be handled my isp - but handled by their hosting operator. What's been suggested here is that my isp police...

2 days ago by Paul Hutchinson via Facebook on MPs urge ISPs to take down terrorist material
Techs UK

Looks like a great phone. I don't notice any deficiencies in WP7. used IOS before, that's pretty good. I don't spend much time in Apps, all i need...

2 days ago by Techs UK on Nokia pins US 're-entry' hopes on Lumia 900
Larry Bloggy

Now with the help of these apps you are always synced with MS outlook while on the move. Just download apps like xobni or outlookreflex and get...

2 days ago by Larry Bloggy via Facebook on Outlook Social Connector beta 2 and the LinkedIn connector
mike40g123

Your details are wrong. The version currently being made is the one with 2 USB ports, 256MB RAM and a network port. This is the Model B. The...

2 days ago by mike40g123 on Raspberry Pi boards set to go on sale
Moley

The thing that has been puzzling me for quite a while is how Anonymous can remain anonymous whilst not only being active on the Internet but also...

3 days ago by Moley on Anonymous activists release PCAnywhere source code
Don Dilly

If what Semantec is saying is rue, that is even worse and shows a complete disregard for thier users. If what Anonymous claims is true and the...

3 days ago by Don Dilly via Facebook on Anonymous activists release PCAnywhere source code

Latest in IT Strategy

Heart of England NHS begins massive digitisation plan

Hard-drive woes hit PC shipments in fourth quarter

Featured white papers

How cloud adds strategy to IT outsourcing

SAVVIS

How cloud adds strategy to IT outsourcing

Thanks to cloud computing, IT outsourcing is back, but this time it can help both in cutting costs and helping the business... Read more

Tech breakthroughs to watch in 2012

ZDNet UK

Tech breakthroughs to watch in 2012

From invisibility cloaks to virtual atom smashing, from Cern to Nasa, this ZDNet UK guide presents the discoveries to watch in... Read more

Key trends driving global business resilience and risk

IBM

Key trends driving global business resilience and risk

This IBM research paper looks at how businesses are thinking more about business resilience by improving the ability to adapt to a continuously changing business... Read more

Inside ZDNet UK

Microsoft reveals Windows On ARM will bind developers

Microsoft reveals Windows On ARM will bind developers

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

BlackBerry Bold 9790

Case study: How cloud enables growth

Case study: How cloud enables growth

Ten factors that make Ubuntu 11.10 a hit

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

BT's archive: Pictures from the vault