Pushing 'shift' draws lawsuit

Princeton PhD student John "Alex" Halderman published a paper on his Web site on Monday that gave detailed instructions on how to disarm the SunnComm technology, which aims to block unauthorised CD copying and MP3 ripping. The technology is included on an album by Anthony Hamilton that was recently distributed by BMG Music.

On Thursday, SunnComm chief executive Peter Jacobs said the company plans legal action and is considering both criminal and civil suits. He said it may charge the student with maligning the company's reputation and, possibly, with violating copyright law that bans the distribution of tools for breaking through digital piracy safeguards.

"We feel we were the victim of an unannounced agenda and that the company has been wronged," Jacobs said. "I think the agenda is: 'Digital property should belong to everyone on the Internet.' I'm not sure that works in the marketplace."

The cases are already being examined by some intellectual-property lawyers for their potential to test the extremes of a controversial copyright law that block the distribution of information or software that breaks or "circumvents" copy-protection technologies.

Several civil and criminal cases based on the Digital Millennium Copyright Act have been filed against people who distributed information or software aimed at breaking through anti-piracy locks. In one, Web publisher Eric Corley was banned by a federal judge from publishing software code that helped in the process of copying DVDs.

In a criminal case, Russian company ElcomSoft was cleared of charges that it had distributed software that wilfully broke through Adobe Systems' e-book copy protection.

Both of those cases dealt with software or software code, however. The issue in Halderman's case is somewhat different.

In his paper, published on the Princeton Web site on Monday, the student explained that the SunnComm technique relies on installing anti-piracy software directly from the protected CD itself. However, this can be prevented by stopping Microsoft Windows' "auto-run" feature. That can be done simply by pushing the shift key as the CD loads.

If the CD does load and installs the software, Halderman identified the driver file that can be disabled using standard Windows tools. Free-speech activists said the nature of Halderman's instructions -- which appeared in an academic paper, used only functions built into every Windows computer, and were not distributed for profit -- meant they would not fall under DMCA scrutiny.

"This is completely outrageous," said Fred von Lohmann, an attorney for the Electronic Frontier Foundation, a group that has previously represented computer academics concerned that copyright law would impair their ability to publish. "This is not black hat (hackers') exploits he's revealing. This is Windows 101... It is relatively hard to imagine any better example of how the DMCA has been misused since it was passed five years ago."

Jacobs said SunnComm's attorneys would refer the case to local federal authorities, who could make the decision on how to proceed on the DMCA issue. He said the company was also exploring a civil suit based on damage to the company's reputation, since Halderman concluded that the technology was ineffective without knowing about future enhancements.

Future versions of the SunnComm software would include ways that the copy-protecting files would change their name on different computers, making them harder to find, Jacobs said. Moreover, the company will distribute the technology along with third-party software, so that it doesn't always come off a protected CD, he added.

The damage to SunnComm's reputation, while not necessarily permanent, was quickly seen in a drop in its market value, totaling close to $10m over several days, Jacobs said. No final decisions about legal action have been made, he added.

Halderman said he's not overly worried about the legal threat. The EFF represented his advisor, Princeton professor Edward Felten, in a lawsuit dealing with academic freedom to publish computer security information, and Princeton University supported Felten in that case.

"I expect I will be well-represented in the case of a lawsuit," Halderman said. "If pressing the shift key is a violation of the DMCA, then the law needs to be changed."