Straining digital copyright law, junior paper exposes protection flaws in CDs

As senior computer science major Alex Halderman '03 was presenting his junior paper to a room of scientists Monday, he was thinking about his future career. Being sued by the music industry was further from his mind.

Halderman said he could possibly be sued for violating the Digital Millennium Copyright Act by presenting his spring JP at the ACM Conference on Computer & Communication Security in Washington.

Halderman's paper explains how some companies have protected CDs from being copied by computers.

Concern over a DMCA lawsuit until now has been reserved for just some of the University's faculty, notably computer science professor Edward Felten.

But what separates Halderman even from the professors — in the unlikely event that he is sued — is that the University might provide him with legal defense, Halderman said.

"I've been given assurances that the University would help me if I were sued for breaking the DMCA," he said. This would be an unprecedented and controversial move for the University if it were to happen.

The DMCA prohibits circumvention of copy-protection technologies, such as encryption and digital watermarking. The copy-protection system that Halderman examined is an exploit of existing flaws in computer software.

Because those technologies constitute a major focus area in computer science, some say the DMCA prohibits legitimate academic research.

Support nonprofit student journalism. Donate to the ‘Prince’. Donate now »

"That makes the DMCA problematic for universities and other institutions," Wilson School professor Christopher Eisgruber said in an email.

The DMCA is the same law that put peer-to-peer file sharing programs — such as Napster, Gnutell and Kazaa — on the judicial radar.

Also as a result of the DMCA, the University's radio station WPRB will face higher royalties for webcasting.

Halderman — a 'Prince' associate photo editor — said he would have written his JP differently if there were no DMCA.

Get the best of the ‘Prince’ delivered straight to your inbox. Subscribe now »

In the past, to show the weaknesses in a security system, one would write a program to break it. "That would be a proof," he said.

But since the DMCA was passed in 1998, creating such a proof can be illegal.

Instead, Halderman said he was careful to explain why the CDs' copy-protection system is inherently weak, without providing a recipe for circumventing it.

In 2001 Felten received a letter from the music industry allegedly threatening a DMCA lawsuit in response to research he and others had done.

The threatening letter never became a lawsuit. But following Felten's troubles, the University faculty voted to establish a committee on threats to academic freedom by legal intimidation, chair of the committee and physics professor Edward Groth said in an email.

Groth said the committee will be finalizing a report to the dean of the faculty's office next month.

The University has provided indemnification — legal defense — for students and faculty in the past, when they were performing a certain function for the University, such as serving on the Honor Committee, General Counsel Peter McDonough said.

Indemnification was originally designed only to protect the highest officers of the University from suits related to their roles, he said.

Protecting researchers for the sake of research is more than just rare, he added. "It is unheard of."

McDonough's office recommends cases of indemnification to the president, who holds the authority of granting indemnification.

"Once you get indemnification and once the University controls your defense, all of the sudden the decisions . . . are not necessarily the individuals," he said.

McDonough added that he would not want to see his office become the de facto clearinghouse for research papers.

If his office were to deny a researcher recommendation for indemnification, McDonough said, then some might see the office as censoring the student or faculty member.

Groth said, "Technology has completely changed the landscape."

The DMCA was created to prevent technology from making copyrights moot. But the law itself is unusual.

Halderman's JP adviser, Professor Andrew Appel '81, said the DMCA gives "a hook on which to hang a reasonably credible threat" — even if that threat would be unlikely to hold up in court.

"One has to explicitly be prepared to deal with the possibility of these threats of lawsuits," he said.

Without a team of defense lawyers at a researcher's disposal, facing a threat may not be feasible. Some researchers might be forced to choose a less risky path by not doing the research at all.

Halderman called that the "chilling effect" of the DMCA. Though Halderman said it is unlikely that he would be sued, he said he plans to continue his research, which could cause more conflict with the act.