Hacking the Xbox

186
Hacking the Xbox: An Introduction to Reverse Engineering
In combination, these DMCA provisions create major barriers to
cryptographers and security researchers who want to analyze the security
measures used in real, mass-marketed products. A commercial reverse
engineer who discovers a problem with another firm’s technical measure
and offers suggestions about how to improve it is at risk of being
indicted on criminal DMCA charges.
Even an academic reverse engineer is at risk of being sued for publishing
a paper about the weaknesses in a firm’s security measures, because such a
paper could be labeled a “tool of circumvention.” 37 One example is
Princeton professor Edward Felten, who assembled and entered a team of
scientists in the music industry’s “SDMI Challenge,” a contest to crack digital
watermarking and other technologies being considered by the Secure Digital
Music Initiative for protecting digital music. Felten and his team entered the
contest with the intent of using the SDMI Challenge as a real-world security
case study, and they eventually authored a peer-reviewed academic paper that
was to be presented at a conference. Before the paper was actually presented,
the Recording Industry Association of America (RIAA) sent Felten and the
conference organizers a letter warning him that publishing the paper would
violate intellectual property laws, including the DMCA.
The DMCA also contains several exemptions relevant to reverse engineering:
circumvention of a technical protection system when necessary to achieve
interoperability among computer programs; circumventions conducted in
the course of legitimate encryption research; and circumvention for purposes
of computer security testing. Unfortunately, each of these exemptions is
both complex and narrow. Even when the act of reverse-engineering is
allowed, the DMCA strictly regulates what can be done with the resulting
information.
1201(f): reverse-engineering for interoperability
This exemption allows the circumvention of technical protection measures
for interoperability reverse engineering. It also allows, to a very limited
extent, the dissemination of information gained from reverse-engineering.
Note that 1201(f) would not have exempted Felten’s attack on the SDMI
watermarks, because it had no relation to interoperability.
The 2600 case, mentioned earlier, concerns the publication of a computer
program known as “DeCSS” on the website of 2600 Magazine.
DeCSS can be used to bypass CSS, the technical protection measure used
to control access to DVD movies. EFF, which represented 2600
Magazine, argued that DeCSS qualifies for the interoperability privilege
of 1201(f). DeCSS was designed, we argued, to enable people to build
software that would enable them to play legitimately purchased DVD
movies on their platform of choice, namely, Linux computer systems.
The courts rejected this argument, saying that 1201(f) only permitted
circumvention for purposes of achieving program-to-program
37 While this seems odd, consider that many academic papers in
the security include computer program code.