Hacking the Xbox

8
Hacking the Xbox: An Introduction to Reverse Engineering
countries — who have been free to explore and understand access
control technologies. The stricter laws in the U.S. and the litigious nature
of corporations has already negatively affected the U.S.’s standing in
electronic security, and this is just the beginning.
The societal impact of the DMCA is being felt by hacker communities
around the world. During the course of my work on the Xbox, I had the
good fortune of meeting brilliant hackers across the globe. Hackers in
America were some of the most fearful of the group, and even though they
were talented engineers, they were loath to apply their skills to such problems
for fear of persecution. The result is that some of the most interesting
results in Xbox hacking are garnered by European and Asian hacker
communities. Significantly, these results are not well known in America, as
these hackers have little motivation to make the effort to share their
findings with Americans. In fact, many foreign hackers make a conscious
effort to keep their findings from leaving their communities, for reasons
including a fear of retribution by American corporations. This “brain
drain” does little to strengthen America’s competency in a technology as
important as fair and effective digital copyright control. And in today’s
global economy, American corporations cannot survive by pretending to
do business in a vacuum.
One may point to the successful publication of my paper on the Xbox
security system as an example of how the DMCA works to protect both free
speech rights as well as economic interests in copyright control technology.
My situation was not typical for most hackers in the US. Since I was a
graduate student at the time, I had no family to worry about or significant
assets to lose if I were to get involved in a lawsuit over my work. I also
had the generous legal assistance of the Electronic Frontier Foundation
(EFF) to help guide me through the legal minefield. The EFF helped
position my paper in the most legal light possible, informing me of my
rights and obligations under the DMCA.
For example, I am required to “make a good faith effort to obtain
authorization [from Microsoft] before the circumvention.” 6 (Note that
authorization is not required, but the good faith effort is.) The EFF
helped me draft such a letter for research. I also had to fight MIT to allow
my research to be published as an affiliated entity. All of the direct effort
of reverse engineering the Xbox security was funded out of my own
pocket, conducted in my apartment, and done after-hours on my own
time. MIT initially took advantage of this fact to separate themselves
from my work, forcing me to seek out the counsel of the EFF. MIT
finally capitulated and allowed me to publish my paper as a student of
MIT after much cajoling by sympathetic professors and after I had
received a constructive, non-threatening letter from Microsoft about my
research.
Freedom of speech should not require a lawyer, and free thought should
not involve letters of authorization for research. I fought to publish my
6 17 U.S.C. § 1201(g)(2), Permissible acts of encryption research