For iTunes hacker, the freedom of the open code

For iTunes hacker, the freedom of the open code

In the late 1990s, Norwegian hacker Jon Lech Johansen became a cyberspace sensation when he broke into the encryption system designed to prevent copying of traditional DVDs and then posted it on the Web.

By Vyvyan Tenorio Publishedon C-Net News: November 24, 2006, 6:00 AM PST

He was 15 years old at the time and quickly became known in hacker circles as "DVD Jon," a wunderkind of reverse engineering who tore down cumbersome technological barriers.

His wizardry provoked a string of lawsuits in the U.S. and Norway. Movie studios even pressed Norwegian authorities to file criminal charges against Johansen. He prevailed in Oslo's courts, which said he should be free to copy DVDs he bought legally. In the U.S., however, the studios scored a victory in the first major test case of the U.S.'s Digital Millennium Copyright Act, or DMCA, passed in 1998.

This summer, Johansen surfaced in San Francisco, claiming to have broken into Apple Computer's encryption software for iTunes. He has started a company called DoubleTwist Ventures, ostensibly to license technology that allows users to play on Apple iPods copy-protected content other than those purchased from Apple's iTunes Store. Moreover, he claims his technology could allow them to play iTunes music on other MP3 devices as well.

http://i.i.com.com/cnwk.1d//i/ne/p/2...n_j180x173.jpg
Jon Johansen
While it may not be his intent, Johansen now appears to be testing the bounds of digital copyright laws in the U.S. There are those who believe his actions could open another battleground between copyright law and technology.

"This is one of a number of issues that have been percolating for some years, particularly since the passage of certain laws in October 1998, including legal claims against YouTube and MySpace," says Kenneth Kaufman, a partner at Skadden, Arps, Slate, Meagher & Flom's Washington office. "The laws were the result of very complex negotiations and compromises between copyright owners and copyright users, and since then there have been a number of areas of tension between the two sides."

Johansen, who first encountered a computer at 3, doesn't think he's doing anything illegal, but he wants to foster interoperability in technologies that frustrate him. Many people in Western Europe, confronted with Apple's stranglehold on music downloads, seem to agree with him and are moving in that direction. That Johansen, who has testified in court hearings in the U.S., has called his Web site "So Sue Me" is a sign that he believes his cause is just and is prepared to defend it in court if necessary.

Which way Apple will fall
DVD Jon may or may not have his day in court. Apple hasn't revealed what it plans to do and isn't commenting on his latest exploits. But copyright lawyers in the U.S. say Apple would certainly have a strong case. Indeed, most experts believe that given the legal precedents, Johansen might be clutching at straws, using arguments already rejected in prior cases.
Others point out that what he is doing adds a fresh twist that could test the scope of the DMCA. "If Apple sues an MP3 manufacturer that has software enabling the manufacturer's devices to listen to iTunes, it might claim violation under the DMCA, but that would take DMCA into an area it hasn't gone before," says Michael Graif, an intellectual property partner at Venable.

Since he began writing simple codes, beginning at age 12, Johansen has made a career of reverse engineering. He reportedly got frustrated when he couldn't copy his DVDs and play them on his PC using Linux. Along with two other European authors who remain anonymous, he wrote a program, DeCSS (for decrypt content scrambling system), so he could play his DVDs on his Linux computer. (CSS is the code that movie studios use to protect DVD films from being copied and distributed.)

Shortly after DeCSS was released on the Web in 1999, the Norwegian police raided his home. Johansen was charged with violating a Norwegian law that prohibits accessing another person's copy-protected data. He was acquitted in 2003, retried on appeal and was acquitted again. In both instances, the courts ruled Johansen was free to copy DVDs he acquired legally.

In the U.S., the release of DeCSS triggered a wave of lawsuits in state courts with mixed results. But in 2000, the Motion Picture Association of America, the primary litigant against digital piracy along with the Recording Industry Association of America, won a case against online Web publisher Eric Corley and his Web site, 2600.com. His service offered DeCSS as well as links to other sites from which DeCSS could be downloaded. Corley challenged the constitutionality of the DMCA, which sidestepped the fair-use doctrine established through court decisions and codified in section 107 of the U.S. Copyright Act.

U.S. District Judge Lewis A. Kaplan of the Southern District of New York, in a 90-page opinion, upheld the constitutionality of the DMCA. In ruling against Corley, Kaplan said that while computer code is speech, it is not "purely expressive any more than the assassination of a political figure is purely a political statement."

In 2003, Johansen began to reverse-engineer iTunes digital rights management software, called FairPlay. His Web site, which offers biographical milestones, says Apple then tweaked its source code to attempt to shut out his open-source protocol, but he reverse-engineered that as well and updated the code.

Johansen also worked online with Michael Robertson, founder of Internet music provider MP3.com (now owned by CNET Networks, publisher of News.com). Robertson figured in a famous suit filed by Universal Music Group in 2000, and the online media dubbed their pairing "Butch Cassidy and the Sundance Kid." (In that landmark case, which came right after another federal judge in San Francisco ordered Napster to cease operations, U.S. District Judge Jed Rakoff ruled that MP3.com infringed the record companies' copyrights.)

Last year, Johansen moved to San Diego to work with Robertson's online music store, MP3tunes, which promotes open systems. But he reportedly decided to strike out on his own, shifting to San Francisco earlier this year to launch DoubleTwist Ventures with business partner Monique Farantzos. The two plan to commercialize the technology, which claims to make iTunes interoperable with other music stores.

Currently, iTunes software does not allow music downloaded from other fee-based services, such as Napster and Rhapsody, to play on the iPod because Apple refuses to license out its DRM. Johansen's software takes a song from another service and "wraps" it with his program in a way that fools the iPod into thinking that it's encoded in FairPlay.

Another program will let an iPod user take a downloaded iTunes song and play it on other MP3 devices. iTunes does allow an iPod user to burn music on a CD, which can then be played on another device as an MP3 file, but it involves a two-step process and the sound quality may deteriorate.
Johansen was not available for comment for this story. But he has said publicly that his program is actually adding copy protection, and therefore the DMCA, which prohibits removing it, is not applicable.

"You can't circumvent any measure designed to protect a copyrighted product."

--Stephen Kramarsky, attorney, Dewey Pegno & Kramarsky

According to Fred von Lohmann, senior staff attorney at the San Francisco advocacy group Electronic Frontier Foundation (EFF), which is representing Johansen, a number of court decisions approve reverse engineering for interoperability purposes. He cited Sega Enterprises Ltd. v. Accolade, and Sony Computer Entertainment v. Connectix. The DMCA, he says, has an exemption in its anticircumvention provision that allows reverse engineering to circumvent a technological measure that controls access to copyrighted material to achieve interoperability with another program.

In the DVD case, says von Lohmann, the court rejected the reverse-engineering argument. "Here, we're going to make it absolutely clear that this is about reverse engineering for interoperability."

Johansen may be on shaky ground. The DMCA allows it only if the circumvention does not independently constitute copyright infringement. Part of Johansen's defense "would have to be that breaking FairPlay and making an iTunes file playable on another device, when FairPlay is intended to prohibit that, does not constitute copyright infringement," says one lawyer.

The case law on circumvention "is all about DVD Jon, and the courts all rejected the reverse-engineering arguments," says Stephen Kramarsky, a litigator with Dewey Pegno & Kramarsky of New York. "You can't circumvent any measure designed to protect a copyrighted product."

Supporting arguments
Last year, Vivendi Universal Games' Blizzard Entertainment sued a group of users of Blizzard's Battle.net game for copyright infringement. The players were unhappy over the game's technical glitches, so they reverse-engineered the site and developed an open-source alternative site that used the same key code to play the game.

The group's defense is similar to what Johansen will have to argue to invoke the interoperability exception. The court ruled it was a copyright infringement because the alternative site enabled players to have access without the enabling key code, and as a result, unauthorized copies of the game were played on different servers.

Adds Kramarsky, "Even if you're using a legitimate or a reverse-engineered key, if you're taking copy protection off software or any content, or if you're creating an access method that allows unauthorized people to get at it in any way, that violates the anticircumvention provisions."

There's also another argument Apple could use: Making the iTunes songs available on other machines can be construed as a violation of iTunes' terms of use and end-user license agreement. "As a matter of contract law," one lawyer says, "Johansen is arguably trying to induce users to breach those agreements."

The court held that the Blizzard case was a copyright infringement partly because the players violated the end-user license agreement and the terms of use. In the absence of that defense, the court found it was a violation of the DMCA because the group circumvented a technological protection measure controlling access to copy-protected material.

Last year's Supreme Court's ruling on the case involving peer-to-peer site Grokster isn't going to help him either. The court as a whole signed on to an opinion that said distributing a device with the object of promoting its use to infringe copyright makes the distributor liable for secondary infringement. Grokster shut down not long afterwards.

In a separate case, CleanFlicks Media, an American Forks, Utah-based company that aimed to provide sanitized, family-friendly versions of DVDs in the market, sought a preliminary injunction against a group of Hollywood directors. CleanFlicks invoked fair use under a section of the U.S. copyright law that allows the use of copyrighted works in certain situations without requiring permission from rights holders. In July this year, a federal court judge ruled against it.

While the CleanFlicks case may not directly apply, Kaufman says, it is part of a trend in litigation where some courts have tended to give copyright owners under current U.S. law a certain amount of leeway in how their works are used and accessed. The law delineates certain factors to analyze fair use. The Supreme Court ruled in 1994 that a use may be justified as fair use if the use is transformative, meaning it adds something new with a further purpose or different character.

CleanFlicks had argued that it was transforming the DVDs to create another opportunity for users who wouldn't buy the original. But the court said it was removing material from the works and it couldn't do that without permission.

If there is a lawsuit, Johansen would have a fairly difficult case, lawyers believe. What's tricky about Johansen's interoperability argument is the DMCA does not provide for a fair-use exemption.

The DMCA has had plenty of detractors, mostly academics, civil libertarians and advocacy groups such as the EFF, who complain it is one-sided in favor of content providers. When the law passed, one copyright lawyer explains, there were no freedom of information advocates powerful enough to go against the movie industry in lobbying Congress. "Unfortunately, the door slammed on them before they got started," he says.

Congress passed the law to address issues such as digital piracy. In reality, argues the EFF's von Lohmann, it's been completely ineffective at that mission, given the persistence of illegal downloading sites; rather, it has been more effective at squelching competition. As one copyright lawyer who represents entertainment companies puts it, the DMCA "is a law essentially written by content providers to protect their content."
"There's been a discouraging trend indicating that companies are viewing the DMCA as a tool to deter competition, not piracy."

--Fred von Lohmann, senior staff attorney, EFF

Von Lohmann points to a couple of cases as symptomatic of a broader issue in the way the DMCA is used in litigation. In one case, garage door patent holder Chamberlain Group sued a small Canadian company, Skylink Technologies, for circumventing access controls in its system. In another, toner cartridge manufacturer Lexmark International sued Static Control Components for reverse-engineering Lexmark's authentication procedure, claiming copyright infringement and circumvention in violation of the DMCA. In both cases, the courts approved the reverse engineering for interoperability purposes.

"There's been a discouraging trend indicating that companies are viewing the DMCA as a tool to deter competition, not piracy," von Lohmann says. "It's one thing to use copyright law to prevent piracy and counterfeiting, but it's quite another thing to use copyright law to create a platform lock in that ends up harming innovation and competition."

Precedents in the case
At the same time, von Lohmann says that the cases provide precedents for Johansen's interoperability argument. He maintains that it clearly isn't a copyright-infringement issue because iTunes software includes tools to bypass the DRM. "When you download songs from the store, it allows you the option to burn these songs onto CDs, remove the DRM and rip it again so that they can be played on another MP3 player," he says. "It's clear the DRM is not helping the recording artist. It's not helping the consumer; the only thing it's doing is limiting competition."

Von Lohmann adds that the songs in question--either downloaded from iTunes sites or from other sites--will remain copy-protected by the vendor's DRM. So it isn't clear whether recording companies will be parties to litigation. "It's hard to see how any legitimate interest is harmed by what Johansen is doing," von Lohmann says.

"It's not as if the major labels are prejudiced here in any way. They obviously approve their songs to be used in a variety of sites because they get fees. Quite the contrary, they've been saying repeatedly that Apple's refusal to license its DRM system is frustrating," he adds.

Venable's Graif believes the iTunes software is designed to prevent portability from iPods to another platform--not to prevent copyright infringement. So it's unclear whether Apple can invoke the DMCA if it decides to sue Johansen. "The question is whether the DMCA was meant to apply in such a case where the technology measure controlling access is not strictly designed to prevent copyright infringement, but rather to maintain a proprietary standard," Graif says.

But is Apple likely to sue? Von Lohmann says Apple has not contacted Johansen. CEO Steve Jobs has tended not to take hackers such as Johansen to court. In 2004, RealNetworks, which markets the RealPlayer music player and owns the Rhapsody music site, launched Harmony, a program intended to break iTunes' DRM and make other music interoperable with iTunes. Apple merely updated the software and superseded RealNetworks' program.

Besides, Apple may have bigger worries. In Europe, it is fighting a wave of legal actions. Consumer agencies in Norway, Denmark and Sweden are trying to force the company to make its system interoperable. France actually passed a so-called iPod law that a court struck down, but the fight isn't over yet. Similar moves are afoot in the U.K., and it will likely become an antitrust issue for the European Union.

In news accounts, meanwhile, Johansen's DoubleTwist company claims to have signed on its first customer, but has declined to identify the licensee. Is he concerned that his customers would be sued? Von Lohmann says it's possible they could be sued, but adds, "It's far too early to speculate on as-yet-unknown customers."

--------------------------------------------

:source: Source: http://news.com.com/For+iTunes+hacke...tml?tag=st.num