Security Code Crackers Warned to Keep Mum

Last year the recording industry waved the Digital Millennium Copyright Act at a bunch of hackers, Linux advocates, and other assorted lowlifes. This year the labels are going uptown: The Secure Digital Music Initiative is threatening a Princeton University professor with legal action if his group publishes its research results.

The dispute is over a contest the SDMI ran last fall, in which the world was invited to hack six digital watermarking techniques that were under development. The SDMI set stringent limits on what participants could do and how much they could say afterwards; the Princeton-led team said it never agreed to any such limits.

An SDMI lawyer, Matthew Oppenheim, sent a letter to the lead researcher, Edward Felton, warning that if the group published details of its research, it might be liable under the DMCA. Most media outlets stressed the DMCA threat in their coverage; only a few detailed the other aspect of the legal warning, that the researchers may have violated the agreement that SDMI insisted contest participants "sign" (actually click through) before attempting to crack its watermarking protections.

On Friday a copy of the letter, and an early draft of the researchers' paper, showed up on Cryptome.org, the Web site of a New York activist.

Coverage Avoids Specifics

Some media outlets contented themselves with interviewing Felton and Oppenheim. Inside delved more deeply, noting that the Princeton-led group was not the only team scheduled to present SDMI-cracking results in Pittsburgh on April 25. Inside's Charles C. Mann and Roger Parloff interviewed the leader of a French team that claims to have cracked three of the SDMI's six challenges (Felton's team managed four), and who has long since posted full research results on the Web.

While a number of stories alluded to the earlier DMCA case involving the DVD-cracking code DeCSS, Inside was the only outlet, among those the Industry Standard discovered, to note that the watermarking technology involved in the SDMI affair is different from the encryption technology used in DeCSS.

For cryptography, researchers can examine and publish details of the algorithms involved without destroying the usefulness of code. But for watermarking technology, continued secrecy turns out to be all-important.