Computing Research Policy Blog

DMCA Slowed Disclosure of Sony/BMG Spyware

CRA has often argued that the Digital Millennium Copyright Act (DMCA) -- enacted in 1998 to combat digital piracy -- is disruptive to the process of research. When computer security researchers feel compelled by the potential liability created by DMCA to consult with an army of attorneys before moving forward with previously legitimate research, there's a cost -- a cost, we'd argue, that affects national and individual security, the pace of innovation, and IP management. In the case of the Sony/BMG spyware debacle, it appears that chilling effect cost unwitting consumers of Sony's CDs at least a month of additional exposure to the major security vulnerability introduced by "copy protection" on the Sony discs.

Ed Felten and Alex Halderman detail this effect in their submission to the Copyright Office requesting exemptions from the anti-circumvention provisions of the DMCA as part of the office's triennial review of the legislation. As Felten notes on Freedom To Tinker, he and Halderman were aware of the vulnerabilities created by the Sony CD a month before the first public disclosure, but delayed publication of their findings until they could consult with university counsel about liability posed by DMCA. From the submission:

Researchers like Professor Edward Felten and Alex Halderman waste valuable research time consulting attorneys due to concerns about liability under the DMCA. They must consult not only with their own attorneys but with the general counsel of their academic institutions as well. Unavoidably, the legal uncertainty surrounding their research leads to delays and lost opportunities. In the case of the CDs at issue, Halderman and Felten were aware of problems with the XCP software almost a month before the news became public, but they delayed publication in order to consult with counsel about legal concerns. This delay left millions of consumers at risk for weeks longer than necessary.

Felten and Halderman are asking the Copyright Office for an exemption to the DMCA that would allow circumvention of compact disk copy protection technologies that have certain spyware-ish features or create security holes. You can read the whole submission here (pdf). Unfortunately, the Copyright Office was pretty miserly about granting exemptions during the last two reviews, so it's not clear how even Felten and Halderman's compelling request will fare. But we'll keep track of the process here and post the details.

Posted by PeterHarsha at December 2, 2005 12:28 PM
Posted to Security