Copy Protection Company To Sue Student For Revealing Shift-Key Bypass [Updated]

by , 2:15 PM EDT, October 10th, 2003

[Update 3:15 PM CDT: SunnComm has issued a press release saying it had reversed its decision to "bring legal action against Princeton researcher." From that press release:

SunnComm Technologies, Inc. (OTC:STEH), a leader in digital content security and enhancement for optical media, announced today it will not seek legal remedies against Princeton researcher Alex Halderman. SunnComm believes Halderman wrote an inaccurate critical report of its recently released MediaMax™ CD-3 Copy Management technology (V1). Mr. Halderman included in his research report several methods of circumventing the MediaMax music file security used to slow down the casual copying of unprotected files. Because Mr. Halderman felt the file security was too easily bypassed, he deduced the product failed in its primary marketing mission. In actuality, MediaMax, which has been licensed to BMG Music, one of the world’s largest record companies, as well as other labels, performed exactly according to its Version 1 design specifications. SunnComm felt that Mr. Halderman missed the fundamental goal of MediaMax – to provide CD buyers with a licensed and legal method of making and sharing authorized copies of the music they purchase.

There's more in the full press release at SunComm's Web site.]

A few days ago, Princeton PhD student, Alex Halderman, told the world how to bypass the copy protection scheme from SunnComm that is on some new music discs offered by some of the top music distributors. The secret, at least when playing the CD on a Windows PC, is to hold down the shift key when inserting the CD into your PC. The scheme didn't work at all on Linux or Mac boxes. Now, according to The Register, the company that created the copy protection scheme is planning on suing Mr. Halderman for exposing the flaw, using the Digital Millennium Copyright Act (DMCA). From the article, SunnComm to sue 'Shift key' student for $10m :

SunnComm has threatened Princeton PhD student Alex Halderman with the Digital Millennium Copyright Act (DMCA) for exposing a key weakness in the company's latest CD copy protection technology, MediaMax CD3.

The company said today it will take legal action against Halderman for revealing how MediaMax CD3 can be bypassed by holding down a Windows PC's Shift key when a protected disc is inserted.

[...]

SunnComm today said the paper was "erroneous" and contains "false conclusions." On the back of said [false conclusions], "Halderman and Princeton University have significantly damaged SunnComm's reputation and caused the market value of SunnComm to drop by more than $10 million," the company alleges.

And then there's the DMCA angle. SunnComm claims Halderman broke the law by revealing the name of the driver the app installs.

In a statement released today, SunnComm said: "SunnComm intends to refer this possible felony to authorities having jurisdiction over these matters because: 1. The author admits that he disabled the driver in order to make an unprotected copy of the disc's contents, and 2. SunnComm believes that the author's report was 'disseminated in a manner which facilitates infringement' in violation of the DMCA or other applicable law".

There's more information in the full article at The Register

The Mac Observer Spin:

We are not lawyers, but we can't see where SunnComm has much to complain about, let alone sue someone over: It created a flawed and easily circumvented copy protection scheme, something anybody could have stumbled upon and found a work-around to, and now it wants to sue because someone did? The company had to know that it was easy to bypass its technology, so they must have been relying on the law to keep the protection bypass from the public; protection through litigation. Now, there's a novel technological approach!

We also frown at the way the copy protection software gets installed: SunnComm literally dupes the end user into installing the protection software by saying that the code, ..."deliver enhanced features to your computer." A virus or worm could also be considered to deliver 'enhanced features'.

We believe that, though SunnComm asks the end user if it's OK to install the application, the company was deceptive in its description of what it is installing. Indeed, the software being installed is no better than a virus or worm. In effect, SunnComm's copy protection scheme is a trojan; code delivered through deception, and we wouldn't be surprised if SunnComm, itself, is liable for a lawsuit, or, at least, a legal slap on the wrist. In the very least, the company deserves a moral slap in the face.

SunnComm to sue 'Shift key' student for $10m