Russian Programmer Arrested under Digital Millennium Copyright Act for Removing Security Features

Russian Programmer Arrested under Digital Millennium Copyright Act for Removing Security Features

Publications

On July 18, 2001, in the second case to be filed under the criminal provisions of the Digital Millennium Copyright Act of 1998 ("DMCA"), FBI agents arrested a Russian software programmer visiting the United States, for allegedly publishing a program that removes security features from Adobe eBook files.

In an effort to protect their software, digital content (such as music or books) and private information from piracy and unauthorized access, publishers are increasingly using encryption and other security features. Programmers all over the world try to find, and sometimes remove, such security features in software programs.

Criminal provisions of the DMCA that prohibit removing such security features from software may pose serious consequences for programmers in the United States, as well as foreign programmers visiting the United States. The DMCA makes it a federal felony to willfully circumvent encryption or other protective features limiting the copying of digital information for commercial advantage or financial gain (see a discussion of other aspects of the DMCA in our April 11, 2000 and March 13, 2001 Internet Alerts). The penalty for violating this provision of the DMCA is a maximum five-year prison sentence and $500,000 fine.

In the case involving Adobe eBook files, the programmer works for a Russian software company, which developed a product to modify the Adobe eBook format to enable installation of electronic books on more than one computer. The Russian company claims this modification is necessary to enable backups required by Russian law, to provide security that Adobe's format lacks, and generally to enable legitimate backup copies of electronic books. In contrast, Adobe claims that the removal of its copy protections is software piracy and allows unlimited (and unauthorized) copying of copyrighted electronic books, even if the intentions are harmless.

According to an FBI affidavit, the FBI began investigating this case only after a request by Adobe and a demonstration of the removal of the eBook's security features by the Russian software. Adobe requested a criminal prosecution because it thought it would be unsuccessful in a civil lawsuit. Because the company and the programmer reside in Russia, the FBI could not obtain jurisdiction over them. Only when the programmer arrived in the United States could the FBI take action.

The Electronic Frontier Foundation, a civil liberties group, is assembling a legal team for the programmer's defense, and some have called for a boycott of Adobe products. In response to the arrest, Alan Cox, a British programmer, resigned from the board of Usenix, a security-conference organizer, on grounds that it is unsafe for non-American software engineers to visit the United States. Because of these intense reactions, Adobe has recommended that the programmer be released, but the government may still choose to go forward with its prosecution.

The potential criminal prosecution of the programmer under the DMCA is significant for software publishers as well as for software engineers, both in the United States and abroad. Many software publishers believe that rogue programmers throughout the world subvert their efforts to protect their software and content. The criminal provisions of the DMCA may serve to deter programmers from modifying the security features of their products and to punish those that do so, especially if the government successfully prosecutes the programmer in the Adobe case. However, the DMCA may be unconstitutional: civil libertarians have questioned the constitutionality of the DMCA in restricting free speech, and a definitive judicial answer has yet to issue. This issue was highlighted in another case, Universal v. Reimerdes, in which a federal district court held that a "hacker" magazine's publication of software code designed to bypass certain protective features found in most DVD players constituted a violation of the DMCA. The case was recently argued on appeal before the U.S. Court of Appeals for the Second Circuit. In response to cases like these, U.S. Representative Rick Boucher has said that "there's a growing sense that the legislation is overly broad," and he plans to introduce a bill to legalize software, like the Russian software in the Adobe case, for traditional fair-use purposes.

Contributors