DVD hacker Johansen indicted in Norway

[Jei]

http://www.theregister.co.uk/content/4/23633.html

--------------------------------------------------------------------------------

DVD hacker Johansen indicted in Norway
By Ann Harrison
Posted: 10/01/2002 at 19:58 GMT


Norwegian prosecutors have indicted Jon Johansen for his role in creating
the DeCSS program that unlocked a DVD copy protection system and unleashed
a series of lawsuits by the motion picture industry. 

The National Authority for Investigation and Prosecution of Economic and
Environmental Crime in Norway (OKOKRIM) indicted Johansen on January 9th
for violating Norwegian criminal code section 145(2), which prohibits the
opening of a closed document in a way that gains access to its contents,
or breaking into a locked repository. The law also prohibits the breaking
of a protective device in a way that unlawfully obtains access to the
data. 

If Johansen is found to have committed the felony for the purpose of
unlawful gain, he could serve up to two years in prison. 

"The way we understand it, the data is the content of the DVD, what you
are breaking is the encryption and what you are getting access to is the
data on the disk," said Halvor Manshaus of the Oslo law firm Schjodt,
which is representing Johansen. 

Manshaus says the law has previously been used to prosecute those who
broke into bank or phone company records. But he says this is the first
time that the law has been used to prosecute someone who broke an
encryption system. The case is expected to go to trial before summer. 

"There was a Norwegian Supreme Court ruling where this regulation has
beenapplied before, but that was a case where he was accessing or breaking
into a system that you are not legally entitled to access," said Manshaus.
"The distinction here is that he is charged with breaking a code and
accessing the data that he is allowed to access. He owned the DVD disk." 

The indictment comes more than two years after the Motion Picture
Association of America (MPAA) contacted OKOKRIM prosecutors and requested
a criminal investigation of Johansen and his father, Per, who owned the PC
on which Johansen posted DeCSS. 

Indictment follows US lawsuits 
Manshaus says the MPAA also asked OKOKRIM to charge both father and son
with contributory copyright infringement. OKOKRIM did not pursue this
charge against Jon Johansen, and Per Johansen has not been charged under
either complaint. 

Neither father, nor son is accused of breaking any U.S. laws. Johansen,
who just turned 18, was not available for comment. 

The movie industry fears that the removal of the DVD encryption could
spark unauthorized copying of DVD movies. 

But Johansen has maintained that DeCSS was intended not to make copies,
but rather to create DVD playback software for computers running the Linux
operating system. Johansen is co-founder of a group called MoRE (Masters
of Reverse Engineering). 

Two members of the group, which Johansen knew only by their screen names,
helped him develop DeCSS in 1999. The group found that the Windows-based
DVD player XingDVD from Xing Technology Corp. had not hidden its
decryption key. MoRE used this decryption key to make DeCSS. 

Manshaus says Johansen never used the utility to make copies of DVDs. 

Jan Bing, a Norwegian legal expert who testified for the EFF in a related
California civil case, concluded in a legal analysis that, "there is no
legal precedent or court decision in Norway to support a claim that
reverse engineering is a violation of Norwegian criminal law." He added
that 145(2) could, in theory, forbid the "breaking of a protective
device," to gain access to information on a disk, but he noted that there
is no supporting Norwegian precedent. 

A spokesmen for the MPAA was not immediately available for comment on the
indictment. Robin Gross, a staff attorney with the Electronic Frontier
Foundation (EFF) that has supported Johansen said the motion picture
industry has pushed Norwegian prosecutors to indict the young programmer.
"I think they just finally succumbed to Hollywood pressure," said Gross. 

"The Norwegian government finally had to bow to the demands of Hollywood
to prosecute Jon." 

In January, 2000, police entered Johansen's home and seized two personal
computers, a mobile phone, and several computer disks. Johansen was taken
to a police station and questioned for nearly seven hours and released. 

Gross says the current action against Johansen stems from two lawsuits
filed in the U.S. The first lawsuit, was brought in 1999 by the DVD
Copyright Control Association (DVD CCA) in California Superior Court,
against Andrew Bunner and others. The suit claimed that Web publishers who
posted or linked to DeCSS unlawfully misappropriated trade secrets. The
suit demanded that the publishers delete the information. While he was not
named in the suit, Jon Johansen decided to remove his link to DeCSS from
his web site. 

On November 1, 2001, the California Court of Appeals reversed the court's
preliminary injunction and confirmed that the publication of DeCSS is
protected by the First Amendment. Bunner and his legal team have asked the
court to recognize that because DeCSS is widely available on the Internet,
it cannot be considered a trade secret. 

The second case involved a federal suit in New York court against 2600
Magazine which posted the DeCSS code on its Web site. The major movie
studios sued 2600 Magazine, claiming that the Digital Millennium Copyright
Act (DMCA) bans publication of the program. 

On November 30, 2001, the Second Circuit Court of Appeals upheld a lower
court decision banning the magazine from publishing DeCSS. The court
agreed that computer programs are protected expression. But it found that
when DeCSS is published on the Internet, the fact that it could be misused
justified a complete ban on the program. 

Despite the lawsuits, Gross says that Johansen, who now works for a
software company, is respected in Norway. She notes that he was awarded
Norway's Karoline Prize given each year to a Norwegian student who
receives top grades and makes a contribution to society. Gross says the
EFF plans to coordinate protests and a letter-writing campaign similar to
that which lobbied for the release of Russian programmer Dmitry Sklyarov. 

Sklyarov was jailed and later released for distributing software that
could be used to circumvent access restrictions on Adobe's e-book format. 

"We want to get the Norwegian public to come together and put some
political pressure on the prosecutors to drop the charges against
Johansen," said Gross. 

© 2001 SecurityFocus.com All rights reserved.