DVD hacker Johansen indicted in Norway

National govt prostrates itself for Hollywood lobbyists

Norwegian prosecutors have indicted Jon Johansen for his role in creating the DeCSS program that unlocked a DVD copy protection system and unleashed a series of lawsuits by the motion picture industry.

The National Authority for Investigation and Prosecution of Economic and Environmental Crime in Norway (OKOKRIM) indicted Johansen on January 9th for violating Norwegian criminal code section 145(2), which prohibits the opening of a closed document in a way that gains access to its contents, or breaking into a locked repository. The law also prohibits the breaking of a protective device in a way that unlawfully obtains access to the data.

If Johansen is found to have committed the felony for the purpose of unlawful gain, he could serve up to two years in prison.

"The way we understand it, the data is the content of the DVD, what you are breaking is the encryption and what you are getting access to is the data on the disk," said Halvor Manshaus of the Oslo law firm Schjodt, which is representing Johansen.

Manshaus says the law has previously been used to prosecute those who broke into bank or phone company records. But he says this is the first time that the law has been used to prosecute someone who broke an encryption system. The case is expected to go to trial before summer.

"There was a Norwegian Supreme Court ruling where this regulation has beenapplied before, but that was a case where he was accessing or breaking into a system that you are not legally entitled to access," said Manshaus. "The distinction here is that he is charged with breaking a code and accessing the data that he is allowed to access. He owned the DVD disk."

The indictment comes more than two years after the Motion Picture Association of America (MPAA) contacted OKOKRIM prosecutors and requested a criminal investigation of Johansen and his father, Per, who owned the PC on which Johansen posted DeCSS.

Indictment follows US lawsuits

Manshaus says the MPAA also asked OKOKRIM to charge both father and son with contributory copyright infringement. OKOKRIM did not pursue this charge against Jon Johansen, and Per Johansen has not been charged under either complaint.

Neither father, nor son is accused of breaking any U.S. laws. Johansen, who just turned 18, was not available for comment.

The movie industry fears that the removal of the DVD encryption could spark unauthorized copying of DVD movies.

But Johansen has maintained that DeCSS was intended not to make copies, but rather to create DVD playback software for computers running the Linux operating system. Johansen is co-founder of a group called MoRE (Masters of Reverse Engineering).

Two members of the group, which Johansen knew only by their screen names, helped him develop DeCSS in 1999. The group found that the Windows-based DVD player XingDVD from Xing Technology Corp. had not hidden its decryption key. MoRE used this decryption key to make DeCSS.

Manshaus says Johansen never used the utility to make copies of DVDs.

Jan Bing, a Norwegian legal expert who testified for the EFF in a related California civil case, concluded in a legal analysis that, "there is no legal precedent or court decision in Norway to support a claim that reverse engineering is a violation of Norwegian criminal law." He added that 145(2) could, in theory, forbid the "breaking of a protective device," to gain access to information on a disk, but he noted that there is no supporting Norwegian precedent.

A spokesmen for the MPAA was not immediately available for comment on the indictment. Robin Gross, a staff attorney with the Electronic Frontier Foundation (EFF) that has supported Johansen said the motion picture industry has pushed Norwegian prosecutors to indict the young programmer. "I think they just finally succumbed to Hollywood pressure," said Gross.

"The Norwegian government finally had to bow to the demands of Hollywood to prosecute Jon."

In January, 2000, police entered Johansen's home and seized two personal computers, a mobile phone, and several computer disks. Johansen was taken to a police station and questioned for nearly seven hours and released.

Gross says the current action against Johansen stems from two lawsuits filed in the U.S. The first lawsuit, was brought in 1999 by the DVD Copyright Control Association (DVD CCA) in California Superior Court, against Andrew Bunner and others. The suit claimed that Web publishers who posted or linked to DeCSS unlawfully misappropriated trade secrets. The suit demanded that the publishers delete the information. While he was not named in the suit, Jon Johansen decided to remove his link to DeCSS from his web site.

On November 1, 2001, the California Court of Appeals reversed the court's preliminary injunction and confirmed that the publication of DeCSS is protected by the First Amendment. Bunner and his legal team have asked the court to recognize that because DeCSS is widely available on the Internet, it cannot be considered a trade secret.

The second case involved a federal suit in New York court against 2600 Magazine which posted the DeCSS code on its Web site. The major movie studios sued 2600 Magazine, claiming that the Digital Millennium Copyright Act (DMCA) bans publication of the program.

On November 30, 2001, the Second Circuit Court of Appeals upheld a lower court decision banning the magazine from publishing DeCSS. The court agreed that computer programs are protected expression. But it found that when DeCSS is published on the Internet, the fact that it could be misused justified a complete ban on the program.

Despite the lawsuits, Gross says that Johansen, who now works for a software company, is respected in Norway. She notes that he was awarded Norway's Karoline Prize given each year to a Norwegian student who receives top grades and makes a contribution to society. Gross says the EFF plans to coordinate protests and a letter-writing campaign similar to that which lobbied for the release of Russian programmer Dmitry Sklyarov.

Sklyarov was jailed and later released for distributing software that could be used to circumvent access restrictions on Adobe's e-book format.

"We want to get the Norwegian public to come together and put some political pressure on the prosecutors to drop the charges against Johansen," said Gross.

© 2001 SecurityFocus.com All rights reserved.

Other stories you might like

  • How ICE became a $2.8b domestic surveillance agency
    Your US tax dollars at work

    The US Immigration and Customs Enforcement (ICE) agency has spent about $2.8 billion over the past 14 years on a massive surveillance "dragnet" that uses big data and facial-recognition technology to secretly spy on most Americans, according to a report from Georgetown Law's Center on Privacy and Technology.

    The research took two years and included "hundreds" of Freedom of Information Act requests, along with reviews of ICE's contracting and procurement records. It details how ICE surveillance spending jumped from about $71 million annually in 2008 to about $388 million per year as of 2021. The network it has purchased with this $2.8 billion means that "ICE now operates as a domestic surveillance agency" and its methods cross "legal and ethical lines," the report concludes.

    ICE did not respond to The Register's request for comment.

    Continue reading
  • Fully automated AI networks less than 5 years away, reckons Juniper CEO
    You robot kids, get off my LAN

    AI will completely automate the network within five years, Juniper CEO Rami Rahim boasted during the company’s Global Summit this week.

    “I truly believe that just as there is this need today for a self-driving automobile, the future is around a self-driving network where humans literally have to do nothing,” he said. “It's probably weird for people to hear the CEO of a networking company say that… but that's exactly what we should be wishing for.”

    Rahim believes AI-driven automation is the latest phase in computer networking’s evolution, which began with the rise of TCP/IP and the internet, was accelerated by faster and more efficient silicon, and then made manageable by advances in software.

    Continue reading
  • Pictured: Sagittarius A*, the supermassive black hole at the center of the Milky Way
    We speak to scientists involved in historic first snap – and no, this isn't the M87*

    Astronomers have captured a clear image of the gigantic supermassive black hole at the center of our galaxy for the first time.

    Sagittarius A*, or Sgr A* for short, is 27,000 light-years from Earth. Scientists knew for a while there was a mysterious object in the constellation of Sagittarius emitting strong radio waves, though it wasn't really discovered until the 1970s. Although astronomers managed to characterize some of the object's properties, experts weren't quite sure what exactly they were looking at.

    Years later, in 2020, the Nobel Prize in physics was awarded to a pair of scientists, who mathematically proved the object must be a supermassive black hole. Now, their work has been experimentally verified in the form of the first-ever snap of Sgr A*, captured by more than 300 researchers working across 80 institutions in the Event Horizon Telescope Collaboration. 

    Continue reading
  • Shopping for malware: $260 gets you a password stealer. $90 for a crypto-miner...
    We take a look at low, low subscription prices – not that we want to give anyone any ideas

    A Tor-hidden website dubbed the Eternity Project is offering a toolkit of malware, including ransomware, worms, and – coming soon – distributed denial-of-service programs, at low prices.

    According to researchers at cyber-intelligence outfit Cyble, the Eternity site's operators also have a channel on Telegram, where they provide videos detailing features and functions of the Windows malware. Once bought, it's up to the buyer how victims' computers are infected; we'll leave that to your imagination.

    The Telegram channel has about 500 subscribers, Team Cyble documented this week. Once someone decides to purchase of one or more of Eternity's malware components, they have the option to customize the final binary executable for whatever crimes they want to commit.

    Continue reading
  • Ukrainian crook jailed in US for selling thousands of stolen login credentials
    Touting info on 6,700 compromised systems will get you four years behind bars

    A Ukrainian man has been sentenced to four years in a US federal prison for selling on a dark-web marketplace stolen login credentials for more than 6,700 compromised servers.

    Glib Oleksandr Ivanov-Tolpintsev, 28, was arrested by Polish authorities in Korczowa, Poland, on October 3, 2020, and extradited to America. He pleaded guilty on February 22, and was sentenced on Thursday in a Florida federal district court. The court also ordered Ivanov-Tolpintsev, of Chernivtsi, Ukraine, to forfeit his ill-gotten gains of $82,648 from the credential theft scheme.

    The prosecution's documents [PDF] detail an unnamed, dark-web marketplace on which usernames and passwords along with personal data, including more than 330,000 dates of birth and social security numbers belonging to US residents, were bought and sold illegally.

    Continue reading

Biting the hand that feeds IT © 1998–2022