7 ms·

Sony uses DMCA to silence speech that reveals its security flaws

146 points by grellas 16y ago

ijuhyftgreduy 16y ago
"Sony is also bringing a slew of outrageous Computer Fraud and Abuse Act claims.... Simply put, Sony claims that it's illegal for users to access their own computers in a way that Sony doesn't like. Moreover, because the CFAA has criminal as well as civil penalties, Sony is actually saying that it's a crime for users to access their own computers in a way that Sony doesn't like." Aren't Sony convicted computer hackers for their little cd+rootkit adventure? Did any CEO do time for that?
- Joakal 16y ago
  "According to the proposed settlement, those who purchased an XCP CD will be paid $7.50 per purchased recording and given the opportunity to download a free album, or be able to download three additional albums from a limited list of recordings if they give up their cash incentive." "The settlement requires Sony BMG to reimburse consumers up to $150 to repair damage that resulted directly from their attempts to remove the software installed without their consent. The settlement also requires them to provide clear and prominent disclosure on the packaging of future CDs of any limits on copying or restrictions on the use of playback devices, and bars the company from installing content protection software without obtaining consumers’ authorization.[34] FTC chairwoman Deborah Platt Majoras added that, "Installations of secret software that create security risks are intrusive and unlawful. Consumers' computers belong to them, and companies must adequately disclose unexpected limitations on the customer use of their products so consumers can make informed decisions regarding whether to purchase and install that content."" https://secure.wikimedia.org/wikipedia/en/wiki/Sony_rootkit https://secure.wikimedia.org/wikipedia/en/wiki/Sony_rootkit
  - ijuhyftgreduy 16y ago
    Exactly "Consumers' computers belong to them" - which is not what Sony are claiming when it comes to hacking your own Playstation.
  - btilly 16y ago
    Wouldn't it be wonderful if that court case got cited in this new case? It could both serve to argue against Sony's claim that consumers don't have the right to tinker with their product after sale, and as a demonstration of the importance of giving security researchers freedom to study consumer products.
    - rbanffy 16y ago
      > the importance of giving security researchers freedom If we are not careful about this, soon it will be required to register oneself as a security researcher. No. Everybody has the right to study whatever they own.
wheaties 16y ago
I think this is the best thing that could happen iff a group of lawyers backs up the professors all the way up to the Supreme Court. And of course, they win. I don't think any career politician will ever reverse course on the DMCA. They don't fully understand the implications and they don't want to alienate their campaign donors. Instead, we as a community will have to chip, piece by piece away at the vagrancies of a law which should never have existed in the first place.
- jorgem 16y ago
  It's unfortunate, though, that a few people's lives (the researchers) will be miserable and stressful for the next few years -- just to protect our right to free speech. The researchers deserve kudos for standing up to the bully, but it won't be a fun experience.
  - dantheman 16y ago
    One thing, I might do if I ever make crazy dotcom money is create a fund to help/reward people who make stand like this. Even if all I can do is provide them with a nice vacation every year, or hire an assistant to keep it from significantly impacting their day to day life I think it would be a great help.
    - Joakal 16y ago
      Wouldn't the long-term be better if the fund went towards lobbying for better laws? Curing the symptoms, not the disease as the saying goes.
      - dantheman 16y ago
        Agreed, but there are already funds/organizations that do that. I don't know of any that help the people who put their lives on hold while they go through these massive court cases.
      - reemrevnivek 16y ago
        Lobbying is almost entirely a question of who has the most money. In this case, it's a .com startup vs. Sony. To follow the analogy, we want to build up an immunity to the disease.
te_platt 16y ago
Does anyone here know what restrictions on the sale of an item are legal (at least in the U.S.)? If I agree to sell you item X given that you promise Y, what are the legal values of Y? For example, I can't sell you a piece of property with the restriction that you can't sell it to a racial minority in the future. Can I sell you a car with the restriction you are not allowed to look at or tamper with the engine? Note that I'm not asking whether or not it is good/moral to ask for these restrictions. But what is in fact legal.
- alex_c 16y ago
  Not a lawyer, nor do I follow this particularly closely, but - I suspect Sony is framing this as an issue of intellectual property and licensing. The DMCA wouldn't be involved otherwise.
- Joakal 16y ago
  https://secure.wikimedia.org/wikipedia/en/wiki/First-sale_doctrine https://secure.wikimedia.org/wikipedia/en/wiki/First-sale_do...
  - te_platt 16y ago
    Thanks. That covers some aspects of what I am asking but not the core. https://secure.wikimedia.org/wikipedia/en/wiki/Restrictive_covenant https://secure.wikimedia.org/wikipedia/en/wiki/Restrictive_c... covers restrictive covenants on real estate and covers the case of racial segregation that I knew about. Still not quite what I was looking for.
- eli 16y ago
  You're not allowed to restrict the resale of a house based on race because that specifically violates various laws. But it's common to sell a house with restrictions that apply to you and to all future buyers: http://en.wikipedia.org/wiki/Restrictive_covenant http://en.wikipedia.org/wiki/Restrictive_covenant
- emmett 16y ago
  There are lots of random rules about contracts. For example, terms can be struck for Unconscionability http://en.wikipedia.org/wiki/Unconscionability http://en.wikipedia.org/wiki/Unconscionability - which is pretty arbitrary. The article on EULAs is also interesting: http://en.wikipedia.org/wiki/Software_license_agreement#Enforceability_of_EULAs_in_the_United_States http://en.wikipedia.org/wiki/Software_license_agreement#Enfo...
nhangen 16y ago
I don't see how it's legal for any company to tell me what I do with my hardware once I purchase it. That's like selling me bread and telling me I can only use it for bologna sandwiches, and that PB & J is against the rules, especially if I tell someone how to make one.
- ekiru 16y ago
  Or someone selling you an operating system and telling you you can only install it on hardware purchased from them. These things are far from uncommon in technology. (I will refrain from mentioning the other example that came to mind because I don't wish to target a specific company to the exclusion of others, since such practices are widespread.)
  - reemrevnivek 16y ago
    > Or someone selling you an operating system and telling you you can only install it on hardware purchased from them. How ridiculous! Sent from my Macbook Pro
  - CrLf 16y ago
    The difference there is that software isn't sold, it's licensed. Hardware on the other hand is a physical object which is bought.
- ootachi 16y ago
  The DMCA provides the legal basis. The hardware controls access to protected works, so circumvention of it (i.e. modifying the hardware) is a crime.
  - metageek 16y ago
    But does the hardware prevent copying? It prevents you from running a game without Sony's imprimatur, but that's not the same thing. If the hardware does not effectively prevent copying, the DMCA does not apply.
wtallis 16y ago
It looks like Pamela Jones of Groklaw plans to cover this case in full. Based on her reporting, it doesn't look like things are going well for Sony so far: http://www.groklaw.net/article.php?story=20110112115731533 http://www.groklaw.net/article.php?story=20110112115731533 http://www.groklaw.net/article.php?story=20110114185542531 http://www.groklaw.net/article.php?story=20110114185542531 http://www.groklaw.net/article.php?story=20110117161946648 http://www.groklaw.net/article.php?story=20110117161946648 Apparently, they are having trouble even establishing that they have the right to sue the defendant in a California court.
SoftwareMaven 16y ago
Like their crappy products and horrible support weren't enough reasons not to buy from Sony.
- rbanffy 16y ago
  In all fairness, the PS3 is a very good gaming console. It was also interesting as a number-crunching machine a couple years back. These days, I think even a modest x86 with a cheap GPU can run rings around it for the same kind of money and much less work.
jjcm 16y ago
It's interesting that they'd risk the Streisand effect in order to instill fear into people who research these jailbreaks. Granted geohotz research already has significant media coverage, so additional air into the flame wont do all that much. Then again, in the case report it says that Sony wants geohotz research materials (his computers and his site) seized; which may imply that they think they can stop it from propagating. It's hard to say whether this is a weighed decision of Sony's or if it's simply their lawyers going after blood.
- ijuhyftgreduy 16y ago
  "Pour encourager les autres" - they don't care about Goehotz, this is aimed at lots of universities who are now drawing up guidelines about the legal consequence of doing any research into computer security. If you're Ross Anderson and Cambridge you can tell them to stuff it, if you are a new junior prof at Nowheresville U you might be persuaded to look at a new research area. 50 years ago the oil companies tried similar things to block Clair Patterson's research into lead in gasoline. If Caltech hadn't been so stubborn or there had been a law against analyzing gasoline we would still be breathing lead.
barranger 16y ago
What I find really funny is how completely opposite MS has dealt with Jailbreaking of Windows Phone. Down to offering to send geohotz a phone to play with: http://twitter.com/#!/BrandonWatson/status/27508118367772672 http://twitter.com/#!/BrandonWatson/status/27508118367772672
- rbanffy 16y ago
  If only Microsoft would be as helpful with jailbreaking the Xbox 360... Last time I checked, gaming consoles and phones had completely different business models. MS profits for every WP7 phone sold (all three of them) even if the phone manufacturer takes a loss. Sony takes a loss with every PS3 sold and recoups that from every unit of every game sold for it.
  - barranger 16y ago
    Do you really think Sony would be any different when it comes to this: http://www.engadget.com/2010/08/11/exclusive-sony-ericsson-to-introduce-android-3-0-gaming-platfor/ http://www.engadget.com/2010/08/11/exclusive-sony-ericsson-t...
    - rbanffy 16y ago
      It really depends on what the business model is. I'd say no because they are the hardware manufacturer and will be able to subsidize the phone expecting to recover the money with the games, which will, possibly, not run on other devices, despite the Android OS.

146 points by grellas 16y ago

"Sony is also bringing a slew of outrageous Computer Fraud and Abuse Act claims.... Simply put, Sony claims that it's illegal for users to access their own computers in a way that Sony doesn't like. Moreover, because the CFAA has criminal as well as civil penalties, Sony is actually saying that it's a crime for users to access their own computers in a way that Sony doesn't like." Aren't Sony convicted computer hackers for their little cd+rootkit adventure? Did any CEO do time for that?

Joakal 16y ago
"According to the proposed settlement, those who purchased an XCP CD will be paid $7.50 per purchased recording and given the opportunity to download a free album, or be able to download three additional albums from a limited list of recordings if they give up their cash incentive." "The settlement requires Sony BMG to reimburse consumers up to $150 to repair damage that resulted directly from their attempts to remove the software installed without their consent. The settlement also requires them to provide clear and prominent disclosure on the packaging of future CDs of any limits on copying or restrictions on the use of playback devices, and bars the company from installing content protection software without obtaining consumers’ authorization.[34] FTC chairwoman Deborah Platt Majoras added that, "Installations of secret software that create security risks are intrusive and unlawful. Consumers' computers belong to them, and companies must adequately disclose unexpected limitations on the customer use of their products so consumers can make informed decisions regarding whether to purchase and install that content."" https://secure.wikimedia.org/wikipedia/en/wiki/Sony_rootkit https://secure.wikimedia.org/wikipedia/en/wiki/Sony_rootkit
- ijuhyftgreduy 16y ago
  Exactly "Consumers' computers belong to them" - which is not what Sony are claiming when it comes to hacking your own Playstation.
- btilly 16y ago
  Wouldn't it be wonderful if that court case got cited in this new case? It could both serve to argue against Sony's claim that consumers don't have the right to tinker with their product after sale, and as a demonstration of the importance of giving security researchers freedom to study consumer products.
  - rbanffy 16y ago
    > the importance of giving security researchers freedom If we are not careful about this, soon it will be required to register oneself as a security researcher. No. Everybody has the right to study whatever they own.

wheaties 16y ago

I think this is the best thing that could happen iff a group of lawyers backs up the professors all the way up to the Supreme Court. And of course, they win. I don't think any career politician will ever reverse course on the DMCA. They don't fully understand the implications and they don't want to alienate their campaign donors. Instead, we as a community will have to chip, piece by piece away at the vagrancies of a law which should never have existed in the first place.

jorgem 16y ago
It's unfortunate, though, that a few people's lives (the researchers) will be miserable and stressful for the next few years -- just to protect our right to free speech. The researchers deserve kudos for standing up to the bully, but it won't be a fun experience.
- dantheman 16y ago
  One thing, I might do if I ever make crazy dotcom money is create a fund to help/reward people who make stand like this. Even if all I can do is provide them with a nice vacation every year, or hire an assistant to keep it from significantly impacting their day to day life I think it would be a great help.
  - Joakal 16y ago
    Wouldn't the long-term be better if the fund went towards lobbying for better laws? Curing the symptoms, not the disease as the saying goes.
    - dantheman 16y ago
      Agreed, but there are already funds/organizations that do that. I don't know of any that help the people who put their lives on hold while they go through these massive court cases.
    - reemrevnivek 16y ago
      Lobbying is almost entirely a question of who has the most money. In this case, it's a .com startup vs. Sony. To follow the analogy, we want to build up an immunity to the disease.

te_platt 16y ago

Does anyone here know what restrictions on the sale of an item are legal (at least in the U.S.)? If I agree to sell you item X given that you promise Y, what are the legal values of Y? For example, I can't sell you a piece of property with the restriction that you can't sell it to a racial minority in the future. Can I sell you a car with the restriction you are not allowed to look at or tamper with the engine? Note that I'm not asking whether or not it is good/moral to ask for these restrictions. But what is in fact legal.

alex_c 16y ago
Not a lawyer, nor do I follow this particularly closely, but - I suspect Sony is framing this as an issue of intellectual property and licensing. The DMCA wouldn't be involved otherwise.
Joakal 16y ago
https://secure.wikimedia.org/wikipedia/en/wiki/First-sale_doctrine https://secure.wikimedia.org/wikipedia/en/wiki/First-sale_do...
- te_platt 16y ago
  Thanks. That covers some aspects of what I am asking but not the core. https://secure.wikimedia.org/wikipedia/en/wiki/Restrictive_covenant https://secure.wikimedia.org/wikipedia/en/wiki/Restrictive_c... covers restrictive covenants on real estate and covers the case of racial segregation that I knew about. Still not quite what I was looking for.
eli 16y ago
You're not allowed to restrict the resale of a house based on race because that specifically violates various laws. But it's common to sell a house with restrictions that apply to you and to all future buyers: http://en.wikipedia.org/wiki/Restrictive_covenant http://en.wikipedia.org/wiki/Restrictive_covenant
emmett 16y ago
There are lots of random rules about contracts. For example, terms can be struck for Unconscionability http://en.wikipedia.org/wiki/Unconscionability http://en.wikipedia.org/wiki/Unconscionability - which is pretty arbitrary. The article on EULAs is also interesting: http://en.wikipedia.org/wiki/Software_license_agreement#Enforceability_of_EULAs_in_the_United_States http://en.wikipedia.org/wiki/Software_license_agreement#Enfo...

nhangen 16y ago

I don't see how it's legal for any company to tell me what I do with my hardware once I purchase it. That's like selling me bread and telling me I can only use it for bologna sandwiches, and that PB & J is against the rules, especially if I tell someone how to make one.

ekiru 16y ago
Or someone selling you an operating system and telling you you can only install it on hardware purchased from them. These things are far from uncommon in technology. (I will refrain from mentioning the other example that came to mind because I don't wish to target a specific company to the exclusion of others, since such practices are widespread.)
- reemrevnivek 16y ago
  > Or someone selling you an operating system and telling you you can only install it on hardware purchased from them. How ridiculous! Sent from my Macbook Pro
- CrLf 16y ago
  The difference there is that software isn't sold, it's licensed. Hardware on the other hand is a physical object which is bought.
ootachi 16y ago
The DMCA provides the legal basis. The hardware controls access to protected works, so circumvention of it (i.e. modifying the hardware) is a crime.
- metageek 16y ago
  But does the hardware prevent copying? It prevents you from running a game without Sony's imprimatur, but that's not the same thing. If the hardware does not effectively prevent copying, the DMCA does not apply.

wtallis 16y ago

It looks like Pamela Jones of Groklaw plans to cover this case in full. Based on her reporting, it doesn't look like things are going well for Sony so far: http://www.groklaw.net/article.php?story=20110112115731533 http://www.groklaw.net/article.php?story=20110112115731533 http://www.groklaw.net/article.php?story=20110114185542531 http://www.groklaw.net/article.php?story=20110114185542531 http://www.groklaw.net/article.php?story=20110117161946648 http://www.groklaw.net/article.php?story=20110117161946648 Apparently, they are having trouble even establishing that they have the right to sue the defendant in a California court.

SoftwareMaven 16y ago

Like their crappy products and horrible support weren't enough reasons not to buy from Sony.

rbanffy 16y ago
In all fairness, the PS3 is a very good gaming console. It was also interesting as a number-crunching machine a couple years back. These days, I think even a modest x86 with a cheap GPU can run rings around it for the same kind of money and much less work.

jjcm 16y ago

It's interesting that they'd risk the Streisand effect in order to instill fear into people who research these jailbreaks. Granted geohotz research already has significant media coverage, so additional air into the flame wont do all that much. Then again, in the case report it says that Sony wants geohotz research materials (his computers and his site) seized; which may imply that they think they can stop it from propagating. It's hard to say whether this is a weighed decision of Sony's or if it's simply their lawyers going after blood.

ijuhyftgreduy 16y ago
"Pour encourager les autres" - they don't care about Goehotz, this is aimed at lots of universities who are now drawing up guidelines about the legal consequence of doing any research into computer security. If you're Ross Anderson and Cambridge you can tell them to stuff it, if you are a new junior prof at Nowheresville U you might be persuaded to look at a new research area. 50 years ago the oil companies tried similar things to block Clair Patterson's research into lead in gasoline. If Caltech hadn't been so stubborn or there had been a law against analyzing gasoline we would still be breathing lead.

barranger 16y ago

What I find really funny is how completely opposite MS has dealt with Jailbreaking of Windows Phone. Down to offering to send geohotz a phone to play with: http://twitter.com/#!/BrandonWatson/status/27508118367772672 http://twitter.com/#!/BrandonWatson/status/27508118367772672

rbanffy 16y ago
If only Microsoft would be as helpful with jailbreaking the Xbox 360... Last time I checked, gaming consoles and phones had completely different business models. MS profits for every WP7 phone sold (all three of them) even if the phone manufacturer takes a loss. Sony takes a loss with every PS3 sold and recoups that from every unit of every game sold for it.
- barranger 16y ago
  Do you really think Sony would be any different when it comes to this: http://www.engadget.com/2010/08/11/exclusive-sony-ericsson-to-introduce-android-3-0-gaming-platfor/ http://www.engadget.com/2010/08/11/exclusive-sony-ericsson-t...
  - rbanffy 16y ago
    It really depends on what the business model is. I'd say no because they are the hardware manufacturer and will be able to subsidize the phone expecting to recover the money with the games, which will, possibly, not run on other devices, despite the Android OS.