5 ms·

It's worth keeping in mind that cracking DRM is pretty much universally criminally illegal these days. In the past (admittedly a long time ago now) you would h

It's worth keeping in mind that cracking DRM is pretty much universally criminally illegal these days. In the past (admittedly a long time ago now) you would have just been butting up against the game's terms of service / shrink-wrap license. Since the WIPO Copyright Treaty has been ratified in local law almost world-wide, no-one with even a semblance of professionalism would even attempt to crack DRM. So it's not like the world's best security consultants have been working on this non-stop for the last year. EDIT: Just to clarify, security firms may of course be hired/green-lit by the DRM's implementer to try break the software. However, DRM is not open season for white-hat security engineers like a lot of other areas are.

pfundstein 6y ago
Are you telling me it's illegal to reverse engineer [DRM] software that I paid for and installed on my PC? That's like making it illegal to open the bonnet of my car and take the engine apart. Or are you saying it's illegal to build a crack using my private computer? Or are you just saying it's illegal to publish that crack?
- deleted 6y ago
  [deleted]
- ev1 6y ago
  From a legal risk POV, yes, assuming US-based. It is not fair use at all, either. CFAA and DMCA are quite nasty in this regard. It gets significantly worse if, in the course of your inspection/EULA violation/whatever, you have to interact with any third party DRM [online] services for authn/authz. Then you bring even more crime into scope. Ianal, but I'm fairly certain the answer is 'yes' to every single question, even individually (the act of cracking and the act of publishing it might even be two separate crimes) EFF: > The anti-circumvention provisions of the DMCA, 17 U.S.C. 1201, prohibit circumvention of “technological protection measures” that effectively control access to copyrighted works. The law also prohibits trafficking in tools that are primarily designed for circumvention, have only limited commercially significant purpose other than circumvention or are marketed for circumvention. While section 1201 can arguably apply to any security researcher, those studying digital rights management (DRM) of music, movies or other creative content are most likely to face section 1201 claims, since Congress intended to protect these copyrighted works when it passed the statute. Researchers looking for vulnerabilities in authentication handshakes, code signing, code obfuscation, and protocol encryption also have to worry about section 1201 because vendors have argued that these also qualify as “technical protection measures” covered by the DMCA.
  - pfundstein 6y ago
    Right so how could they possibly define/prove/enforce it, since reverse engineering is essentially the act of understanding how something works by looking at it.
    - Benjamin_Dobell 6y ago
      There are examples of this specific provision of the DMCA being enforced (or at the very least being used to threaten into submission) on EFF's website. Dmitry Sklyarov, a Russian national, was even arrested and sent to jail in the US: https://www.eff.org/pages/unintended-consequences-fifteen-years-under-dmca https://www.eff.org/pages/unintended-consequences-fifteen-ye... EDIT: Probably worth noting Dmitry Sklyarov was released from jail after testifying at the trial of his employer, who were themselves then found not guilty of violating the DMCA.
  - Dylan16807 6y ago
    > It is not fair use at all, either. Fair use is a copyright term, so let's be more specific: Even when you're cracking DRM to enable copyright fair use, the act of cracking will typically be illegal.
- fulafel 6y ago
  Criminally illegal.
gjs278 6y ago
nobody goes to jail for this, the world's best security consultants would just release it anonymously.
fergie 6y ago
Although there has been a concerted effort to spreaf FUD around "Digital Rights Management" and "Intellectual Property", these things are not, generally speaking, concepts that are found in criminal law. In most (all?) jurisdictions copyright infringement is a civil matter, and there is pretty robust legislation that protects "fair use" and the "right to repair". Modifying (Removing DRM on) a piece of software that you yourself have bought is perfectly legal. Furthermore, its also legal to tell other people how to do it. https://gizmodo.com/its-perfectly-legal-to-tell-people-how-to-remove-drm-1670223538 https://gizmodo.com/its-perfectly-legal-to-tell-people-how-t...
- Benjamin_Dobell 6y ago
  > In most (all?) jurisdictions copyright infringement is a civil matter This is just absolutely 100% factually inaccurate. There are huge swaths of legislation specifically to spell out the fact that this is not the case. Please refer to the other sub-threads, particularly the information about arrests being made! > Modifying (Removing DRM on) a piece of software that you yourself have bought is perfectly legal. Not likely. At least not for any practical use cases. The point of removing "rights management" would typically be to grant yourself rights that the copyright holder did not wish to grant you. IANAL, however if you were to remove DRM, but then continue to use the software in a manner that is in line with what the rights-holder intended, then you may be okay. Although, the laws themselves indicate that facilitating removal of DRM is in itself illegal, so I wouldn't count on it. If you were to distribute any tooling, or even technical information about the removal of the DRM, then you're in clear violation. In fact, the stringency of these laws is how the case in the aforementioned Gizmodo article even came to be. Some rights-holders believed that simply mentioning the existence of DRM removal software was a violation of these laws. Fortunately, the courts ruled otherwise, but that's a far cry from publishing technical information explaining how to remove the DRM itself. From the WIPO Copyright Treaty: > Article 12 Obligations concerning Rights Management Information (1) Contracting Parties shall provide adequate and effective legal remedies against any person knowingly performing any of the following acts knowing, or with respect to civil remedies having reasonable grounds to know, that it will induce, enable, facilitate or conceal an infringement of any right covered by this Treaty or the Berne Convention: (i) to remove or alter any electronic rights management information without authority; (ii) to distribute, import for distribution, broadcast or communicate to the public, without authority, works or copies of works knowing that electronic rights management information has been removed or altered without authority. (2) As used in this Article, “rights management information” means information which identifies the work, the author of the work, the owner of any right in the work, or information about the terms and conditions of use of the work, and any numbers or codes that represent such information, when any of these items of information is attached to a copy of a work or appears in connection with the communication of a work to the public. The WIPO Copyright Treaty has been implemented all around the globe. In the US these laws are largely incorporated as part of the DMCA. The DMCA has provisions for fair use and the right to repair exemptions. However, these exemptions aren't even part of the legislation. Instead, every three years the copyright office reviews the exemptions, adding, removing and extending exemptions as they see fit. What's legal in the US now, may not be in three years time. Article 10 of WIPO Copyright Treaty allows "Contracting Parties" (signatories of the treaty) to incorporate certain exemptions in their legislation. However, it's not at all clear that this section even applies to Article 12. The US have provided exemptions, "because they can". Other countries around the globe are not so lucky. Take Australia for example, the WIPO Copyright Treaty was simply implemented as amendments to Australia's Copyright Act in 2000. Australia has no exemptions, nor any special processes to introduce them.
anoncake 6y ago
> It's worth keeping in mind that cracking DRM is pretty much universally criminally illegal these days. No, why? It isn't hard to avoid getting caught.

pfundstein 6y ago

Are you telling me it's illegal to reverse engineer [DRM] software that I paid for and installed on my PC? That's like making it illegal to open the bonnet of my car and take the engine apart. Or are you saying it's illegal to build a crack using my private computer? Or are you just saying it's illegal to publish that crack?

deleted 6y ago
[deleted]
ev1 6y ago
From a legal risk POV, yes, assuming US-based. It is not fair use at all, either. CFAA and DMCA are quite nasty in this regard. It gets significantly worse if, in the course of your inspection/EULA violation/whatever, you have to interact with any third party DRM [online] services for authn/authz. Then you bring even more crime into scope. Ianal, but I'm fairly certain the answer is 'yes' to every single question, even individually (the act of cracking and the act of publishing it might even be two separate crimes) EFF: > The anti-circumvention provisions of the DMCA, 17 U.S.C. 1201, prohibit circumvention of “technological protection measures” that effectively control access to copyrighted works. The law also prohibits trafficking in tools that are primarily designed for circumvention, have only limited commercially significant purpose other than circumvention or are marketed for circumvention. While section 1201 can arguably apply to any security researcher, those studying digital rights management (DRM) of music, movies or other creative content are most likely to face section 1201 claims, since Congress intended to protect these copyrighted works when it passed the statute. Researchers looking for vulnerabilities in authentication handshakes, code signing, code obfuscation, and protocol encryption also have to worry about section 1201 because vendors have argued that these also qualify as “technical protection measures” covered by the DMCA.
- pfundstein 6y ago
  Right so how could they possibly define/prove/enforce it, since reverse engineering is essentially the act of understanding how something works by looking at it.
  - Benjamin_Dobell 6y ago
    There are examples of this specific provision of the DMCA being enforced (or at the very least being used to threaten into submission) on EFF's website. Dmitry Sklyarov, a Russian national, was even arrested and sent to jail in the US: https://www.eff.org/pages/unintended-consequences-fifteen-years-under-dmca https://www.eff.org/pages/unintended-consequences-fifteen-ye... EDIT: Probably worth noting Dmitry Sklyarov was released from jail after testifying at the trial of his employer, who were themselves then found not guilty of violating the DMCA.
- Dylan16807 6y ago
  > It is not fair use at all, either. Fair use is a copyright term, so let's be more specific: Even when you're cracking DRM to enable copyright fair use, the act of cracking will typically be illegal.
fulafel 6y ago
Criminally illegal.

gjs278 6y ago

nobody goes to jail for this, the world's best security consultants would just release it anonymously.

fergie 6y ago

Although there has been a concerted effort to spreaf FUD around "Digital Rights Management" and "Intellectual Property", these things are not, generally speaking, concepts that are found in criminal law. In most (all?) jurisdictions copyright infringement is a civil matter, and there is pretty robust legislation that protects "fair use" and the "right to repair". Modifying (Removing DRM on) a piece of software that you yourself have bought is perfectly legal. Furthermore, its also legal to tell other people how to do it. https://gizmodo.com/its-perfectly-legal-to-tell-people-how-to-remove-drm-1670223538 https://gizmodo.com/its-perfectly-legal-to-tell-people-how-t...

Benjamin_Dobell 6y ago
> In most (all?) jurisdictions copyright infringement is a civil matter This is just absolutely 100% factually inaccurate. There are huge swaths of legislation specifically to spell out the fact that this is not the case. Please refer to the other sub-threads, particularly the information about arrests being made! > Modifying (Removing DRM on) a piece of software that you yourself have bought is perfectly legal. Not likely. At least not for any practical use cases. The point of removing "rights management" would typically be to grant yourself rights that the copyright holder did not wish to grant you. IANAL, however if you were to remove DRM, but then continue to use the software in a manner that is in line with what the rights-holder intended, then you may be okay. Although, the laws themselves indicate that facilitating removal of DRM is in itself illegal, so I wouldn't count on it. If you were to distribute any tooling, or even technical information about the removal of the DRM, then you're in clear violation. In fact, the stringency of these laws is how the case in the aforementioned Gizmodo article even came to be. Some rights-holders believed that simply mentioning the existence of DRM removal software was a violation of these laws. Fortunately, the courts ruled otherwise, but that's a far cry from publishing technical information explaining how to remove the DRM itself. From the WIPO Copyright Treaty: > Article 12 Obligations concerning Rights Management Information (1) Contracting Parties shall provide adequate and effective legal remedies against any person knowingly performing any of the following acts knowing, or with respect to civil remedies having reasonable grounds to know, that it will induce, enable, facilitate or conceal an infringement of any right covered by this Treaty or the Berne Convention: (i) to remove or alter any electronic rights management information without authority; (ii) to distribute, import for distribution, broadcast or communicate to the public, without authority, works or copies of works knowing that electronic rights management information has been removed or altered without authority. (2) As used in this Article, “rights management information” means information which identifies the work, the author of the work, the owner of any right in the work, or information about the terms and conditions of use of the work, and any numbers or codes that represent such information, when any of these items of information is attached to a copy of a work or appears in connection with the communication of a work to the public. The WIPO Copyright Treaty has been implemented all around the globe. In the US these laws are largely incorporated as part of the DMCA. The DMCA has provisions for fair use and the right to repair exemptions. However, these exemptions aren't even part of the legislation. Instead, every three years the copyright office reviews the exemptions, adding, removing and extending exemptions as they see fit. What's legal in the US now, may not be in three years time. Article 10 of WIPO Copyright Treaty allows "Contracting Parties" (signatories of the treaty) to incorporate certain exemptions in their legislation. However, it's not at all clear that this section even applies to Article 12. The US have provided exemptions, "because they can". Other countries around the globe are not so lucky. Take Australia for example, the WIPO Copyright Treaty was simply implemented as amendments to Australia's Copyright Act in 2000. Australia has no exemptions, nor any special processes to introduce them.

anoncake 6y ago

> It's worth keeping in mind that cracking DRM is pretty much universally criminally illegal these days. No, why? It isn't hard to avoid getting caught.