Russian Programmer Held By FBI

Posted by jeme (Thursday July 19 2001 @ 11:14PM PDT)

A Russian computer programmer was arrested by the FBI on Monday after giving a presentation at an annual computer security conference in Las Vegas. Dmitry Sklyarov is being taken to the district of northern California for arraignment. Mr. Sklyarov's lecture at the DefCon-9 conference was entitled "E-Book Security: Theory and Practice". He was arrested at the behest of Adobe Systems, a San Jose-based software company responsible for PhotoShop, Illustrator and Premiere (all popular graphics packages for Microsoft Windows and MacOS).

Dmitry wrote a program for his employer Elcomsoft of Moscow that takes a document in Adobe's eBook format and outputs a regular PDF document. The eBook format is designed to extremely limit a person's ability to make use of the words and pictures in a book. A person can read and view the document, but there is no printing, no cutting and pasting, no ability to highlight, underline, or otherwise mark the book, no facility for taking notes in the margins or excerpting passages into other documents.

These are all features that we take for granted when we buy a book. Also, the eBook is "tied" to a particular computer system and can only be decoded for reading on that system. If you copy the document to your laptop, the reader software will reject it. If you are done with it and want to pass it on to a friend, it will not work and your friend would have to pay for the use of it on his computer as well. We think nothing of giving away (or selling to recoup our costs) a book when we are finished reading it, but this format makes that impossible.

In Russia, every person is gauranteed the right to make copies for backup or personal use of any work regardless of that work's copyright status or any license imposed in the acquisition of a copy of the work. Therefore, AEBPR is a valuable and legal utility to have and use in Russia.

While Dmitry Sklyarov is said to hold the copyright for the program, his employer Elcomsoft is responsible for distribution of the work. According to the provisions of 1998's Digital Millenium Copyright Act (US Code Title 17 Section 1201), trafficking in a device to circumvent a "technological protection measure" that "effectively controls access" to a work is a crime punishable by up to five (5) years in prison and 0,000 fine.

In at least one case, the "technological protection measure" that "effectively controls access" was a simple Caesar cypher. That is to say, the letters of the document were simply shifted a fixed number of characters across the alphabet. This is the sort of encryption a grade-schooler might use to make his classroom notes unreadable by his enemies. The invention of this system is (however aprocyphally) attributed to Julius Caesar, making it the oldest encryption scheme known to man.

While Dmitry is the copyright holder and primary author of the work, this work was done in a country in which such work is legal and encouraged. The distribution of the work in this country was done by Elcomsoft, a Russian company.

Dmitry Sklyarov is a graduate student in his native Russia where he has a wife and two children. Since his arrest, he has had no contact with Russian Consul or his family, associates and friends. The above is all fact.

Now for some interpretation and opinion: First, the DMCA (Digital Millenium Copyright Act) seems to protect, and is certainly being used to protect, the ability of a corporation to add new controls to their already granted copyright monopolies by simply adding technological measures that "effectively" protect the few rights a copyright holder can legitimately claim and inhibit any other actions the copyright holder finds unsavory. In essence, I can take a work like this one: I AM A CRIMINAL, PLEASE INCARCERATE ME UNDER THE DMCA. Submit it to my "encryption scheme" and get: V NZ N PEVZVANY, CYRNFR VAPNEPRENGR ZR HAQRE GUR QZPN. Now, distribution of a "device" that decodes this message could be construed as illegal under the DMCA.

Forget the fact that every unix system and every USENET newsreader in the world has the capability to do what is called ROT13 translation (shifting every character 13 characters to the right, so that A becomes N, B becomes O, etc.), which is the scheme I used to "encrypt" my message above.

Second, is Dmitry Sklyarov responsible for the actions of his employer (distributing a circumvention device)? Even if he wrote the program single-handedly, he wasn't the entity doing the distributing. Not to mention the fact that all of it was written by a foreign national in a foreign nation. What jurisdiction does the US have to imprison such a man? Beyond that, his work on the eBook was part of his doctoral thesis (and hence, his authority to speak on the subject at DefCon 9) and is clearly the work of a scientist for academic purposes.

If we have come to a point where the FBI is prosecuting employees of a corporation for the crimes committed by the corporation, I'd like to submit my list. The Electronic Frontier Foundation has offered legal counsel, but has been denied access to Dmitry so far (as has everyone else).

There is a protest outside Adobe Systems' headquarters in San Jose, California on Monday, 23 July, 2001 at eleven o'clock in the morning. They will meet across the street from the Adobe building (I believe the tallest building in San Jose) in Plaza de Cesar Chavez near the statue of Quetzecoatl.

There are several solidarity protests at both Adobe offices and federal buildings throughout the country. I am working with the EFF and anyone else that can help to organize a solidarity action in Portland to be held in front of the federal building at the designated time. We will talk about the case, pass out flyers, and hopefully just make a strong showing to stop this international atrocity. Other cities hosting solidarity actions are Denver, Seattle, Chicago, Boston, an d Moscow.

Visit the demonstration coordination site There is also talk of an IT walk-out (more of a sick-out) in solidarity to show that information workers will not be treated this way. The day of the walk-out has not yet been determined.