Federal Judge Rules Against Reverse-engineering

zurab writes "A federal judge in Boston threw out a challenge to the DMCA brought by the ACLU for a Harvard Law School student. Ben Edelman decided to ask court's permission to reverse-engineer the Internet filtering software made by N2H2 in fears of being sued by the company. Of interest is a quote from the ruling: "there is no plausibly protected constitutional interest that Edelman can assert that outweighs N2H2's right to protect its copyrighted material from an invasive and destructive trespass." Full story on Yahoo."

my school uses that..

and its so freaking intrusive. it once banned slashdot for "vulgar language" (how often do you see that on /.?

btw, fp!

Re:my school uses that..

I never see any fucking vulgar language on Slashdot. Those cuntbags must just be fucking out of their fuck-ass mind.

BTW, I actually am at a school that uses Bess, an N2H2 product. It banned Slashdot for being a "Message Board." I have a good mind to go there and give those networking bastards a piece of my mind.

Re:my school uses that..

Wait, wait, WTF? Since when are/should "message boards" be banned from schools?! Isn't the whole point of school (supposedly) to facilitate intellectual conversations.. DISCUSSIONS, which of course is what said "message boards" are for?

So these schools using Bess/etc. are basically saying "Go to msnbc.com / aol.com / cnn.com all you want, since they're nice big corporations, but don't discuss things amongst yourselves?" What is the justification given? Or is none at all given (as is typical nowadays)?

I am confused.

My good friend works at an office using WebSense (which both of us now call WebSenseless). It has, in the past, blocked her from accessing many perfectly legitimate sites, including my own site-- when I was trying to use my site to send her a technical document. It was very annoying.

All these years, and censorware still hasn't gotten better? This is pathetic...

Re:my school uses that..

Isn't the whole point of school (supposedly) to facilitate intellectual conversations.. DISCUSSIONS, which of course is what said "message boards" are for?

No, primary and secondary schools are designed to shift responsibilities for children off of the parents' backs, so they have someone else to blame when their child doesn't turn out to be Superman and/or Wonderwoman.

Re:my school uses that..

You make one big assumption---that given the run of all the message boards on the internet, students will only go to the "good" ones---that is, the ones that promote discussion and whatnot.

All I can say is, it must have been awhile since you were a student. The purpose of blocking message board sites is so kids dont dick around when they're supposed to be working, tying up what might be already scanty bandwith (my highschool had 1400 students with several labs and all teachers' computers on a 64k ISDN line.) doing things that are not at all school related.

Re:my school uses that..

A couple years ago, I saw a reverse-engineered list of the keywords that Bess considered illegal. In addition to the standard seven unprintable words, there were many context-sensitive words like "breast". But the really disturbing find was "MacMillan" - a rival publishing company.

OK, I'll admit some of the politically sensitive oversimplifications in their scientific textbooks were obscene, but not enough to ban them for.

Tried to find the link again, but this is the closest I could come up with on short notice:
http://danny.oz.au/freedom/censorware/ifi lter.html
I know it's not an authoritave source, but this is slashdot.

Re:my school uses that..

I think one of the main points of school is to lock kids up and keep them out of (most) trouble. But anyway...

Banning reverse engineering?!?! What's NEXT?! I bet they're going to rule against literary analysis in English! Reading too far into something would endanger the author's critical intellectual property---if we knew *how* he (or she, of course) wrote what he wrote, there would be countless knock-offs and imitators! Oh wait, there already are..... so?

Anyway.

Re:my school uses that..

have the right to protect their copyrights.

Reverse engineering is independent of copyright violation.

To break a copyright, you make copies of the material.

Reverse-engineering means you come to understand material already in your possesion.

It does not damage copyright at all, except via circular reasoning.

Re:my school uses that..

The reason my school gives for blocking Discussion sites is the idea that when we surf the internet from school, we are representing the school. By allowing us to talk on forums and boards, they are afraid we may offend someone, and that would reflect poorly on the school.

*Tongue in Cheek*

The reality of Bess is is that it is unquestionable. Most of my teachers aren't willing to walk over to my computer and type in a password every minutes so that I can actually see the pictures of Mussolini's dead body. (We are covering WWI). The problem lies with Bess and other such filtering software in that its database is inaccurate and beyond reproach. Bess used to allow you to submit webpages that it blocked for reviews, it would even email me telling whether or not the site was allowed. I would usually get a response within 4 days, and they would usually agree with me, that the site shouldn't be blocked. Now, when you try to submit the page, there is no option to allow you to give them your email addy (I didn't use my private one of course), and they don't even allow you submit freepages. They are blocked by default. Without notification, they could never get around to checking the site, and you would never know which way it went unless the site was magically unblocked one day.

I don't even get the point of having a filter at a High School. Very few people are stupid enough to be surfing Pr0n in the middle of library, so what are they afraid of? I dont't knw, maybe I'm just angry because they block /. and Penny Arcade, both of which I need to live.
Just my two bits..

P.S. This is my first post! Yay!

Re:my school uses that..

yeah. my old highschool uses bess... it was a pain in the ass. it banned the homepage of the comp sci department (hosted off campus on one of the teacher's personal servers) for being "a hate webpage" that also had kiddy porn and hacking tools. it would've been a pain, if i hadn't known the admin's username, and figured out that his passwords changed monthly, but were just the president's last names, starting from washington... last i checked, incidentally, Bess/N2H2 is under litigation for selling user browsing information in breach of their own privacy policy and contract.

my highschool

uses a filtering "service" that's always down. The NT4 proxy servers only resolve an ip correctly two tries out of three.

It's not too bad, because they have an 802.11b net my Zaurus and iBook can access as well as a "secret router" on 10.0.0.3 that I'm not supposed to know about.

BTW, the NT4 proxy is sp2; I made a single URL that can crash the proxy if entered on any school computer. They really should fire the techies and let me do the job for a gym credit.

Re:my school uses that..

Just a heads up for everyone:

N2H2's Bess currently blocks an extremely large amount of sites, including google's image search (but not the main google site). It also seemingly blocks by a number of things, including ip address (I think it performs a reverse DNS lookup on every ip as it blocks the octal and hexidecimal ips of site as well) and string. What I mean by string is that you can get to the main Web Archive site (as a loophole), but you can't enter a blocked address there and try to recieve an archive of it. Same deal with google cache.

Another thing is the shear rapidness of blocking. I started playing FlashFlashRevolution.com for about a week, and when I got back to school on monday it was blocked. I asked my Systems admin and he told me he didn't block me, so they must be monitoring bandwidth at some central station.

The FlashFlash ban got me pissed off, so I found some open proxies at my house and manually searched out the internet options control panel file (InetCpl.cpl) to change my proxy settings. Sure enough, this worked. Of course, if you need a new proxy server absolutely every web-based proxy or open proxy list is banned (and you wouldn't believe the number of bans), so I had to VNC to my freebsd box at home to get a list. Sure enough, I can now play flash flash revolution during those boring high school comp science classes.

If anyone has any other suggestions I'd love to hear them

Re:Unsigned apps can't run on some installs

The application "dwi2.exe" could not be opened, because it has not been approved by the system administrator.

C:\> ren dwi2.exe notepad.exe

Simple

Reverse engineer anyways, and publish the results anonymously.

Easy enough to do, isn't it?

Re:Simple

And when they do find you, you are instantly labeled a hacker instead of a serious researcher.

Anyway, my two cents. One, I'm seeing a trend that these lawsuits keep getting tossed because the issued involved aren't ripe. Two, how does a collection of blocked URLs constitute a copyrighted work?

Re:Simple

how does a collection of blocked URLs constitute a copyrighted work?

An individual URL might just be a fact, but a collection of facts that's more than just a simple collation (i.e. some creativity went into creating it) can be copyrighted. See this page [lawnotes.com] for more details.

On a side note, does anybody else find it hilarious that the USA Copyright Office gets asked "How do I protect my sighting of Elvis?" [copyright.gov] often enough for them to put it in their FAQ?

NO!

Reverse engineer anyways, and publish the results anonymously.

That's not good enough. Honest people should be able to do honest things in an upright manner. Honest people also demand accontablility and an anonymous list of blocked sites is worthless when the results can't be repeated elsewhere.

This ruling is absolutly outrageous. A Federal jusdge protecting a trade secret with copyright law? It's amazing that laws designed to encourage publishing have been perverted to prevent legitmate research and the useful arts. When did copyright protection of exclusive publication by an author become a prohibiton agaist READING and ANALYZING the thing published?

The following paragraph is a copyrighted ASCI text art diagram with a message protected by an ingenious electronic encryption method called French, available at bablefish [http]. It is intended to form a pleasing pattern of black and white when viewed by a browser. It may not, under any circumstances by coppied or otherwise dessiminated, not even oraly or by heliograph.

Juge Richard Stearns de zone des ETATS-UNIS, ou vous avez la merde pour des cerveaux ou Yahoo vous a fait un grand mauvais service. Si vous prolongeriez la loi de copyright aux secrets commerciaux vous êtes la plupart d'homme d'UnAmerican et avoir violé les serments de votre bureau.

Eh?

From the company's spokesman:

I think it's pretty clear that people who want to analyze and criticize filters can use tools that do not involve decryption.

And what exactly would those be - ESP? Divination with a forked stick? Tarot readings?

Re:Eh?

From the company's spokesman:

I think it's pretty clear that people who want to analyze and criticize filters can use tools that do not involve decryption.

And what exactly would those be - ESP? Divination with a forked stick? Tarot readings?

The concept exists of a "black box" analysis. In this case you use a random number generator to come up with long string of possible URL's and feed them to the program to see which ones are blocked. You could also do a sequential search, where you feed it urls like a.com, b.com, c.com and so on, through zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.com (or longer if you allow more than 32 characters before the .com) as well as combinations with legitimate symbols ('-', '.', and whatever else is considrered valid)

A random walk should get you close to a comprehensive list earlier than a seqential search, though a dictionary attack may work faster, especially if you include modified dictionary entries such as s3x, 53x, sechs, and so on.

Then again, I could be wrong. Someone might consider that to be decrypting the list.

-Rusty

Re:Eh?

...In other news today, longtime Slashdot member BJH was served with a lawsuit under the provisions of the DMCA by internet filtering company N2H2. Said David Burt, company spokesperson "We have no idea how Mr. BJH deterimined that our block list is created by a Psycic divining the locaton of several Tarot cards with a forked maple stick - he had to of de-crypted or reverse engineered it in some way."

Mr. BJH could not be reached for further comment.

Soko

A sad state of affairs...

This [slashdot.org] country [slashdot.org] is [slashdot.org] going [slashdot.org] to [slashdot.org] hell [slashdot.org]... quickly.

Write to your elected representatives [house.gov]. Do it now.

-S

Re:A sad state of affairs...

The problem is, everyone on slashdot would rather just complain on slashdot instead of actually writing thier representative a well worded letter.

I was actually thinking about this the other day. What about a slashdot sponsered letter writing compaign that gave people a tangible reward for writing a good letter to thier congress(wo)man.

They could have everyone write an email about what really matter to them, any topic, preferably a technological one as thats what scores points around here. Then have them mail them to thier representative and CC a copy to [e-mail] as well as post it as a comment. Say, 10 highest rated letters win a free subscription (however many page views that is). The cost would be negligable, but the impact of tons of well worded emails coming from intellegent people would have an amazing impact. So, editors, what do YOU think? --btw, the letters should be worded better than this post.

Re:A sad state of affairs...

Send letters, rather than emails. Emails are too easy to ignore. But otherwise, I think this is a great idea. You've convinced me to scrounge up a stamp. Let's Slashdot Congress!

Re:A sad state of affairs...

The real problem is that most /.'ers would rather browse http://www.whitehouse.com [whitehouse.com] than http://www.whitehouse.gov [whitehouse.gov].

Re:Writing your congressman works!

Just so you know, you don't need a PAC to lobby your own congresscritter. Many congresscritters are happy to hear from their constituents, and really give some consideration to what they have to say. Sadly, senators often have a much less substantial relation to their constituents.

Also, even without cash (well, other than to buy stamps and paper, or to pay the phone bill), you can get involved. A congressman almost always has a local office in their district that they visit, for at least a few weeks while Congress is not in session. You might want to talk to his staff about getting some time to visit and talk directly while your representative is in town. If you get access, do your homework ahead of time and bring copies of supporting documents that you can give (executive summaries are nice too here).

You can also offer time. If your congresscritter is doing a good job, volunteer to help on their campaign. If your congresscritter is doing a bad job, look over there opposition and see if there's someone there you'd like to help out instead. Nothing modifies a congresscritter's opinion faster than popular support for an opponent with a contrary opinion. If you hate all of these bozos, consider running yourself.

Basically, the more involved and visible you are (in a friendly, non-wacko, non-stalker sort of way), the more likely the congresscritter is to give credibility to your opinion. Involved people don't just vote, they influence other peoples' votes, and that means a lot to someone who is up for reelection every two years.

Re:A sad state of affairs...

The problem is, everyone on slashdot would rather just complain on slashdot instead of actually writing thier representative a well worded letter.

Actually, the problem is a lot of /.ers are international. We see daily just how fucked up the good ol' US of A is becoming, and can do nothing about it. Now, that's not so bad - I don't ever want to travel to the USA myself, let alone live there, but in the meantime, our own counties are threatening to follow in their footsteps, so that we can further our trade agreements.

So in that way, we whinge about the USA laws, because they will eventually influence our own laws.

Holy crap the end is near

If this stands up, it will be a kick in the teeth to freedom. A free society depends on public disclosure and peer-review. It's sickening to see how so many laws are being aimed at those two targets these days.

Re:Holy crap the end is near

I would have said something different from the parent poster: scientific and technical progress depends on public disclosure and peer review. It also depends on the freedom to investigate a problem without interference from the government or companies (as long as no one gets hurt!).

Re:Holy crap the end is near

Let us think about that for a moment. Suppose that you want to show the success or failure of a product who's maker claims the extraordinary. Back in the good old days you'd go to the store buy the product, test it out, take it apart and find out how it ticks. Most of the time you'd find out that the actual features were at a minimum technically misleading. At the end of your little test you'd post your results out to the web or tell your buddies or let other professionals know.

Now you can't own the product. It's not yours. Not only is it not yours but you can't tinker with it. Tinkering with it is illegal. If the manufacturer says it's the safest product ever devised and you suspect that it's full of holes you aren't allowed to look. If they say it has technology developed by NASA and you suspect code looted from a GPL'd product - you can't check - it's illegal.

If I'm doing a term paper on the effectiveness and accuracy of "filters" and I can't test the product, or publish my findings, how do I progress. When someone else is doing a study on the long term effects of filtering (i.e. what knowledge was lost/missed due to improper filtering) how can one do so without looking at how and what the filters filtered.

Look at some EULA's lately. One EULA I got a couple of years ago said that "reviews can only be published after the written consent of 'COMPANYX'. COMPANYX reserves the right to sole editorship of any published reviews of it's products." This meant that ANY review that you saw on the web or in a magazine they effectively wrote. The problem was trying to find any real data on the product - every review was glowing, no problems, no benchmarks, and no real information.

At the end of the day the product was a piece of crap. But the only way you could find out it was a piece of crap was by purchasing a license at 700+ per seat and doing your own testing. Which the company assured wouldn't be accurate without having a "production" environment to test against.

More and more companies are hiding behind their EULA's, patent law, trademark law, copyright law, and so called "trade secrets" to hide the fact that their products are not of the quality nor even contain the feature sets that they advertise. And the judges and the politicians give them more and more room to maneuver every day. Filtering companies claim "Advanced Artificial Intelligence" and "Intelligent Algorithms" and we can't tell that they aren't just using a handcompiled blacklist updated regularly. And these are the companies that the politicians want EVERY LIBRARY and EVERY SCHOOL SYSTEM to use for filtering. I don't reallistically think that the government is going to make the effort to keep these vendors honest so I think WE should have the ability to do so. The only way to do that is through some ability to reverse engineer their products.

Re:Holy crap the end is near

It's a clear prior restraint on freedom of speech, so I would expect the ACLU to get involved, never mind the EFF!

In fact, this type of thing has already been ruled unconstitutional [techdirt.com] in New York at least, thanks to the New York Attorney General:

About a year ago, Eliot Spitzer in New York sued Network Associates for telling people they weren't allowed to write a review of their products without Network Associates approving it first. Now, a New York judge has told Network Associates that they have to remove that language from the packaging of their products and the website, and can't do anything that would bar people from writing reviews of their software products.

(As a side note, I believe this is the way the First Amendment is stretched to include private contracts: It says "Congress shall pass no law..." but copyright law is also a federal law, and therefore copyright law cannot be construed as prohibiting free speech other than speech with which it is directly concerned, i.e. copying of other people's work.)

why make a choice?

Every company is entitled to keep trade secrets. It either that or they must patent their inventions. Patents require disclosure.

Yes patents require disclosure in return for Federal protection of the exlusive use of the thing described. They are very expensive for a company and they give away all your hard work so that others can use it.

Now, thanks to the DMCA, you don't have to chose. Neat eh? You can have your trade secrets published publically in an encrypted form and the US Government will make sure others don't tell anyone about how it works even when they are bright enough to figure it out. They will