Cracking the DVD code

WIRED: If the movie industry was trying to generate an underground internet buzz for this new production, it would have been heralded as an incredible success.

What was set up to be a big Hollywood secret has been turned, in the space of a week, into a T-shirt, a song, a puzzle, a domain name and has made headline news on all the cool blogs.

Literally hundreds of thousands of websites are talking about the hush-hush project on their pages.

Unfortunately for Hollywood, this really was a movie secret: a 20-digit number that is the key for unlocking and decoding the latest in digital home movies.

High-definition DVD, or HD-DVD, is a format with few films and few viewers out in the wild right now, but already the anti-copying measures that the movie industry's technologists wrapped around it has been broken.

Ingenious amateurs, frustrated by the new DVD hardware's insistence on preserving the worst features of the old DVD format - unskippable advertisements, impossibility to backup and incompatibility with open-source systems like Linux - have unlocked at least part of the byzantine encoding system on the new DVDs.

The heart of that "crack", as its known, is a 128-bit number. If you know that, plus another magic number which varies with each DVD and the right software, you can decrypt HD-DVDs that you have purchased and copy and manipulate them as easily as any other file on a PC.

The consumer detectives who have been investigating HD-DVD's anti-copying system since the first HD-DVD machines appeared have known and publicised that 128-bit number, known as the processing key, since late last year.

However, it's only recently that the value achieved the kind of global popularity that must have movie execs wincing at every new Google result.

Why? Late in April, Hollywood's own anti-copying enforcement agency, the Advanced Access Content System Licensing Administrator (or AACS-LA), started sending legal letters to websites that published the key, demanding that they remove the page.

In this, it would seem at least from first glance at the law that they may have some right to do.

The key, it could be argued, is part of a larger "anti- circumvention device" and therefore protected by the notoriously broad anti- circumvention provisions of the Digital Millenial Copyright Act (or DMCA) in the United States, and the European Union copyright directive in Europe.

The AACS-LA claimed that publishing the number was, in law, as bad as personally unlocking all those HD-DVDs themselves. All discussion of the number in question had to be silenced.

On the internet, such attempts at censorship always risk what is known as the "Streisand effect".

Barbara Streisand, irritated at a photography project to take pictures of the entirety of the California coastline, sued the photographer for the small slice of his project that included her beachside home.

The non-descript pictures were just a few out of 12,000 in the project. Within no time at all, the specific photographs of the Streisand property were viewed, copied and redistributed across the internet, as more and more net users heard the story and, outraged at the censorship attempt, made and labelled their own copies.

In the case of the AACS-LA key, it was even simpler to register a protest and spread the apparently forbidden fruit. The processing key is a simple number - in its most computer-friendly form, it's a sequence of just 32 letters and numbers, beginning with "09F9 . . ." You could print it in less space than this sentence.

However, when users tried to post the number on popular discussion sites like Digg.com and found their post removed by lawyer-fearing moderators, they went into overdrive, posting it wherever and whenever they could.

It's a great example of both the risks and the limits of what's described these days as the "user-generated internet".

Most publishers of content online are protected from liability for what their users do, but there are limits to that protection.

Notably, in the United States and in Europe, the courts have yet to definitively decide on their protection from users posting these "anti- circumvention tools".

That's possibly because the idea that a simple number - or even a poem describing the number or a picture including hidden symbols that spell out the number - could ever be part of a "device".

The 128-bit number that the AACS-LA so badly wanted to hide is now perhaps one of the most famous 20-digit numbers in the world. It may not quite be a victory for free speech, but it does point to the profoundly uphill battle that the movie industry is seeking to fight.

This, after all, is a number that has to remain secret, merely so that other numbers can remain secret too. Just as the processing key is just a long string of digits, so are the films and audio encoded on those DVDs, and just as easily spread around the internet.

If they can't prevent one from escaping and spreading so easily, how do they seriously expect to stop the others?