Last week, Dmitry Sklyarov was arrested and held without bail for allegedly “hacking” Adobe Systems’ ebook reader and committing violations of the DCMA (Digital Millineum Copyright Act).
The events leading up to the arrest are rather confusing, so I’ve put together this weblog of the facts based on the complaint that was filed to try and help explain the situation and its legal implications.
In my opinion, the most important issue this situation brings to light is the unfair way in which Sklyarov has been treated by the authorities, who didn’t seem to adequately investigate the details of his case before they arrested him and held him without bail for what has now been over a week.
(Editor’s note: Dmitry has since been released on bail since this weblog was originally published. See my follow-up weblog for the details.).
A few important facts about this case:
-
Dmitry Sklyarov was arrested on July 16, 2001, and has been held without bail ever since, after giving a public presentation about the details of how his employer’s software operates.
-
According to the complaint, Sklyarov is in violation of both Title 17, United States Code, Section 1201(b)(1)(A) “trafficking in a product designed to circumvent copyright protection measures” and 18 of the United States Code, Section 2 — “aiding and abetting”.
-
The crimes Dmitry Sklyarov is being accused of are punishable by 10 years in jail, $1,000,000, or both.
-
Dmitry Sklyarov is only an employee of the company that develops and distributes the software in question.
-
Dmitry’s employer’s alleged violations of the DCMA refer to activities that are legal under Russia law that took place in the Soviet Union.
-
One meeting, one phone call, and a two-day FBI “Independent Investigation” by a single Special Agent (Daniel J. O’Connell) was the sole basis for the Justice department’s prosecution. (See the “AFFIDAVIT FOR COMPLAINT” filed with the complaint itself for the day by day account of what transpired before Dmitry was apprehended.)
Although, at the time of this writing, Adobe has backed down from its original accusations (see the Wired News article Release the Russian, Adobe Says), the fact that the situation was allowed to occur raises serious questions about copyright law enforcement and the potential for the civil rights of individuals to be compromised as a result.
I don’t know about you, but when one meeting and a phone call with an individual’s corporate accusers is all that seems to be required to get picked up by the Feds and held without bail, I start to get a little nervous.
Scenario
Imagine, if you will, that you are a 26 year-old father of two, working on your Ph.D. at Stanford University. You are considered an expert programmer in your field of study, and are planning a trip to Russia to speak at one of the World’s most prestigious security conferences.
About two weeks before you leave, your company receives an unverified (not digitally signed) e-mail from the Anti-Piracy division of a foreign software company alleging that one of your company’s products infriges upon its copyright.
The e-mail states that your employer is in violation of foreign copyright law and asks that your company respond to the accusations within five (5) working days. The e-mail does not mention you personally by name and makes no claims regarding your personal liability in the matter.
Less than 24 hours later, your employer receives an e-mail from its ISP that it has been intimidated by the foreign accuser enough to dislodge your employer’s web site on the basis that the site is somehow involved in the illegal distribution of its software.
Since your employer’s company is under fire, and not you personally, it deals with the technical and legal logistics involved in switching to another ISP and protecting its own corporate interests.
You travel to Russia, as planned, where you publicly disseminate what you feel is vital information regarding the ease in which secure document formats can be compromised. Your presentation is well-received by your peers and your ethical conduct in making the information public is duly noted by both your contemporaries and the popular press.
The next morning, you are apprehended in your hotel room, detained by government authorities and not allowed to return home. You are incarcerated without bail and without being allowed to contact a lawyer, your employer, friends or family.
You are told that you are one of the first to be prosecuted for the willful violation of a newly instated statute that is the subject of much controversy, and that you are going to be extradited to Siberia to be processed with the other prisoners before going before a Judge who will decide your fate.
The penalties for the crime you are being accused of committing are $500,000, 5 years in jail or both, for each separate offense. Since you are being charged with two separate counts (one count of “trafficking in software to circumvent copyrightable materials” and one count of “aiding and abetting” such trafficking) you could be sentenced to 10 years in jail, $1,000,000, or both.
You may or may not realize at this point that you are being held personally responsible for your employer’s alleged copyright violations because your name appears on the splash screen of the software application in question.
The affidavit filed with the formal complaint against you reveals that you are being prosecuted as the result of a two-day “Independent Investigation” of a single KGB Special Agent based on the heresay of several officers of the Russian-based corporation that accused your company of copyright violations and that no other evidence or legal or technical expertise was obtained before the complaint was filed in criminal court.
But it doesn’t end there. After several days of being held in custody, the Russian government criminal justice system loses track of you. Not even an approximation of your whereabouts is provided to anyone, even the American consulate. After five days, you are still not allowed to contact anyone, obtain legal counsel or exercise any of the rights or freedoms you have grown accustomed to as a United States citizen.
The events described above are not being overexaggerated for dramatic effect. They are real events taking place this very instant. In fact, the only difference between this mock scenario and its real life equivalent is that the questionable legal practices and blatant civil rights violations are not being committed by a non-democratic country against an American citizen. They are being commited right here, in the democratic United States, to a Russian citizen.
US vs. Dmitry Sklyarov: Reality Check
Dmitry Sklyarov is a graduate student and father of two young children currently working on his Ph.D at Moscow State Technical University.
Dmitry became the target of an Adobe witch hunt because his name appears on the copyright splash screen of his employer’s Advanced eBook Processor software. Although Dmitry is only one of a team of programmers that worked on the software program in question (not the sole author), and despite the fact that he has literally nothing to do with his employer’s software distribution practices, he became a worthy target in the eyes of his corporate accusers due to his being in the wrong place at the wrong time: he dared to visit the United States and exercise his right to “free speech” in a public forum.
Dmitry’s employer is Elcomsoft, a developer and publisher of productivity tools. Currently, Adobe’s eBook reader is only available on Macintosh and Windows, and most ebooks are not allowed to be printed, viewed on another device, or duplicated for any purpose - even for the purposes of creating a backup copy for the rightful owner in case of hard disk failure. The software in question, Advanced eBook Processor, was created as a utility for enabling legally-obtained ebooks to be viewed on devices and platforms other than the machine used for their initial purchase.
The letters sent to Elcomsoft and RegisterNow! from Adobe that clearly do not name Dmitry Sklyarov personally, but rather the company of Elcomsoft, in their cease and dissest request. That would be like arresting a Chevron employee for publicly speaking out about its employer’s oil spills, etc.
There appears to be some confusion on the part of Adobe regarding how Elcomsoft’s Advanced eBook Processor product actually operates. The product acts upon the documents themselves to remove editing and printing restrictions. The program does not modify any of Adobe’s software applications or compromise the integrity of its encryption mechanisms in the process. As evidenced by a white paper written by Certified Adobe PDF Expert Bryan Guignard. Guignard also posted several comments on a PDF-related message board that detailed the fallacy of Adobe’s accusations.
Fair use vs. copyright protections
“Fair Use” under Russian copyright law requires that at least one back up copy be allowed. Elcomsoft’s software enabled that copy to be achieved.
Can a man become a criminal for speaking in the United States about his experiences that took place while under the employ of a Russian company operating legally under Russian Law? Surely, any pending civil disputes between American and Russian businesses do not instantly turn the Russian company’s employees into criminals.
The goal of Elcomsoft’s software product is to allow ebooks purchased legally to be viewed on platforms other than Mac and Windows (the only two platforms that the ebook reader is currently available.) A legally-entitled owner might also wish to make a copy of their work, under fair use, so that it can be viewed on their another device. (Who really only uses only one device these days for all of their digital services?)
Contrary to popular belief, the Advanced eBook processor does not “unlock” Adobe’s “eBook Reader”. The reader decrypts the files itself. Elcomsoft’s software simply saves a version of the file without any permissions, once it is already encrypted. If the user has not already paid the required legal copyright fee and obtained a password from doing so, Elcomsoft’s product will not work. (Here’s a white paper where Adobe Certified Expert Bryan Guignard explains the details.)
An EFF media release issued on July 17 quotes Jennifer Granick, Clinical Director at the Stanford Law School Center for Internet and Society, on the subject:
“The DMCA says that companies can use technology to take away fair use, but programmers can’t use technology to take fair use back. Now the government is spending taxpayer money putting people from other countries in jail to protect multinational corporate profits at the expense of free speech.”
Timeline
The timeline below was compiled from the complaint and Elcomsoft’s own accounts — (The two sets of dates match up without question, for the most part).
|
June 25, 2001
|
|
Adobe sends an e-mail to Elcomsoft saying that its Advanced eBook Processor product violates its copyright protection under the DCMA and that Elcomsoft has five days to respond by removing the offending content from its website.
|
|
June 26, 2001
|
|
In a single day, Adobe managed to:
-
Purchase a copy of the Advanced eBook Processor software through Register Now! by paying the $99 fee. (Evidence of this transaction taking place on June 26, 2001 was provided to the FBI Agent.)
-
Have Elcomsoft’s product tested once by a single engineer who confirms that it operates as represented on Elcomsoft’s own website. (This test was used as the only basis for Adobe’s determination of how exactly Elcomsoft’s Advanced eBook Processor product compromises its copyright protection mechanisms. Note that the explanation on Elcomsoft’s website is quite different than what Adobe represented to O’Connell in the complaint.)
-
Adobe contacted Elcomsoft’s ISP, Verio, to insist that it shut down Elcomsoft’s web site immediately (On the basis of Elcomsoft’s illegal distribution of Adobe’s copyrighted software.)
-
Meet in person with FBI special agent Daniel J. O’Connell (who apparently just happened to be in the neighborhood :-) to provide him with screen shots of Dmitry’s name on the splash screen of the software in question, along with assurances that “an Adobe engineer” confirmed that it “worked as Elcomsoft claimed”. (Note: If this last statement is true, Adobe is contradicting its own allegations, which are quite the contrary to what Elcomsoft claims on its website.)
|
|
June 27, 2001
|
|
Verio blocks Elcomsoft’s website (and many other websites that don’t have anything to do with Elcomsoft) by disabling access at the router level.
|
|
June 28, 2001
|
|
Adobe contacts RegNow billing service claiming Elcomsoft is guilty of the “unauthorized distribution of software” — Elcomsoft asks RegNow to stop selling Advanced eBook Processor so as not to get involved in whatever was actually taking place.
|
|
July 3, 2001
|
|
Elcomsoft publicaly announces the inherent insecurity of Adobe’s ebook protection system — not due to its encryption methods, but due to the way in which they are implemented within the ebook and other protected document formats.
|
|
July 2 and 3, 2001
|
|
O’Connell conducts a an “Independent Investigation” over a two-day period. The investigation’s only source of information is the agent’s accessing of Elcomsoft’s and Register Now!’s publicaly-available web sites. At this time he also confirms that Dmitry is speaking at the Def Con conference about the weaknesses of Adobe’s secured document technology.
|
|
July 5, 2001
|
|
O’Connell initiates a telephone conversation with Tom Diaz, Senior Engineering Manager for the eBook Development Group of Adobe, in which Diaz affirms that “he believes the Elcomsoft Software program, coupled with the Elcomsoft unlocking key, circumvents protection afforded by a technological measure developed by Adobe for its Acrobat eBook Reader either by avoiding, bypassing, removing, deactivating, or otherwise impairing the technological measure.”
Note: No security experts or legal experts appear to have been consulted in this regard. O’Connell takes Diaz’s opinion as deciding evidence.
|
|
July 7, 2001
|
|
Complaint filed by O’Connell in San Jose, CA w/ U.S. Magistrate Judge Patricia V. Trumbull (although an “attached affidavit” is referenced in the complaint, the affidavit itself is dated three days later, on July 10)
|
|
July 10, 2001
|
|
O’Connell files an affidavit which provides the “facts” of July 7, 2001 complaint.
|
|
July 15, 2001
|
|
Dmitry gives his presentation at the Def Con conference
|
|
July 16, 2001
|
|
Dmitry apprehended at hotel room in the morning and arraigned that afternoon. He is provided with a Public Defender for the arraignment, where a Judge orders him to be held without bail and removed to the Northern District of California. There, a judge will decide if he is even eligible for a public defender before he is tried and sentenced.
|
|
July 17, 2001
|
|
Dmitry is deemed “missing in action” somewhere within the U.S. penal system en route to his San Francisco destination. He is still not allowed to contact a lawyer or contact with any outside parties.
|
Below is a messageboard comment from an Elcomsoft company representative immediately after Sklyarov had been apprehended:
Comment posted on July 16, 2001
Posted By: Vladimir Katalov
Web Page: Advanced eBook Processor
Message:
As you probably know, yesterday (July 15th) we had “eBook Security:
Theory and Practice” speech on DefCon 9 conference in Las Vegas
(Nevada, USA). The main speaker was Mr. Dmitry Sklyarov, the author of
“Advanced eBook Processor”, an employee of our company (ElcomSoft).
Today, Dmitry had to return from Las Vegas to Moscow (through Los
Angeles). However, he has been hold by FBI in the airport (this was 9 a.m. PST). Since then,
we were not able to get any additional information (even through Russian consulate), except the fact that he was not boarded on the
flight to Moscow (which was about 3 pm local time).
Now it is 7:30 p.m. PST, but we still don’t know anything — where he is now, and what the actual problem is.
We will keep you informed!
Btw, we have updated our Advanced eBook Processor page — you can get the slides from our DefCon presentation (in PowerPoint format); and read a new article
about Advanced eBook Processor published at eBookWeb.org:
http://www.elcomsoft.com/Advanced eBook Processor.html
(LA Times)Company President Alexander Katalov was also in Las Vegas when Sklyarov was arrested. He said the company developed the program to allow users to copy electronic books they had bought onto multiple computers–a desktop for home and a laptop for the road, for instance.
“Dmitry was one of three programmers who worked on this,” Katalov said. “The corporation holds the copyright. I am very surprised that he was arrested.”
Resources
-
Release the Russian, Adobe Says
By Declan McCullagh,
Wired News
(July 23, 2001)
-
Adobe Tries to Quell Protest
By Declan McCullagh,
Wired News
(July 21, 2001)
-
Russian Hacker Arrested by FBI Goes Missing By Declan McCullagh (Wired News writer) On her personal web site (July 19, 2001)
-
Hacker Arrest Stirs Protest By Declan McCullagh (July 19, 2001)
-
Arrest fuels Adobe copyright fight
By Robert Lemos,
ZDNet News
(July 18, 2001)
-
Boycott Adobe campaign launches (The Register)
-
U.S. Arrests Russian Cryptographer as Copyright Violator By Jennifer 8. Lee (July 18, 2001)
-
CORRECTED: Russian Hacker Arrested After Las Vegas Convention REUTERS (July 18, 2001)
-
Welcome to Vegas, You’re Under Arrest
By Jen Muehlbauer
(July 18 2001)
-
Russian Arrested for Alleged DMCA Violations
By IDG
(July 18 2001)
-
Sklyarov Arrest Follow-up Slashdot (July 18, 2001)
-
Russian software developer arrested in Vegas
By Jeff German (July 18, 2001)
-
Programmer Arrested in E-Book Case
LA Times (July 18, 2001)
-
FBI nabs Russian expert at Def Con
By Robert Lemos, ZDNet News
(July 17, 2001)
-
Russian Author of Adobe eBook Password-Removing Software Held Without Bail, Faces Possible 5-Year Prison Term
By Wade Roush (July 16, 2001,
Updated July 17, 2001)
-
Russian Adobe Hacker Busted By Declan McCullagh (July 17, 2001)
-
Fallout From Def Con: Ebook Hacker Arrested by FBI Slashdot, (July 17, 2001)
-
Removing Those Pesky Passwords By Roger Sperberg for eBook Web
-
The Adobe Security Imbroglio
By Roger Sperberg for eBook Web,
What are your thoughts about these civil rights issues?
