numbers aren't just numbers
Ed Felten has an interesting post up this morning discussing the 09-f9 HD-DVD key and why the net has been replicating it so enthusiastically. He has a number of explanations for why people are showing such antipathy toward the AACS LA's efforts to suppress the key. I'm most interested in the second one, because it's pretty widespread and very, very silly:
...the content in question is an integer — an ordinary number, in other words. The number is often written in geeky alphanumeric format, but it can be written equivalently in a more user-friendly form like 790,815,794,162,126,871,771,506,399,625. Giving a private party ownership of a number seems deeply wrong to people versed in mathematics and computer science. Letting a private group pick out many millions of numbers (like the AACS secret keys), and then simply declare ownership of them, seems even worse
While it’s obvious why the creator of a movie or a song might deserve some special claim over the use of their creation, it’s hard to see why anyone should be able to pick a number at random and unilaterally declare ownership of it. There is nothing creative about this number — indeed, it was chosen by a method designed to ensure that the resulting number was in no way special. It’s just a number they picked out of a hat. And now they own it?
As if that’s not weird enough, there are actually millions of other numbers (other keys used in AACS) that AACS LA claims to own, and we don’t know what they are. When I wrote the thirty-digit number that appears above, I carefully avoided writing the real 09F9 number, so as to avoid the possibility of mind-bending lawsuits over integer ownership. But there is still a nonzero probability that AACS LA thinks it owns the number I wrote.
When the great mathematician Leopold Kronecker wrote his famous dictum, “God created the integers; all else is the work of man”, he meant that the basic structure of mathematics is part of the design of the universe. What God created, AACS LA now wants to take away.
Okay, so it's a little melodramatic. But you can see his point. He's not alone in this, either: BoingBoing has been petulantly maintaining that if we all just pretend the number is being used for other purposes, it'll be just dandy to redistribute it.
I'm no fan of DRM, and I think the AACS LA's actions are pointless and stupid. But Doctorow and Felten are being disingenuous — they're simply too smart not to see the problem with this argument. Namely, that any type of data, sampled at a chosen level of precision, can be represented as a number. Consequently, if you believe that one or more types of information deserve legal protection — as Felten seems to, when he refers to songs & movies — then the argument that "it's just a number!" becomes ridiculous.
Sixteen bytes is probably too short to merit a copyright. But that's not the right that the AACS LA is asserting: they're calling the code a "circumvention device" under the DMCA. And even if you don't recognize the DMCA's validity, there are other forms of intellectual property protection that may apply — there are laws related to trade secrets, for example. If you just think about it a little, it should be obvious that even a very short piece of data can enjoy some kinds of legal protection. Sixteen bytes is more that enough room to encode the words "Coca-Cola", after all.
The thing is, geeks like to pretend that the legal system is some sort of Rube Goldberg contraption, easily foiled by their unparalleled cleverness. Sadly, this isn't the case. All the IANAL-prefixed prattling on Slashdot about quick & easy ways to make yourself legally bulletproof when the cops/MPAA/interpol come knocking are little more than wishful thinking. It's like holding your finger an inch from your sibling's face and yelling, "I'm not touching you!" over and over. Your parents weren't dumb enough to fall for that, and neither is the legal system.
So yes, if you accidentally used these colors in a design, I doubt you'd be breaking the law. If you wrote this terrible poem by chance, you'd be fine. But if you provided either intentionally, as a way of transmitting a "circumvention device", then you broke the law. It's entirely possible for a judge to make reasonable inferences about what you probably intended to do. I don't know where people got the idea that courtrooms are run by robots that'll start spewing sparks & smoke if you feed them a logical paradox. It just ain't so.
Most of all, I'm surprised by Felten saying that making a number protected will irk "people versed in mathematics and computer science" most of all. In fact, the people who don't understand why a number could deserve protection are the ones who sat through their CS and information theory classes but emerged without actually understanding the point of it all. Information is information. The fact that it can be encoded in many different ways is neat — it's nearly magical, in fact, and the very essence of why digital technology is so amazingly powerful — but doesn't change its essential nature. Refusing to admit that numbers are only protected in context reveals either ignorance of these ideas or simple denial of them.
crossposted at EchoDitto Labs
Comments
I don't think Felton is being disingenuous. He wrote down a 30 digit number in the context of it being "like" an encryption key. He later disclaimed that it was actually an encryption key. But suppose that it really was. Suppose it was one of the undisclosed keys. Would not AACS sue? Would you like to bet large sums of legal fees that a judge would find their suit ridiculous? Perhaps the judge would think the disclaimer 'like holding your finger an inch from your sibling's face and yelling, "I'm not touching you!"' Felton writes about encryption all the time. He gives examples. His risk is small, but not non-zero.
Remember Felton has been sued under DMCA for his professional activities before. Back in 2001, IIRC, he withdrew a paper on digital watermarks from a conference after being threatened by SDMI and the RIAA.
Jim, the "non-zero" risk of randomly pulling out a 30 digit number that matches a specific encryption key is 0.0000000000000000000000000001%. Described in other terms, if everyone in the world picked one such number every second, it still wouldn't happen by chance before the sun explodes.
So I'm not sure re-designing laws to take into account the possibility of such an occurrence makes a whole lot of sense.
Jim, the point I was trying to make is that disallowed use of the number depends on the context of the use -- not just on the mathematical identity of the number itself (or the way in which it's represented).
The idea of "owning a number" is good rhetoric gambit, but it's misleading (I suppose that's why it's good rhetoric). The question here is not ownership of intellectual property (which tends to be problematic, and is especially so in the case of a necessarily shared resource like an integer), but whether a particular piece of information can be redistributed for a particular purpose. In this case the answer is "no".
Whether that information can be represented mathematically is irrelevant, since all information can be represented mathematically.
I've been saying the same thing for years.
gz:
Yes. The chance of picking a single 30 digit number is miniscule. The AACS has, though, "reserved" several million numbers. That chops a whole bunch of zeros off the likelihood of landing on one. The penalty for picking one is likely to end up in the six digit dollar range. Of course AACS is going to sue: you're playing games with them; the likelihood you picked one of their numbers by chance is so tiny, it must be you know their numbers. Even so, I concede that the mathematical expectation of loss from printing a random 30 digit number in the context of an encryption key is a small fraction of a penny. You're worse off buying a lottery ticket. But it is still the mathematical expectation of a loss. And a law that imposes an expectation of loss on everyone who writes about encryption is a bad law, particularly one that in no case does anyone any good.
Tom:
I understand that context matters. But some of us do talk about encryption and some of us do want to pick numbers as examples in that context. I originally trained as a pure mathematician before I turned to the dark side and worked on computers. And small numbers, numbers that I could conceive of writing down, were to me then like the air. Free to my use. Free to everyone else's use, too. And now, in a context that I might want to use them, there are a set of small numbers that have been secretly fenced off: I may not use them in my chosen context; I may not even know what they are. And I do find that offensive.
You larger point is correct. Eben at the FSF used to say, perhaps still does, that since a novel or a piece of music can be represented by a number it shouldn't be protected. But that number is so big and the context in which it represents the creative work so narrow, that we don't in practice mind the infringement on our access to the integers.
But there is a conflict. Over time, the range of integers which could be considered "small" has expanded to include larger and larger numbers. The range of integers which represent protectable intellectual property has expanded to include smaller and smaller numbers. Sooner or later they would collide. The collision has occurred. What do we do about it?
I don't know, it seems they are effectively claiming owership over a number. You can't copyright it (too short), it's not a trade secret because it is no longer secret, and patent protection won't get you anywhere. The line between using the number to circumvent a digital protection scheme is meaningless, as any use of the number, even referencing it in a scholarly article, could be deemed a violation of the DMCA.
As for any data being reprensted by a number--sure, you can't translate harry potter into numbers and then sell the book of numbers, because you are creating a derivative work based on something that has copyright protection. But that is not what is going on here.
I agree with everything except that I note that using someone else's trade secret is perfectly legal, as long as you don't steal it or acquire it by otherwise unethical means--even if you get it by reverse engineering it. The DMCA is another matter, of course, as are various other IP-related laws.
Jim, there could be 10 billion numbers such reserved numbers--and the chance of *anyone* in the world picking one randomly, even if that's all they did, is still vanishingly small. Say 10^10 numbers, 10^10 people, picking one number every couple seconds (10^7/year) and it still will come up once every thousand years.
To translate it into your financial terms: the average burden that his law, with a say 10 million dollar fine attached, places on someone who did *nothing* but list 30 digit numbers his whole adult life would be well under a tenth of a cent. I just can't see this as such an unreasonable risk that justice is offended.
Tom's point is more relevant, though. Similarly, any word I've just typed in my post could be a password to some secure account. It would (often) be illegal to disseminate that word as a password, but in normal context using that same word is fine. This seems like a perfectly sensible arrangement to me, and no one claims someone "owns" that word. I don't see how the key being a 30-digit number instead of an English word makes the setup illogical.
"The line between using the number to circumvent a digital protection scheme is meaningless, as any use of the number, even referencing it in a scholarly article, could be deemed a violation of the DMCA."
This is not the case. It only seems that way because so many people are trying to be smartasses and pointing out various ways they might "accidentally" mention the number without actually intending to distribute a means of circumventing the DMCA.
17 USCA 1201 reads, in part,
(2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that--
(A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;
(B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or
(C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.
That's only a small part of the federal code on this issue. But take a look. Note the "produced for the purpose of." That means that your intent is relevant.
Patrick:
"That means that your intent is relevant." True. But intent is determined at trial. Trial costs money. At the end of the trial, it has been determined that I didn't produce the number for the purpose of circumventing. Great. I won. I'm still bankrupt.
Ah yes. The inevitable spectre of crushingly expensive frivolous litigation.
There are a great number of legal issues that are only resolvable at trial, and yet which don't lead to constant litigation of marginal cases. This is because there are quite a few safeguards to prevent frivolous litigation from proceeding, and because legal standards and norms quickly arise which clarify what is and what is not acceptable behavior. Further, legitimate actors tend to have the motivation to make sure they're not running afoul of the law in advance, so norms of behavior arise in their professions and communities.
Not to mention: How, precisely, do you expect that you will have produced the number for an actual legitimate purpose but in such a manner that an argument that your purpose was illegitimate is credible enough to get you through 12(b) motions to dismiss, through summary judgment, and into a trial?
When I say an actual legitimate purpose, I mean an ACTUAL legitimate purpose, as opposed to producing it for an illegitimate purpose while maintaining a shallow pretense of legitimacy because you were relying on legal advice from slashdot.