I am not a law professor
i am and am not a hacker.

the term hacker has undergone significant change in the last two decades so the meaning is ambiguous these days.
let me give you this definition and for the sake of the next 4 mins of my talk consider it to the the authoritative one

hackers are computer users who are adept enough to bend the function of a program to their will.

security researchers are much like the hackers of the 1990’s but unlike what the term has come to mean lately.

when researchers find security flaws in software they will generally contact the manufacturer. they are met with one of three responses:
1) disregard
2) deference
3) contempt

When met with contempt they have been threatened with law suits using a variety of novel legal theories. Reading though our history is like walking through a catalogue of existing IP frameworks. Patent, Trademark, Copyright, Contract and Criminal have all been used in response to an individual making claims that a product contains a security flaw.

examples:
In 2007 Chris Paget of security firm IOActive was going to give a talk at a security conference about the insecurity of HID badges. These badges are ubiquitous in corporate America and the issues he discovered need to be discussed. HID forced his talk to be canceled with the threat of patent infringement.

A few years earlier in 2005, researcher Mike Lynn had discovered a security flaw in Cisco routers. These devices are largely responsible for the backbone of the Internet. Interestingly Cisco had already fixed the flaw yet filed a TRO against Lynn to prevent him from talking about his work to a group of like minded peers at a security conference. In the aftermath of this incident Lynn had to agree to a permanent injunction forbidding him from ever talking about it again.

Lessig famously said that on the Internet “Code is Law”. I would like to reverse that turn of phrase for the real world.
“Law is code”
It is compiled by legislators and debugged by judges

And in this sense what the companies we write about in our paper did was impressive. They hacked the law. The bent these disparate legal frameworks to their will and used seemingly unrelated laws to silence researchers who were making claims that their product was flawed.

what our paper proposes to do is patch the law so that legal hackers can not continue to subvert the legal system anymore. And with that I’ll turn it over to Derek to explain how that would work. [pdf]

msg["koreaFail"] = “본인확인제로 인해 한국 국가 설정시 동영상/댓글 업로드 기능을자발적으로 비활성화합니다. We have voluntarily disabled this functionality on kr.youtube.com because of the Korean real-name verification law.”;

I looked into this a bit more and South Korea seems to have rallied around the death of a popular actress who killed herself due to online comments about her. The new “anti bully” law requires all sites with at least 100,000 users to verify the posters real name.

“The Cyber Defamation Law, as it’s called, went into effect on April 1st. According
to officials at the Korea Communications Commission (KCC), the country’s
broadcasting and telecommunications regulator, the law is an attempt to
quell the cyber-bullying and spread of misinformation on the internet.”

source: readwriteweb

Google is unwilling to collect this kind of data about its users and instead has opted to disable upload (and I assume comment) capabilities from South Korean IP addresses.

non commercial p2p users

and intended only for operations which sought to compete with record labels.

Full quote from the Thomas ruling[pdf]:

While the Court does not discount Plaintiffs’ claim that, cumulatively, illegal downloading has far‐reaching effects on their businesses, the damages awarded in this case are wholly disproportionate to the damages suffered by Plaintiffs. Thomas allegedly infringed on the copyrights of 24 songs ‐ the equivalent of approximately three CDs, costing less than $54, and yet the total damages awarded is $222,000 – more than five hundred times the cost of buying 24 separate CDs and more than four thousand times the cost of three CDs. While the Copyright Act was intended to permit statutory damages that are larger than the simple cost of the infringed works in order to make infringing a far less attractive alternative than legitimately purchasing the songs, surely damages that are more than one hundred times the cost of the works would serve as a sufficient deterrent.
Thomas not only gained no profits from her alleged illegal activities, she
sought no profits. Part of the justification for large statutory damages awards in
copyright cases is to deter actors by ensuring that the possible penalty for
infringing substantially outweighs the potential gain from infringing. In the case
43 of commercial actors, the potential gain in revenues is enormous and enticing to potential infringers. In the case of individuals who infringe by using peer‐to‐peer networks, the potential gain from infringement is access to free music, not the possibility of hundreds of thousands – or even millions – of dollars in profits.
This fact means that statutory damages awards of hundreds of thousands of
dollars is certainly far greater than necessary to accomplish Congress’s goal of
deterrence.
Unfortunately, by using Kazaa, Thomas acted like countless other Internet
users. Her alleged acts were illegal, but common. Her status as a consumer who
was not seeking to harm her competitors or make a profit does not excuse her
behavior. But it does make the award of hundreds of thousands of dollars in
damages unprecedented and oppressive.

Jones wrote in his opinion that equating each download with a lost sale is a faulty assumption. “Those who download movies and music for free would not necessarily purchase those movies and music at the full purchase price,” Jones wrote. “[A]lthough it is true that someone who copies a digital version of a sound recording has little incentive to purchase the recording through legitimate means, it does not necessarily follow that the downloader would have made a legitimate purchase if the recording had not been available for free.”

Maybe its time for another “Gideon” to petition the US Supreme Court. How many thousands have capitulated to the RIAA because they can’t afford an attorney? Despite being tried in a civil court aren’t these cases criminal in nature? Judge Gertner seems to suggest that defendants in RIAA cases are not receiving fair trials which is supposed to be guaranteed by the 6th Amendment. While the 6th Amendment is about criminal law the spirit of it seems to suggest cases where the defendants lives are on the line. At the time of the framing I doubt any civil case could deprive citizens of all their money and possessions. The RIAA’s end run around our legal system is denying defendants “meaningful access to the courts”. How long will this country allow the RIAA to make a mockery of our legal system?

One of the more amusing parts of the complaint is (61) where the MBTA says that Ron Rivest (a professor of these students) and the undergrads are bound by the MITnet Terms of Service and those apply to “key systems in the Commonwealth, such as the MBTA computerized Fare Media systems.”

More on this to come.

We’re sorry, but this application is not available to you. Please visit the Application Directory to find other applications.