Debate heats up as student spots hole in CD protection
By Kevin Maney, USA TODAY
About every 30 seconds, the phone rings in the Phoenix offices of SunnComm Technologies. When the receptionist at the 28-employee company answers, someone on the other end curses into the phone.
That's happening because SunnComm CEO Peter Jacobs, 55, has been labeled the newest villain in the superheated battle over free copying of music files. Jacobs has faced this since tousle-haired 22-year-old Princeton University student Alex Halderman became the file-sharing crowd's latest hero.

Halderman researched SunnComm's software, which is meant to control the copying of music CDs, and concluded that the software could be defeated simply by holding down the shift key while loading a CD in a computer. On Oct. 6, Halderman posted his findings on his Web site, and word spread.

Halderman and Jacobs were flung into the kind of instant global fame only the Internet can fuel.

But there is more to this clash between a supposed hero and villain. Behind it is a complex story about two ambitious men, a generation gap, flashpoint emotions, fortunes lost and lives changed. It features a hero who might not be all that heroic, a villain who seems to be, at worst, a bumbling crisis manager, and one explosive incident that will affect the debate over music copyrights for years.

SunnComm is the leader in CD copy-protection technology, analysts say. That is practically a miracle, considering the penny-stock company was in the business of Elvis impersonators until 2000, when its founding CEO got run out of office by the Securities and Exchange Commission.

SunnComm used to be Desert Winds Entertainment. Mostly, it created so-called tribute acts, finding people who could pretend to be Elvis Presley or Madonna and booking them at clubs and casinos. The SEC said the company's two top officers, Michael Paloma and Matthew Bardasian, were illegally selling shares after a false news release pushed up the stock price. Both were fined and banned by the SEC from running public companies.

That's where Jacobs comes in. A radio personality, he had run a small telecommunications company, Inter-Exchange Carrier, for 11 years. Desert Winds stockholders asked Jacobs to turn the company around. He thought that would put him in entertainment. "I had no intention of running a company making copy control for CDs," Jacobs says.

That changed when he learned that an employee was working on copy-protection technology on the side. "Napster was raging then, and I thought it was the right thing at the right time," Jacobs says.

He renamed the company and set off in a new direction.

In 2001, SunnComm's first-generation technology was released by Music City Records on a Charley Pride CD, A Tribute to Jim Reeves. For SunnComm, it was a PR mess, and a taste of things to come.

Batman finds a Robin

Halderman had grown up using his PC as his CD player. He was also first in his Philadelphia high school class of 950 and scored a 1580 on the SATs, a mere 20 points shy of perfect. He entered Princeton in 1999 and majored in computer science just as the dot-com boom crumbled. He landed in the orbit of Ed Felten, a professor of computer security who was tangling with the Recording Industry Association of America (RIAA) for exposing flaws in copy protection.

He'd heard of copy-protected CDs that wouldn't play at all in computers — i.e., SunnComm's first-generation technology — and "thought it was interesting. I wanted to see how it worked."

Encouraged by Felten, Halderman pushed his research in that direction. When Halderman graduated in 2003, he stayed at Princeton to pursue a Ph.D. in computer science. His adviser was — and still is — Felten. In the fight against copy protection, Batman had found a Robin.

The entertainment industry has long worried about copying. In the 1980s, Hollywood tried to stop the sale of Sony Betamax VCRs. Hollywood lost in the Supreme Court.

The record labels have wanted CD copy protection for years.

People can use PCs to make flawless copies of CDs and give them to dozens of friends. PCs can also copy songs from CDs into file-sharing programs, such as Kazaa and Morpheus, which in turn allow millions of Internet users to download songs for free. The result, the RIAA says, is that CD sales are plummeting, music companies are hurting and artists are not getting the royalties due them.

Copy protection, though, is a tricky antidote. Since the first cassettes, consumers have felt they have the right to copy music they buy to share with a few friends or to mix songs onto a tape or CD.

The first copy protection attempted to end all copying. It messed with the data on the CD so PCs couldn't find songs, and so couldn't play or copy them. Macrovision, a leader in copy protection for DVDs (an easier problem because people don't expect to be able to copy movies), made a version of this kind of technology. So did SunnComm, Sony and Israel's Midbar Technologies.

The backlash was ferocious when the first copy-protected CDs arrived in 2001 and 2002. A German hacker found that scribbling with a felt-tipped pen on the rim of a Sony CD would kill the copy protection, embarrassing Sony into yanking it off the market.

A woman who bought the SunnComm-protected Pride CD sued, winning $3,000 plus remedies that forced SunnComm to change its policies. It didn't matter — it was enough to kill that version of the technology.

Copy protection seemed doomed until SunnComm went after the problem in a new way. BMG Music, one of the most aggressive about copy protection among the five major labels, signed a deal to use SunnComm's technology.

In a Sept. 15 report, J.P. Morgan analyst Sterling Auty said the BMG-SunnComm deal "will be the first major gauge of consumer acceptance of the (new) technology and a critical measuring stick for BMG."

BMG released the first CD using the technology on Sept. 23 — R&B artist Anthony Hamilton's Comin' From Where I'm From.

Testing finds flaw

Halderman read news stories about the Hamilton CD. The stories said SunnComm's technology allowed a limited number of copies but squelched copying after that. "I couldn't figure out how they could do that, just musing about it in my head," Halderman says. So he ordered the CD to research it.

Here's something Halderman didn't know: The research had already been done.

Gene Munster, an analyst for U.S. Bancorp Piper Jaffray, covers rival copy-protection company Macrovision. Seeing the threat from SunnComm, he ran extensive tests on the Hamilton CD. In a report dated Sept. 24 — one day before Halderman got his CD — Munster wrote: "We found by holding the shift key down for 30 seconds when inserting the CD, the user can circumvent the burning-copy protection." But most people, he said, won't go through the "inconvenience" of doing that, and he gave SunnComm's copy protection high marks.

The media never noticed the report, which was circulated to U.S. Bancorp clients. Neither SunnComm nor BMG worried much. Both say they knew the work-around was possible but say it was the best solution on the market.

At Princeton, Halderman went on with his tests. He discovered that SunnComm put the copy protection in a separate software program that loads into a PC the first time the CD is inserted in the PC. The software then tracks copying and stops it after a number of copies determined by the record company — could be four, 10, or any number.

In a Windows PC, the way to stop a program from automatically running is to hold down the shift key. "It's standard Windows knowledge," Halderman says. The research took about three days.

On Oct. 6, Halderman posted his work on his Web site. Felten pointed to it from his site, noting, "This technology is going to end up in the Hall of Fame beside the previous Sony technology" that could be defeated with a pen.

In the paper, Halderman claimed that SunnComm's system is "irreparably flawed." He added, "I believe anti-copy CD technologies will prove unfruitful and will therefore eventually be abandoned by record companies."

'The ambush at Princeton'

Now that the shift key work-around was on the Net for all to see, the news went global. TV news and talk shows called.

"I call it the ambush at Princeton," Jacobs says. "I did take it a little bit personally." SunnComm's stock, in 48 hours, fell 25%, from 16 cents a share to 12 cents.

Jacobs knew nothing of Halderman's research until shareholders started calling. He'd pulled SunnComm out of a crater during three years of tech-industry malaise, he says, and Halderman was out to ruin it. "He wanted to embarrass the record industry and put us out of business," Jacobs says. "I had to launch a public defense."

It turned out to be the wrong public defense.

Halderman's paper had gone beyond the shift-key trick. He also explained how to disable the SunnComm software if it already was loaded — a considerably more complicated eight-step process.

Jacobs thought that might violate the Digital Millennium Copyright Act, a controversial law that makes it a crime to aid copyright violation — perhaps by posting instructions on the Net. Jacobs invoked the DMCA, telling the news media he would sue Halderman and also have the student arrested.

That's when the world seemed to turn on Jacobs. Anonymous callers began abusing SunnComm receptionists. Employees found their photos doctored and posted on Web sites. The Electronic Frontier Foundation, a lobbying group, jumped in, saying, "It's hard to imagine any better example of how the DMCA has been misused."

Even BMG told Jacobs to back off. "They didn't want to fight the good fight," Jacobs says. "They wanted it all to go away."

Jacobs pulled back. More than likely, experts say, that took the DMCA out of the CD copy-protection debate for good.

Halderman says he was never worried. Felten told him to remain calm. Besides, after Jacobs' threats, "I received wonderful offers of financial support and legal representation," Halderman says.

From his paper, it's clear Halderman acted as both a researcher and as a young man who grew up playing and manipulating music on computers, and who felt it was his right to do so.

He has since toned down his rhetoric and put on a white hat, saying that he's helping record companies deal with piracy by letting them know the copy protection is a dead end. "The worst thing for security is a false sense of security," Halderman says.

Halderman, now something of an Internet celebrity, plans to continue his studies under Felten, and continue to work on copyright protection. But life might never return to normal. He's still getting interview and talk show requests.

Back in Phoenix, SunnComm shareholders have lost millions of dollars, and the ordeal has financially slammed Jacobs, who owns about 4% of SunnComm.

Though Jacobs hasn't reversed SunnComm's stock slide, BMG is sticking by the company. BMG considers SunnComm's system "an important first generation of the next generation of technology," says spokesman Nathaniel Brown.

He offers proof from the sales of the Hamilton CD. Unprotected CDs typically see sales drop 35% to 45% in the second week, as pirated versions circulate. Sales of the Hamilton CD fell just 23%.

On a personal level, Jacobs sounds hurt. Donning his version of a white hat, Jacobs says he thought SunnComm was helping find a solution everyone could agree on — a way for artists to get paid and consumers to have some freedom to use the music they buy.

"I'm trying to figure out how I found myself on this side of the debate," Jacobs says. "I know we're not doing God's work, but I think we're performing an important service."

SunnComm has a new version of its technology ready. BMG plans to use it. The other major record labels are interested.

This story hasn't ended yet.

my guess is that within 4 days of the release of their new version someone will have cracked it.

From impersonators to security specialists.....hmmm, sounds like time for another career change

A very interesting (and thorough) article.

Halderman's description on how to disable the SunnComm software after it was loaded on your computer may have technically been a violation of the DMCA.
But I think a strong case could also be made that people have a right to decide what programs reside on their PC.

At the very least, the CD with the SunnComm copy protection should have some sort of warning for the customer stating that any attempts to duplicate the CD in a computer will result in loading DRM software on the machine.

I read this piece yesterday and I was laughing so hard.

When will these ppl realize that if it is software, it can be broken into will they never learn, that the masses want their music and will do with as they please. THe big 5 are dying off and they are trying to take as many with them as possible.

Has anyone seen the actual Hamilton cd? Does it tell you that software will be loaded on your computer? That is a clear case of deceit if you are not made aware of programs being loaded on your pc.

"Sales of the Hamilton CD fell just 23%."

Maybe they only sold 100 copies the first week and 77 the next.

If they keep pouring money into making their products less appealing - let them.

"He offers proof from the sales of the Hamilton CD. Unprotected CDs typically see sales drop 35% to 45% in the second week, as pirated versions circulate. Sales of the Hamilton CD fell just 23%."

Proof my ass. Ummm Whats the standard deviation of the uprotected CD drop in sales? In statistics you must rule out random chance occurance before you ASSUME something you did made a difference. You can't compare a new point with an average UNLESS you do that analysis. Whats the normal variation?

"Jacobs says he thought SunnComm was helping find a solution everyone could agree on — a way for artists to get paid and consumers to have some freedom to use the music they buy."

Oh puh-leeze. Another kind soul worried about the artists. And how much of the artists' money did Jacobs' company suck up creating "copy protection" that doesn't work?

How much more are they sucking up for the "new version" of this inept technology?

This is why the artists aren't getting any royalties -- the labels are wasting it on anti-consumer stupidity.

nyer82 -- Whenever a label spouts percentages, they will never give you enough information to determine if they're just blowing smoke up the crack.

What's even funnier is that the RIAA and BMG haven't learned their lesson yet, have they?

"SunnComm has a new version of its technology ready. BMG plans to use it. The other major record labels are interested."

They are STILL going ahead with the "new version" even though it will again prove fruitless. Are the record labels that desperate or that STUPID? From the sounds of the end of this article, the answer would be a resounding YES!

Gee, maybe with all the money spent on lawsuits and copy protection they could have lowered the price of CDs. Oh, never mind, that would be the INTELLIGENT thing to do. DUH!

SunnComm should leave the copyright venue for another field, or i guess without SunnComm, we would not have much to talk about when it comes to copy protection.

I think that what SunnComm fails to realise is that any "copy protection" method that is used on Windows will ONLY, repeat, ONLY work in the Windows environment. In order for the masses not to be alienated with a non-working CD, the tracks must still be readable by CD players conforming to the Phillips Red Book standard (apologies if I got the color of the book incorrect, this is from the top of my head on a dreary Tuesday morning) of Audio Compact Discs. Regardless of what programs are installed, I'm sure that the Shift-Key sequence will undoubtably be the biggest work-around, something that Microsoft would have to completely disable (which wouldn't happen, or would it?) in order for CD protection companies like SunnComm to be successful.

Whether it be Gene Munster or Alex Halderman doing the research to find flaws in CD copy protections, the inherint secureless method of mass CD replication today doesn't allow changes to the basic way the CD's can be read, therefore, this area of technology won't change until a new format is introduced.

Similar in ways that a DVD, which is mostly ISO compliant in readability, can still be copied onto a harddrive in it's raw format without the use of any programs that defeat the copy-protection of the data on said disc. As harddrive storage start to ecplise the 300GB/500GB marks heading into the Terabyte territory, and Blu-Ray Disc technology just around the corner (up to 36GB on an DVD-type disc), Hollywood and the music industry in whole, again, is BEHIND the times.

Technology doesn't stand still in the way of progress, and I see the media (RIAA/MPAA) always lagging behind until they realise that they have to get with the program and cater to the consumers needs.

Zuckuss: Matchbox 20 has a similar CD protection scheme on their CD, and won't be playable on any Win machines without it installed, unless you bypass it via the Shift-Key press. What is amazing is that same Matchbox 20 CD can be played on an Apple or another OS without the limitations imposed by the Win software that it attempts to install.

Same can be the said with The Eminem Show CD (as example, personally, I'm not a fan at all, ick) - which can be copied, bit-for-bit without any errors on any non-Win machine without any problems. Most CD's that have the built in copy protections are for WIN machines only, thus, when played back on a non-Win machine, the embedded software is useless. I believe the consumer Phillips CDR unit also doesn't take into account the WIN copy protection programs that are installed on some CD's. It's basically an attempt by the music companies to add fodder to the disc's so that people don't rampantly copy them en mass. But as technology has proven with the SunnComm case, it still has flaws in it and will continue to do so unless the disc format it self is changed.

OK, so a CDs sales drop 35-45% during the second week.

Maybe, just maybe, its because all the die-hard fans of the artist purchased the CD during that first week

Maybe just maybe the sales of the second week didn't drop 80-95% because the die-hard fans played the CD (shared the music) for everyone they knew.

When Rush came out with different stages a few years ago, some friends didn't buy it since it was just an anthology, with no new songs. (just live performances of previously recorded stuff) After hearing my CDs, three of them decided it was worth having, and they purchased it themselves.

My point is, the sharing or try before you buy, is a critical part of most people's buying experience.

In todays post dotcom and 9/11 world, there is much less disgressionary income to go around for entertainment. If the FTAA act gets passed, there will be lots less money to go around, since many USA based jobs will move out of country.

My budget is tight enough that I had to plan and save for 6 weeks to be able to afford the extended edition of LOTR Two Towers and 4 tickets for Return of the King. That doesn't leave alot for crappy artists with one good song and lots of filler on a CD

Sorry for the off the topic post, but the 2nd week decline in CD sales made my ask "why" rather than blindly blame p2p 'arrrrggh matey' pirates

Maybe Hamilton's CD sales only fell 23% instead of 90% cause people like Haldeman (who never would have purchased it anyway) wanted to see if they could crack it just for fun

Haha... the labels are clueless. I hope they spend a freakin fortune developing CD copy protection. As far as I am concerned, they can make a CD that James Bond couldn't break into, I'm still not buying it. Boycott means boycott. They can take their crappy "artists" and their oppressive practices and go suck a lemon. I am very happy and excited with the indie scene right now.

CDs are an inherantly copyable medium. Short of switching to DVD-audio or SACD (financially almost impossible, profits would take years to recover) or produceing an effective watermark (a technical near impossility) theres nothing that can be done to prevent copying and ripping of CDs.

Sunncomm S0oooo boring hard to believe they are from here in phoenix, they and BayTsp and all the RIAA cohorts will still go on being the villain untill they get tired of being called the bad guy.