The rogue SSSCA

Early September 2001, close before the WTC disaster that changed history, senator Fritz Hollings proposed a new law, that in its current form has the potential to make computers as we know them illegal. That's one problem. The other problem is that it would potentially make much more illegal as well. See The Anti DMCA page and The EFF for more details.

The SSSCA (Security Systems Standards and Certification Act), if passed, will make it "unlawful to manufacture, import, offer to the public, provide or otherwise traffic in any interactive digital device that does not include and utilize certified security technologies that adhere to the security system standards adopted under section 104", with the exception of devices that already existed before the effective date.

Those certified security technologies are anti-copying measures, so you cannot make an unlimited number of copies of a CD or read an e-book on a different computer from the one it was licensed for. So to people who are not computer nerds, it may seem like a legitimate requirement for anti-piracy measures, just a reasonable technical standard, much like the requirement to have a lock on a car or fuses in electrical installations. Security and safety are so closely related to a layman and both are good: safety prevents accidents, security prevents crimes and that's it.

But in 2 or 3 years you buy a new VCR, a digital one of course. And then you start to feel uneasy because you cannot record certain TV shows, you cannot play your recorded discs in your friend's VCR, you cannot play your recordings anymore one month after recording et cetera. If you call the support line of the manufacturer of your VCR, you hear that all things you cannot do anymore are illegal and that it's a good thing that your new VCR prevents piracy. And then you record your own wedding or your own holiday trip and you stumble across similar restrictions. Then you are not so certain about the piracy thing anymore. You call the number again and then you hear that the VCR does not know the difference between the signal from your camcorder and the signal from an old copyrighted VHS tape, so it assumes it's copyrighted material. And even if your VCR knew it was the camcorder, you could have been to the cinema with your camcorder to make a bootleg copy, so restrictions would still apply.

Of course you are not a computer nerd, so you don't know or care if Linux and FreeBSD will no longer be available 2 or 3 years from now? You only wonder why the annual license fee for Windows increases by 50% each year, why there are mandatory upgrades and why new versions come with more stupid restrictions each time. At least the NOTEPAD in Windows 98 let you edit files up to 32 kilobytes. That's a lot compared to the measly 5k of Windows 2005.

Interactive digital device: life universe and everything?

The SSSCA does not only impose restrictions for personal computers, DVD recorders and other high-tech things. It does certainly apply to more than devices that store or process digitized audio and video signals. Most criticism to the SSSCA focuses on the restriction of digitized audio and video.

Look at the definition of "interactive digital device". The term "interactive digital device" means "any machine, device, product, software, or technology, whether or not included with or as part of some other machine, device, product, software, or technology, that is designed, marketed or used for the primary purpose of, and that is capable of, storing, retrieving, processing, performing, transmitting, receiving, or copying information in digital form." The central term is "information in digital form". Everything that has anything to do with this, could probably fall under this broad definition. Especially the definition of "interactive digital device" does not require that the device is electronic or that the digital information is machine-readable. There is certainly no requirement that the information represents digitized audio or video signals.

Digital means only that information is represented by a finite number of distinct symbols from a finite set. So if I write down a number using the digits 0 through 9 and the decimal point, this does qualify as digital. The alphabet is a set of 26 distinct symbols, so ordinary printed or even written text could probably qualify as information in digital form. Would you find it reasonable to put restrictions on paper and pencil? They are products whose primary purpose is storing text so they could just fit the broad definition of "interactive digital device".

Another example: teaching arithmetic skills to children. Arithmetic skills are not a traditional product that you buy in a shop, nor are they a device or machine, but they could just be a "technology". They do require mental steps, but that does not disqualify them as an "interactive digital device"; it's all about processing information in digital form. So teaching arithmetic could be a case of providing an interactive digital device according to this Orwellian reasoning.

What about life? With all this DNA copying inside living organisms, should living cells be outlawed, unless they include and utilize certified security technologies? Reductio ad absurdum.

Now back to reality. Of course in the real world there is a large difference between the letter and the spirit of a law and a prohibition on writing, mathematics or even life would certainly be not what is intended? Read the law as a mathematician and you will find absurdities in many laws. What the judges decide is much more reasonable. And there's always the Constitution, so a ban on writing materials would be ruled as "abridging the freedom of speech". But a law that does not mean as much as it says, is a bad law. Even with these considerations, nearly all digital electronic devices and all computer programs would certainly be regulated and there would be little or no doubt about how the law should be interpreted with regard to them.

One thing is exceptionally bad. The proposed bill has an extremely broad definition of what is considered an "interactive digital device", but it does not readily provide for devices that by their nature cannot conform to the requirement of including and utilizing certified security technologies. Neither does it exempt devices for which it makes no sense at all to include and utilize certified security technologies. So a mechanical music box, a pocket calculator, an electronic typewriter, it shall either include and utilize certified security technologies or it shall not be imported or manufactured at all. Bad luck for the mechanical music box! Many different (and unexpected) types of devices and products could fall victim of this regulation. The proposal states that it is OK to use your old (pre-SSSCA) printer, but new ink cartridges may become illegal to manufacture or import. Many industrial installations, vehicles, airplanes, medical systems and military systems would have to be discarded prematurely as replacement parts may no longer be legal to manufacture or import.

Of course there is a workaround for it: the security standards could specify the "null" security technology for certain types of devices, so a digital wrist watch is only required to have the "null" security technology, which is equivalent to "no security technology at all". But this workaround does require a mathematician's reading of the law, which is not commonly accepted legal practice.

The end of the general purpose computer?

If there is one device that best fits the definition of "interactive digital device", it is a general purpose computer. So all general purpose computers (and their software!) would be required to include and utilize certified security technologies. Is is just not clear what consequences this would bring for the architecture of computers and their software. Again the broadness of the definition of "interactive digital device" implies that each computer program must include and utilize certified security technologies, not just those for which it is obviously relevant. The following simple C program would probably become illegal to import or manufacture (whatever this may mean in the context of software), unless it can be made sure that the printf function somehow takes care of the requirement to utilize security technologies, in other words it checks that the string "Hello, world\n" is not copyrighted.

#include <stdio.h>

int main(void)
{
   printf("Hello, world\n");
   return 0;
}

Research in many fields of science cannot exist or would be severely handicapped without the use of computers. For many applications it is necessary to write specific programs for the task. The Human Genome Project would be impossible without computers and efficient computer programs to order the massive amount of information from DNA sequences. Physics, astronomy and chemistry owe much of their recent progress to the use of computers. If researchers cannot write custom programs for their own research, this research would be unnecessarily impaired. For some types of scientific research, special purpose digital hardware must be built, which would certainly be infeasible if it must be SSSCA compliant. Other types of research (research of human hearing, analysis of engine noise) would require audio signals to be digitally recorded, analyzed and stored. This would most likely be impossible with SSSCA compliant hardware and software.

The general purpose computer enabled the USA to stay ahead in the nuclear arms race and to make manned space flights possible, to name just a few things. Engineering and innovation depend on computers just as much as scientific research. State of the art computer technology is necessary to develop the next generation of integrated circuits. The same is true for airplanes, pharmaceuticals and many other products.

Even the movie industry itself (who designed the SSSCA in the first place) would be hindered by the SSSCA. Many motion pictures contain computer generated animation. The tools to generate these animations may well be illegal under the SSSCA. For some motion pictures the animations were generated on computers running Linux.

Research in computer science may come to a standstill if new computer architectures or operating systems may not be built without being SSSCA compliant. For education purposes it is necessary to let students do low level programming on small systems. There are now operating systems that are freely available in source form (such as Linux and FreeBSD). These are an invaluable resource for computer science research and education, not to mention a cheap alternative to more established operating systems. Open source operating systems will most likely not meet SSSCA standards (even if they technically could implement the copy control measures, there are issues of patents and the requirement of not being easily modifiable).

The Internet would not have existed if the SSSCA existed from the start. As the SSSCA prohibits all interactive digital devices, unless they include and utilize certified security technologies, it is not possible to build a new type of product for which the standards for certified security technologies are not yet defined. It takes much more to update standards than it takes to innovate, especially if the product in question does not exist yet or has no market share. New types of digital products will certainly not be developed in the USA or any country that adopts a law like the SSSCA. Had the SSSCA existed in 1980, we would have used telegrams instead of emails.

The requirement to include and utilize certified security technologies would increase the price and reduce the efficiency of computer systems across the entire spectrum, from tiny embedded systems to mainframes and supercomputers. Tiny embedded systems will need a bigger processor, require more memory and consume more power to accommodate the security technology. The I/O throughput of larger systems would be reduced. At the same time reliability would be reduced, if only by the increased complexity. But what if the control system of a nuclear reactor decides to zero all its outputs because it detected some watermark in the data passing through it? For some real-time systems the response time would increase, as data passing through the system must be checked for copyright infringement. A longer response time could reduce the safety and effectiveness of industrial machines, aircrafts and weapon systems.

Journalists, please leave your laptops and cameras at home!

Every tourist would carry in his luggage a camera, a radio, an electric shaver, a PDA, an alarm clock or all of the above, Add to this the watch that you wear and some people carry necessary medical equipment like pacemakers or insulin pumps. At least some of these devices are regulated under the SSSCA. People enter the USA from countries where such devices are not regulated under the SSSCA. Carrying anything into the USA counts as import, whether or not there is the intention to sell the item inside the USA.

This means that tourists would be required to keep many of their personal belongings at home. This is either not enforceable or it would scare tourist away from the USA. It is also possible to permit tourists to take their electronic stuff to the USA, but require all items to be declared. If a tourist leaves the USA with less than he entered, the tourist would be jailed. This too would scare tourists away. If you do not enforce it, there is the risk of tourists smuggling all kinds of noncompliant equipment into the USA.

Tourists are one thing, but foreign students, employees and researchers would also avoid the USA. Tell foreign journalists to leave their noncompliant laptops and cameras at home. That would mean bad press for the USA.

Anyway, there will remain a huge demand for noncompliant devices and these will be smuggled from countries where the SSSCA does not apply. This would remain a big problem, at least until all civilized countries adopt the SSSCA. Where demand exists and supply is prohibited, there is a huge breeding ground for organized crime. Remember the Prohibition? Remember the War or Drugs?

The Constitution of course

First of all, the SSSCA (or more likely a variation of it that does not require wrist watches to have Pentiums and lithium ion batteries just to check the time of day for copyright infringement), will impose restrictions on equipment and software that is capable of copying and recording audio and video signals. In the USA there are already mandatory restrictions on digital consumer audio recorders. A singer songwriter cannot just record his own songs on his Minidisc or DAT recorder and make unlimited digital copies of them, which is probably an unconstitutional restriction of free speech. Fortunately he can spend a few bucks more and buy a professional recorder without this restriction, which is probably cheaper than challenging the law on constitutional grounds. Now there are PC's anyway and these are "professional" devices, because offices are full of them.

With the SSSCA, it would not be as simple as buying a "professional" recorder or PC to get the technical capability to make unlimited digital copies of your own recorded songs (or your recorded speeches). You will have to mess with an established security system, which would require obtaining a certificate of some sorts. This may require lots of paperwork. Maybe you even need to become a member of some organization and be subjected to all sorts of restrictions. Maybe it is not even open to individuals at all, so you have to do business with a record label. As the number of singer songwriters who wish to distribute their own songs is small compared to the number of consumers who want to have free copies of copyrighted CD's, politicians are all too willing to turn a blind eye to this constitutional issue.

But this free speech restriction will not remain limited to recorded audio and video. The publishers are all too eager to apply the same principle to e-books. E-books are just a special case of electronic texts (with some pictures in between). If all technical protections really work, you could still type the text from an e-book into a word processor. A traditional book can be scanned and OCR'ed. The same is true for an e-book that can be printed. So if it is found reasonable to restrict unlimited distribution of recorded audio, so the same may be true for wordprocessor documents. Remember, the SSSCA in its current form does not say anything about the type of digital information that must be restricted, so wordprocessor documents would already be restricted.

So the SSSCA or the laws that will be really accepted, will eventually restrict what you can do with text documents that you type yourself and are your own work. Obtaining the technical capability to make an unlimited number of electronic or printed copies or to distribute your document to an unlimited number of recipients, would probably require your text to be screened, which is censorship. The text that goes into your web pages or email will also be subjected to censorship. Nearly all paper publications are prepared using computers, so putting restrictions on the computers and software used in the preparation of these publications, is a restriction of the free press.

Computer programs consist of words and symbols and are written by humans, so they are a form of speech. As the SSSCA puts restrictions on nearly all computer programs, it would conflict with the First Amendment. The free speech position of computer programs is controversial. In a case dealing with crypto export controls, a judge decided that computer program source code printed on paper is free speech and that machine readable source code is not. This distinction is strange, certainly if it were applied to ordinary text documents.

Of course this is just an American issue?

The SSSCA is not only harmful to the USA, it could affect the freedom in the rest of the world as well. The USA thinks it rules the world and many civilized countries agree with that. Software patents were first enforced in the USA and later they were introduced in Japan. Europe will be next. Laws like the DMCA are also emerging around the world.

The "The Hague" Convention is a proposed treaty that makes it possible to prosecute infringement of intellectual property rights in all contries, not just in the country where the infringement was made. Therefore software writers world wide may be prosecuted if their software somehow emerges in the USA. As the SSSCA is sufficiently copyright-related, infringement of the SSSCA could also be covered by this convention. This is especially harmful for authors of open source software.

Conclusion

The proposed SSSCA in its current form is a major threat to freedom and democracy in the USA and other parts of the civilized world. Since the Nazi regime in Germany the Western world has not had such threatening and damaging proposal. Not only freedom, but also the economic, technological and military leadership of the USA would be in severe danger. Finally this proposal conflicts with the First Amendment of the US Constitution.