Legal Battles Over DVD Decryption Keys

The publication of mathematical keys and algorithms capable of decrypting Video Object (VOB) files on DVDs triggered profound legal battles at the intersection of intellectual property, trade secret law, and constitutional free speech. Emerging in the late 1990s, these controversies primarily centered on the Content Scramble System (CSS) used to protect commercial DVDs, challenging whether mathematical numbers and functional computer code could be classified as illegal contraband under the newly enacted Digital Millennium Copyright Act (DMCA).

The Origin of CSS and DeCSS

Commercial DVD-Video discs store multimedia data in VOB files, which are encrypted using CSS, a proprietary 40-bit stream cipher. Licensed DVD players held proprietary player keys required to decrypt this content. In 1999, Norwegian teenager Jon Lech Johansen ("DVD Jon") and two anonymous collaborators reverse-engineered an unencrypted software player and created DeCSS. This utility brute-forced the encryption and decrypted VOB files, enabling users to play DVDs on unapproved platforms, specifically open-source Linux systems.

Johansen published the source code online, alongside various mathematical player keys. The movie industry, represented by the Motion Picture Association of America (MPAA) and the DVD Copy Control Association (DVD CCA), swiftly intervened, arguing that publishing these keys and algorithms facilitated widespread digital piracy.

The DMCA and Universal v. Reimerdes

The most prominent legal challenge arose in Universal City Studios, Inc. v. Reimerdes. The MPAA sued Eric Corley, publisher of 2600: The Hacker Quarterly, after he published the DeCSS source code and linked to mirror sites hosting the software.

The studios asserted that distributing the decryption software violated Section 1201 of the DMCA, the "anti-circumvention" provision prohibiting the creation and distribution of technologies designed to bypass technological measures controlling access to copyrighted works.

Corley’s defense argued that computer code is a form of expression protected by the First Amendment, and that DeCSS constituted fair use by allowing interoperability on alternative operating systems. Federal District Judge Lewis A. Kaplan ruled against Corley, issuing a permanent injunction. The court recognized that while source code possesses expressive elements, its primary utility is functional—serving as an active mechanism to bypass security systems. The U.S. Court of Appeals for the Second Circuit upheld the decision, establishing that the anti-circumvention provisions of the DMCA outweighed the incidental burdens placed on speech.

Trade Secret Claims: DVD CCA v. Bunner

Concurrently, the DVD CCA pursued trade secret litigation in California state courts against Andrew Bunner and dozens of other website operators who republished DeCSS code and related decryption keys.

The DVD CCA argued that the algorithmic keys were proprietary trade secrets obtained through an unauthorized breach of licensing agreements. Bunner contended that he simply republished information already widespread across the internet, meaning the keys were no longer secret.

The California Supreme Court held that preliminary injunctions against distributing trade secrets do not violate the First Amendment if the injunction is based on a content-neutral evaluation of commercial misappropriation. However, on remand, the California Court of Appeal ruled in Bunner's favor, finding that by the time Bunner republished the DeCSS code, it had been mirrored across hundreds of websites globally, permanently eliminating its status as a legally protectable trade secret.

Protest and the "Illegal Number" Paradox

The legal attempts to suppress the publication of VOB decryption keys sparked widespread protest throughout the digital rights community. Activists sought to test the legal boundaries of whether a numerical sequence or mathematical formula could legally be suppressed.

Because CSS decryption relies on finite numerical keys, programmers and activists embedded the algorithms and keys into various creative formats:

The legal battles surrounding VOB decryption keys cemented the authority of the DMCA’s anti-circumvention rules in the United States, effectively decoupling the act of digital circumvention from the act of actual copyright infringement. The decisions affirmed that functional code that facilitates access bypass can be restricted without infringing upon First Amendment rights, creating the legal blueprint used to enforce digital rights management (DRM) across streaming services, game consoles, and modern digital media.