The RISKS Digest
Volume 19 Issue 88

Both localtime() & time() are Perl equivalents of the corresponding C functions and use them internally. But what most Perl programmers probably do not know is that time(3c) will return (( time_t )-1) if it fails for any reason, so localtime(-1) will happily return a formatted date string for "Wednesday December 31, 1969".

The risks? This particular idiom is extremely common in Perl scripts of all sorts, since it's a convenient way of printing out a date or timestamp in human readable format. RISKS readers are well aware of the dangers of not explicitly checking return values, but many programmers may routinely take shortcuts such as this. After all, who expects time(3c) to ever fail? In this case, the result is harmless - visitors to the page get a good laugh. But what if the same code was recording the timestamp to a database, or using it for something important?

Federal Court holds that source code is a functional device

Back in May 1993 I had an article in RISKS Volume 14, Issue 65 about ``The risks of teaching about computers and the law'', relating how I wrote a simple encryption program for use in my course in Computing and the Law and discovered that I had to have a license from the government before I could publish the program, or even discuss it in a class if any foreign students were present.

Quite a bit has happened since then.

I filed a suit on 1 Oct 1996 challenging the constitutionality of the International Traffic in Arms Regulations (the ``ITAR'') as they applied to cryptographic software like my little demonstration program, as well as much more functional programs like Phil Zimmermann's Pretty Good Privacy. At that point matters appeared to be moving right along.

But then the President transferred the authority to regulate encryption technology to the Secretary of Commerce under the Export Administration Regulations (and thus the ITAR was replaced by the EAR). The new regulations considerably relaxed the restrictions on cryptographic software and it was, much to my relief, no longer necessary for me to get a license from the government before discussing my program or PGP with a foreign student. And the publication of encryption software in a book or a journal or in other ``hard copy'' form was no longer subject to the licensing requirements. But a license is still required under the EAR if one publishes encryption software on the Internet or the World Wide Web or in other ``electronic form''. And by that time I had collected lots of cryptographic software that I wanted to publish on my web and ftp servers, and some of it was embedded in my casebook and in a couple of law review articles that I am writing.

So it was back to the drawing board. On 2 Sep 1997, we filed a new complaint naming Secretary of Commerce Daley as the defendant, and both sides moved for summary judgment. The complaint, answer, briefs, and other documents relating to the case are available on my web site at <http://samsara.law.cwru.edu/comp_law/jvd/>.

Our position was quite simple and is summarized in our final brief: ``Making software available on the Internet and the World Wide Web is publication of that software, and publication in that medium is entitled to the unqualified protection of the First Amendment.''

The government's position was not so clear; in fact, I find it rather incoherent. It seems to argue that the publication of software amounts to using that software, and that Congress could restrict its use to prevent fraud and other criminal acts, ignoring the reality that Congress has never passed any law that forbids the use of encryption software.

But don't take my word for that. Here is what the government argued in its final brief:

The linchpin of plaintiff's First Amendment argument is that ``software is speech'' This notion is not only irrelevant to deciding the case, but has unknown and potentially harmful implications. If it were necessary to decide the matter, the more prudent judicial finding would be that encryption software, whatever its informational value, is properly treated as a functional item. The common sense understanding of software — as recognized by courts — is as a set of instructions to a computer microprocessor that enables a computer to function a certain way. . . . The common use of software is to perform tasks on a computer, ranging from word-processing, electronic mail, exploring the Internet, playing games, or encrypting data.

Much software, however, is designed to cause substantial harm. Software exists to spread and install ``viruses'' that can destroy computer hard-drives or the files they contain. Software also exists to ``hack'' into secure computer systems, such as banking and telephone systems. Such software can be used to invade privacy, commit fraud, and substantially disrupt or even endanger people's lives — not because it contains a harmful ``idea'' but because it can do harmful things. Those who transmit such software cannot validly claim they were merely distributing an ``idea'' or ``speech'' when that ``speech'' destroyed a computer hard-drive, shut down a phone system, or hacked into a bank account.

In the case of powerful encryption, there are valid uses of hardware and software in securing communications, including to prevent the harms described above. But encryption can also secure the communications of criminals, terrorists, and other hostile entities overseas, which gives rise to the government's concern over its uncontrolled export. When all the consequences are considered, the conclusion that ``software is speech,'' because some people understand the intricacies of how it works, is simplistic and should be avoided, particularly in judicial precedent.

Finally, on July 3, 1998, Federal District Court Judge Gwin of the Northern District of Ohio ruled in favor of the government, concluding that software is not constitutionally protected speech because it is ``inherently functional'', saying: ``while a recipe provides instructions to a cook, source code is a device, like embedded circuitry in a telephone, that actually does the function''.

Now some of the risks of having a legal system that simply miscomprehends the very nature of software---and that is what the government's argument and Judge Gwin's decision strongly suggest to me---should be all too apparent to the readers of this digest. I suspect, however, that there are many unknown risks lurking here as well. What, for example, is the implication of Judge Gwin's decision that source code is a device for copyrights on software?

I have created a new electronic discussion list and web site called SoftSpeech, which I hope will be a forum in which programmers and computer scientists, on the one hand, and lawyers and legal scholars, on the other, can discuss the issues raised by Judge Gwin's decision, including whether software is constitutionally protected speech or a functional device.

For further information about the SoftSpeech discussion list and Judge Gwin's decision, see <http://samsara.law.cwru.edu/~sftspch/>.

Commerce Committee approves WIPO

Here is a quick update on the House Commerce Committee consideration of the Digital Millennium Copyright Act (WIPO)

HOUSE COMMERCE COMMITTEE APPROVES H.R. 2281, DIGITAL MILLENNIUM COPYRIGHT ACT

H.R. 2281, known as the Digital Millennium Act, was approved by the House Commerce Committee on July 17 by a 41-0 unanimous vote. A total of eight amendments were considered during the mark-up. Six were adopted and two were withdrawn. There now currently exist two versions of H.R. 2281 - the Commerce version and the Judiciary version. The two versions are quite different and must ultimately by reconciled. The Commerce version is an amended version of the Senate bill, known as the Digital Millennium Act, and the Judiciary version uses language from the original House bill, known as the WIPO Copyright Treaties Implementation Act.

USACM had sent a letter to the House Commerce Subcommittee on Telecommunications, Trade and Consumer Protection on June 4, 1998 that expressed concerns about language in the bill which could prohibit legitimate efforts in encryption research and computer security. The amendments adopted by the Committee address several of the concerns raised by USACM.

1. ENCRYPTION RESEARCH - ADOPTED
   An amendment was adopted which allows a person to circumvent a technology protection measure "in the course of an act of good faith encryption research." Good faith in this case means that the person lawfully obtained the encrypted work, the act of circumvention is necessary to conduct the research, and the person made a good faith effort to obtain authorization before the circumvention. Additionally, the amendment directs the Assistant Secretary of Commerce for Communications and Information to report to Congress on the effects of the legislation on encryption research no later than one year after the enactment of the act.

2. PERSONAL PRIVACY - ADOPTED
   The adopted privacy amendment permits a person to circumvent a technological protection measure which collects or disseminates personally identifying information provided that the act of circumvention has "no other effect on the ability of any person to gain access to any work."

3. DEFINITION OF "TECHNOLOGICAL PROTECTION MEASURE" - WITHDRAWN
   An amendment defining a "technological protection measure" was vigorously debated, but ultimately withdrawn. Supporters of the amendment argued that it was necessary to preserve the constitutionality of the bill. Without a clear definition of a technological protection measure, courts would be quick to throw out cases involving the law due to the vague term. While opponents of the amendment conceded that a precise definition was necessary, they argued that the amendment as drafted provided a poor definition. Ultimately, the amendment was withdrawn with the provision that members would work together to perfect the definition in the legislative history.

4. REVERSE ENGINEERING - ADOPTED
   Unamended, the bill would allow reverse engineering only for the purposes of interoperability. An amendment was adopted that included the consideration of the extent to which claims were brought against persons who used reverse engineering in research in an annual report by the Secretary of Commerce. The report would include an assessment of the level of impediment such claims would have on the development of goods and services. Even with this amendment, however, the bill still prohibits reverse engineering for uses other than interoperability.

5. FAIR USE - ADOPTED
   For the past month, the Commerce Committee had struggled with the concern of fair use. While libraries feared that the bill would prohibit fair use rights essential to library lending, publishers feared that any legal circumvention techniques would lead to uncontrollable piracy. Early Friday morning, both sides apparently struck a compromise deal. The adopted compromise amendment delayed the prohibition of circumvention for two years, directing the Secretary of Commerce to "conduct a rulemaking on the record to determine whether users of copyrighted works have been... adversely affected by the implementation of technological protection measures..." Every two years thereafter, the Secretary could waive the prohibition for particular "classes" of copyrighted works which were adversely affected by the legislation.

The Commerce Committee is currently drafting the legislative history for the bill. Next there will be an informal conference between the House Judiciary Committee and the House Commerce Committee to reconcile the two different versions of the bill. In general, the Commerce Committee version is more in line with the positions of the USACM, though it still contains provisions that may be problematic for computer research.

Please let me know if I can provide any more information.

Japanese snake vs. railroad electrical supply

In the continuing tradition of animals versus electrical power grids, I submit this snippet from a news story of a Japanese snake, genus unknown, who gave its life making commuters late:

Electrocuted snake causes train havoc in northern Japan
Associated Press, 20 Jul 1998

Officials canceled 34 train runs after a snake crawled up an electricity pole and touched a high-voltage overhead rail wire. Railway workers later removed the charred remains of the electrocuted snake, which was 3 feet, 4 inches long. The snake's type was not immediately known.

[The lack of strong typing was not on the scales. PGN]

Another cable cut, near Jacksonville

Where have we heard this before?

The July 16th edition of the Miami Herald newspaper carried a story with the headline "Severed cable shuts down superhighway." It seems that a telephone work crew north of Jacksonville accidentally cut a cable owned by WorldCom that carries telephone and Internet traffic from Florida to the northeast (recurring theme #1). This cable handles Internet traffic for WorldCom's UUnet, which acts as part of the Internet backbone, carrying traffic between thousands of customers. There was no specific count on the number of people affected, but the paper reported "it was a significant number."

One thing that is interesting to me is how differently various South Florida service providers were affected.

America Online, which uses WorldCom and other backbone providers said it experienced temporary slowdowns. [ How could anyone tell??? ;-) ]

CyberGate, a Broward County-based ISP with 47,000 subscribers, said customers were unaffected since they don't use UUnet and have multiple connections to avoid this kind of problem.

The worst hit seems to have been Icanect, a Miami-Dade county provider for 20,000 people, who was almost totally shut down. The reason for this is that their backup provider, Cable & Wireless, experienced technical problems on the very same day. Bob Hurwitz, president of Icanect, was expecting it to take at least 24 hours to clear up his problem, and he was quoted in the paper as saying "To have both your primary and your backup both go down, that's not supposed to happen." (recurring theme #2).

Fortunately, this was only a non-fatal reminder that these kinds of things still happen and need to be accounted for.

Auckland power supply failure report released

"After a series of four power cable failures, on 20 February 1998 Mercury Energy Limited, the major distributor and retailer of electrical power to the city of Auckland, announced that it could no longer supply power to the central business district. Emergency services were notified and mobilised..."

Quote from the report of the Ministerial Inquiry into the Auckland power supply failure, issued today. Now available:

• Executive summary: http://www.executive.govt.nz/minister/bradford/power/summary.htm
• Media Release from the Minister of Energy: http://www.executive.govt.nz/minister/bradford/power/release.htm
• Inquiry Home Page: http://www.moc.govt.nz/inquiry/

ps: The lights are on, here in Auckland, now. See: http://www.webcam.co.nz/

Re: Y2K contingency plans needed (Frankston, RISKS-19.85)

That's what I thought, too. The point was raised over on the Emergency Management Net distribution list that lots of talk about identifying and fixing the problem had taken place, but that the emergency management community as a whole had been pretty much ignoring the problem of response and damage mitigation to a problem that is 18 months off (and, unlike all other disasters, can be timed quite accurately on any calendar).

In response, <VanceB4660@AOL.COM> wrote that "[t]he Y2K bug seems to mostly lurk in old COBOL code." So I decided to offer a couple of examples that had been brought up here in Risks and some pointers in the Web to embedded systems that might / will fail on Y-day. I was pounded with criticism. The most poignant attack came from <stevew@ENG.ADAPTEC.COM>, who opined that I was promulgating unfounded "Fear, Uncertainty and Doubt". Steve went on to add that "[a]ll in all, [he's] not really that concerned about Y2K."

With that attitude, it's no wonder that little if anything has been planned by the emergency management community in response to the 01-01-01. For example, FEMA has implied that few or no Y2K-*specific* preparations have been made; instead, FEMA will rely on the national response plan to deal with the (alleged) emergency like any other emergency. I hope it works; unlike others, all in all, I *am* really concerned about Y2K.

Y2K dig-gerel

Millennium Panic
Michael H. Brill, 5 June 1998

The Bug hangs off in distant skies
And stares with double-O for eyes,
Between my digits now. But soon,
It hides itself behind the moon.
Emerging on the other side--
New-grown, and much too large to hide--
It grows again. I see it nears,
Igniting all my primal fears.
(But no-one else sees this display;
They're deep into their business day.)

With jaws agape and wings unfurled,
This Bug's about to eat the world!
Now sages see the ghastly form,
And mumble that it's just the norm:
"The 'Bug' is just a trick of lights,
A cloud of dust, or must--or mites."

As evening comes, arachnid pall,
It scarcely dims the sun at all.
Though jaws envelop all the sky,
I see through them the planets fly.
Orion studs the frigid night.
I feel no heat; I find no light.
Our world, the lifeblood that we've prized
With digitalis paralyzed.
The ichor from the jaws has spread
In smaller things beside my bed.
Outside, crowds mad with fear and pain,
For lack of power their kin have slain.
As gun-filled hands my door break through,
The sages' echoes all ring true.

"They're right," I sigh with my last breath.
"A cloud of 'mights' has brought my death."

Please report problems with the web pages to the maintainer