Jon Lech Johansen

Background

Jon Lech Johansen was born on 18 November 1983 in Harstad, Norway, to a Norwegian father and a Polish mother. Largely self-taught as a programmer, he left high school during his first year to concentrate on software work. By his mid-teens he was active in the online communities around Linux, media playback and reverse engineering, which brought him into contact with the problem that would define his public reputation: commercial DVD-Video discs could not legally or practically be played on free operating systems.

DVD encryption and DeCSS

Commercial DVD-Video discs are protected by the Content Scramble System (CSS), a digital rights management and encryption scheme introduced around 1996 that uses a proprietary 40-bit stream cipher. The short key length reflected United States cryptographic export restrictions of the period. Because CSS player keys were issued only under licence, there were no authorised DVD players for Linux or BSD systems, and licensed playback software was unavailable to users of those platforms.

DeCSS, released on 6 October 1999, was one of the first freely available programs capable of decrypting commercially produced DVD-Video discs. It was the work of three people, two of whom remained anonymous behind the handles "mdx" and "the nomad" and who reverse-engineered the decryption algorithm; Johansen, then fifteen, wrote the graphical user interface and became the only participant publicly identified. The release drew immediate attention because CSS proved far weaker than assumed: in November 1999 the researcher Frank A. Stevenson published cryptanalytic attacks derived from leaked DeCSS source code, including a method for recovering disc keys from hash values that ran in under 18 seconds on a 450 MHz Pentium III processor. The effective strength of CSS was subsequently reckoned at closer to 16 bits than 40.

Legal proceedings in Norway

Legal threats against websites distributing DeCSS began in early November 1999, and in January 2000 a preliminary injunction was issued in the American case DVD Copy Control Association, Inc. v. Bunner. In 2000 Norwegian police raided Johansen's home. Following complaints by the DVD Copy Control Association and the Motion Picture Association, Norwegian authorities prosecuted him in 2002 under a provision of the penal code concerned with unlawful access to protected data.

The verdict was announced on 7 January 2003, acquitting Johansen of all charges. Prosecutors appealed, and on 22 December 2003 the appeals court upheld the acquittal. On 5 January 2004 Norway's economic crime unit declined to pursue the matter to the Supreme Court, and later that month the DVD Copy Control Association dropped its own case against him. The outcome was widely reported internationally as a defeat for the film industry's attempt to criminalise the analysis of a consumer copy-protection system.

Later work on digital rights management

Johansen continued to publish tools that unpicked media protection schemes. In 2001 he released OpenJaz, drivers for a portable MP3 player. In 2003 he wrote QTFairUse, an early utility aimed at Apple's FairPlay DRM in the iTunes Store, and in 2004 contributed FairPlay support to the VLC media player. In 2005 he co-wrote PyMusique, a third-party iTunes Store client, and worked for the digital music company MP3tunes in San Diego. He moved to San Francisco in 2006 to work with DoubleTwist Ventures.

The company doubleTwist Corporation was established in San Francisco in March 2007 by Monique Farantzos and Johansen, with Farantzos as president and chairman and Johansen as chief executive. Its software, launched in 2008, converted and synchronised media libraries across devices, and a later Android application positioned itself as an alternative to iTunes syncing. In 2009 the company drew press attention for an advertisement placed near an Apple retail store, which was subsequently removed.

Recognition and legacy

Johansen received the Norwegian Karoline Prize in January 2000, and in 2002 the Electronic Frontier Foundation gave a Pioneer Award to the writers of DeCSS, alongside that year's other recipients Dan Gillmor and Beth Givens. His nickname "DVD Jon" became shorthand in technology journalism for the individual hacker positioned against the entertainment industry's legal apparatus.

The significance of the DeCSS episode lies less in the program itself than in what followed it. The leaked source code enabled public cryptanalysis of CSS and informed the libdvdcss library that made DVD playback routine on free operating systems. The litigation it triggered on both sides of the Atlantic became a standard case study in how anti-circumvention statutes interact with reverse engineering, interoperability and the publication of security research, and Johansen's acquittal is regularly cited in arguments that analysing a protection mechanism is not equivalent to infringing the works it protects.

Timeline

• 1983-11-18Born in Harstad, Norway.
• 1999-10-06DeCSS is released; Johansen, then 15, had written its graphical user interface.
• 1999-11Frank A. Stevenson publishes cryptanalytic attacks on CSS based on leaked DeCSS source code.
• 2000-01Awarded the Karoline Prize in Norway.
• 2000Norwegian police raid Johansen's home over the DeCSS release.
• 2001Releases OpenJaz, drivers for a portable MP3 player.
• 2002-04The Electronic Frontier Foundation gives a Pioneer Award to the writers of DeCSS.
• 2002Prosecuted in Norway following complaints by the DVD Copy Control Association and the Motion Picture Association.
• 2003-01-07Acquitted of all charges by the Norwegian court.
• 2003Releases QTFairUse, an early tool targeting Apple's FairPlay DRM.
• 2003-12-22Norwegian appeals court upholds the acquittal.
• 2004Adds FairPlay support to the VLC media player.
• 2004-01-05Norway's economic crime unit declines to appeal to the Supreme Court.
• 2004-01-22The DVD Copy Control Association drops its case against Johansen.
• 2005Co-writes PyMusique and works for MP3tunes in San Diego.
• 2006Moves to San Francisco to work with DoubleTwist Ventures.
• 2007-03doubleTwist Corporation founded in San Francisco with Monique Farantzos; Johansen serves as chief executive.
• 2008doubleTwist media management software launched.