GameSpy, Security, & the DMCA

A post to the SecurityFocus BUGTRAQ Mailing List outlines a conflict brewing between GameSpy's lawyers and a researcher who uncovered some bugs in GameSpy software (thanks Brown, Quboid, and Slashdot). According to the post, the researcher has received a cease and desist order over his work (which he says he made available to GameSpy before publishing it), saying he is in violation of the dreaded Digital Millennium Copyright Act.
View : : :
11.
 
The accusation
Nov 12, 2003, 15:06
11.
The accusation Nov 12, 2003, 15:06
Nov 12, 2003, 15:06
 
First, I'm sympathetic to people who test and probe software for security issues with the intent to help plug the holes. In fact, there are government, non-govermental, and international organizations that provide a clearing house and interface between such independent investigators and the companies producing software. Mr. Auriemma didn't mention any attempt to contact them; only GameSpy. Perhaps it would have been best to deal with these clearing houses which already have relationships and credibility with the software companies.

In case anyone wants to know what the other side actually said, here is the link (at the moment) to the GameSpy letter:
http://aluigi.altervista.org/misc/75395-1.pdf

The basic issue as taken from the letter sent to Mr. Auriemma is:

These programs purport to permit users to circumvent the encryption protection of GameSpy's proprietary software, including GameSpy 3D and Roger Wilco, to obtain access to computer servers owned and operated by GameSpy, or in some cases to cause those servers to crash.

They list programs on Mr. Auriemma's web site and claim that his "security advisories" provide step-by-step instructions for others to circumvent security on GameSpy servers. It isn't about him finding a particular bug. It's about him offering tools to the public to do what the above quote states, as well as Mr. Auriemma using them to gain unauthorized access to the GameSpy servers.

If it is true that he tried to work with GameSpy first but they rebuffed his attempts to help, then GameSpy sure doesn't look good. I sympathize with Mr. Auriemma. I hope he has some proof of his attempts and GameSpy's refusal to work with him prior to him posting the programs and methods to access the GameSpy servers. Although, I don't see how USA law can do anything to the guy. Maybe there is an international treaty covering this or the USA has some way to get to Mr. Auriemma through the Italian government.

BTW, I too am concerned that the DMCA will be used and abused by the authorities in concert with large corporations to stiffle criticism and impede competition.

Date
Subject
Author
1.
Nov 12, 2003Nov 12 2003
8.
Nov 12, 2003Nov 12 2003
15.
Nov 12, 2003Nov 12 2003
2.
Nov 12, 2003Nov 12 2003
12.
Nov 12, 2003Nov 12 2003
14.
Nov 12, 2003Nov 12 2003
16.
Nov 12, 2003Nov 12 2003
3.
Nov 12, 2003Nov 12 2003
4.
Nov 12, 2003Nov 12 2003
5.
Nov 12, 2003Nov 12 2003
6.
Nov 12, 2003Nov 12 2003
7.
Nov 12, 2003Nov 12 2003
13.
Nov 12, 2003Nov 12 2003
18.
Nov 12, 2003Nov 12 2003
9.
Nov 12, 2003Nov 12 2003
10.
Nov 12, 2003Nov 12 2003
 11.
Nov 12, 2003Nov 12 2003
The accusation
17.
Nov 12, 2003Nov 12 2003