SAN FRANCISCO – Jon Lech Johansen, the 21-year-old Norwegian media hacker nicknamed DVD Jon, is moving to San Diego to work for maverick tech entrepreneur Michael Robertson in what can only be described as the most portentous team-up since Butch met Sundance.
"I have no idea what I'll be doing, but I know it will be reverse engineering, and I'm sure it will be interesting," Johansen told Wired News during a Friday stopover in San Francisco.
A world-famous reverse engineer by the time he was 16, the soft-spoken tinkerer outraged the motion picture industry in 1999 for his work on DeCSS, a successful project to crack the encryption on DVDs that led to Hollywood's first lawsuits under the United States' controversial Digital Millennium Copyright Act. Since then, Johansen's hacks for Apple Computer's iTunes software and Microsoft's Media Player have made headlines, and his blog – titled "So Sue Me" – has become must-see surfing for digital media geeks and, one suspects, entertainment company lawyers.
In a posting to his website late Tuesday, Robertson said he'd snapped up Johansen to work on a "significant new project" called Oboe at his digital music company MP3tunes. Oboe will "bring digital music into the 21st century," Robertson wrote.
"We have been e-mail acquaintances for a while," said Robertson in an e-mail interview. "I hired him because we happen to have a major project underway at MP3tunes.com where I thought his skill set would fit perfectly."
But what is an avowed media liberator doing in a country where entertainment companies routinely sue college students for making copies of movies?
Quite simply, times are changing.
Until recently, Johansen's controversial work was protected by Norway's laws, which allowed people to reverse-engineer digital copy protection for lawful purposes. But in July, Norway adopted a European Union directive similar to the DMCA that outlaws circumventing copy protections for any reason.
"In Norway, you have the same laws (as in the United States) now," he says, "so it makes no difference if I'm doing my work here or there."
Johansen became the poster boy for free tinkering when he refused to stop distributing DeCSS with LiVid, a Linux DVD player. That's when the Norwegian police, egged on by U.S. entertainment companies, arrested him under that country's computer crime laws for breaking into his own media.
Undeterred, Johansen fought and won both cases brought against him in Norway, and continued his quest to release digital media from the shackles of overly restrictive copy protection. Since then he's built free software tools that crack Apple's AAC audio format – the encryption systems used by iTunes – and the Windows Media Player codec for streaming video.
PyMusique, another tool Johansen and two other engineers released earlier this year, allows people with Linux operating systems to buy music from the iTunes store and save it in an unrestricted format.
Johansen said he will be continuing this kind of work at Michael Robertson's latest venture, San Diego-based MP3tunes, an online digital music store that sells MP3s unfettered by digital rights management copy-protection systems.
Fresh off a plane from Norway and sampling his first California beer, Johansen said Friday he wasn't worried that his penchant for ripping apart DRM would get him into trouble in the United States.
"I still haven't heard anything from Apple about my hacks," he said with an infectious grin. "There is a tool based on my work reverse-engineering Apple's FairPlay called jhymn that's been hosted on a U.S. server for over a year and nothing has happened."
Johansen added: "I plan to continue my research, but I won't be writing any tools (while in the United States)."
As for what kind of research he might pursue, Johansen says he's intrigued by Helix, the DRM system used by RealNetworks, because "it's the same audio format as Apple's, but higher quality." Real's music store is only open to U.S. customers, which has been frustrating for Johansen. "Basically, if I have no intention of using a service then I won't bother reverse-engineering it," he said. "Now that I can get an American credit card and sign up for their store I might look into it."
Although he dismissed the idea of being arrested with a shrug, Johansen admitted his stop in San Francisco – 800 miles north of San Diego – was planned in part as an opportunity to consult with attorneys at the Electronic Frontier Foundation.
Jennifer Granick, a cyberlaw attorney at Stanford Law School who often works with the EFF, said Johansen would be wise to be cautious. "Johansen has been out of the reach of the U.S. government and the DOJ," she said. "The fact is that when you've done something that the authorities think is illegal under U.S. law, you'll probably attract attention when you're capable of being arrested."
Nevertheless, Johansen is glad to be in the states, where he'll get a chance to contribute to software that ordinary people will use. "I took a job in the U.S. because I wanted to work on products that would get into end users' hands," he said. "In Norway, most of the jobs are in server software, niche stuff. The Opera browser is one of the few Norwegian products aimed at users."
In late summer, Johansen returned from a year in France and started his job search by pinging Robertson, whom he said "supports the work I do on open systems" and seemed like a good match for the quiet hacker.
Robertson is also no stranger to legal troubles – his previous company, MP3.com, was sued by multiple companies in the record industry over its music locker business model. And in 2001, Microsoft filed a trademark infringement suit against Robertson's Linux startup, Lindows, which last year changed its name to Linspire in a settlement with Redmond's lawyers.
MP3tunes, whose name is a sly reference to iTunes, lets music lovers buy MP3s of their favorite music that can be played in any device, without a restrictive DRM system that impedes them from saving legal copies on multiple devices. "It's the record store model you'd like to see," said open-source entrepreneur John Gilmore, founder of Cygnus. "You can do whatever you like with your music within the bounds of copyright law."
This suits Johansen just fine. He's still strongly opposed to DRM, particularly because he believes it punishes consumers rather than prevents piracy. "People use my programs to put iTunes songs on non-iPod players," he said. "They're playing these files legally. Companies shouldn't use the law to prevent consumers from doing something legal."
The former DVD liberator is also dismayed by the future of movie disks, because new high-definition DVDs use several million keys in their encryption scheme, as compared to the 400 keys used in the Content-Scrambling System, or CSS, the method used to encrypt regular DVDs.
"Once again, this is a scheme that won't stop piracy, but it will stop open-source players," he said. "Pirates will steal one key, and not tell anyone about it. Then they'll decrypt HD-DVDs and put them on the net. But if you want an open-source player, you'll have to show your key, so (companies) will be able to find you and stop you."
Perhaps it makes sense that Johansen is excited to be in America. Now he's in the country that produces most of the world's media – and most of the world's DRM, too. It's a media liberator's candy box.
And a media fan's. "Is the movie Serenity good?" he asked a reporter earnestly after finishing his beer. Assured that it is, Johansen broke out in another wide grin. "I'm so glad I get to see it now! It wasn't going to reach Norway until December."
Then, more seriously, he added, "I'm not scared about being arrested now that I'm here. Michael has good lawyers."
