DeCSS and the First DVD Wars: The Courtroom Battle Over Source Code

Every DVD ever pressed carries a lock called the Content Scramble System. Deployed in 1996, CSS was a condition of Hollywood’s blessing for the format: studios would release their films on disc only if the discs were encrypted. The encryption itself was a product of its time — a 40-bit stream cipher, its key length chosen partly so the scheme would fall under US export restrictions on strong cryptography. It was designed for a world where only licensed player manufacturers would ever touch the keys.

That world lasted three years.

The leak

In October 1999, a program called DeCSS appeared on the internet. It decrypted CSS, and it had a story: Jon Lech Johansen, a fifteen-year-old Norwegian who went by “DVD Jon,” had been working with two anonymous developers — one known only by the handle “MoRE” — to reverse-engineer a licensed Windows software player and extract its key. Johansen’s stated goal was simple and, in his view, innocent: he wanted to play the DVDs he had bought on Linux, where no licensed player existed.

The code spread through the hacker community within days, mirrored on hundreds of sites, printed on T-shirts, and even rendered as a prime number to test how far “speech” could be stretched.

The lawsuits

The DVD Copy Control Association, the licensing body that controlled CSS, responded with the full legal arsenal. In California it sued 72 defendants, Johansen among them, alleging trade-secret misappropriation. In Norway, police raided Johansen’s home under a computer-crime statute rarely used against teenagers, seizing his computers and charging him with aiding copyright infringement.

In the United States, the parallel battle became a free-speech cause célèbre. When the hacker magazine 2600 posted links to DeCSS, Universal sued under the brand-new Digital Millennium Copyright Act. In Universal City Studios v. Corley (2000), a federal court ruled that while source code is speech, publishing it in this context was conduct — and enjoined 2600 from linking to the code. The decision remains one of the most debated First Amendment rulings of the internet era.

The verdicts

The Norwegian case collapsed. In January 2003 an Oslo court acquitted Johansen, reasoning that reverse-engineering a product you legally own to achieve interoperability is not a crime. The prosecution appealed; in January 2004 the appellate court upheld the acquittal. The California civil suits, meanwhile, ran out of steam and were dropped.

The wars ended in a strange stalemate. Johansen walked free. DeCSS remained everywhere. And yet the DMCA’s Section 1201 — the provision that makes trafficking in circumvention tools illegal regardless of the user’s intent — survived intact and became the template for every digital lock that followed, from games consoles to printer ink.

Why it matters

The DVD wars settled almost nothing about who was right, but they drew the map for everything after: the Sony rootkit, the console modding cases, the right-to-repair movement, the modern fight over jailbreaking phones. Every one of those battles is a footnote to the argument that started with a 40-bit key and a Norwegian teenager. The lock lost; the idea of the lock won.