Dmitry Sklyarov: The DEF CON Visit That Became a DMCA Case

Dmitry Sklyarov flew to Las Vegas in July 2001 to give a conference talk about weak encryption in electronic books. He flew home to Moscow five months later, after becoming the first person ever criminally charged under the Digital Millennium Copyright Act.

In between came a jail cell, a $50,000 bail, "Free Dmitry" rallies and a federal indictment carrying a theoretical 25 years in prison. All for writing a program that turned Adobe eBooks back into ordinary PDFs.

The case was supposed to show that the DMCA had teeth. It ended up showing something else.

Dmitry Sklyarov at a Glance

• A Moscow programmer and PhD student in cryptanalysis at Bauman Moscow State Technical University, Sklyarov wrote the Advanced eBook Processor for the Russian software company ElcomSoft.
• On July 15, 2001, he presented "eBooks security: theory and practice" at DEF CON 9 in Las Vegas. The FBI arrested him the next day on a complaint from Adobe.
• He spent three weeks in custody before being released on $50,000 bail on August 6, 2001, confined to Northern California while his wife and two small children waited in Moscow.
• Adobe withdrew its support for the prosecution on July 23, 2001, after meeting with the Electronic Frontier Foundation. The Justice Department pressed on and indicted Sklyarov and ElcomSoft on five counts on August 28.
• On December 13, 2001, prosecutors agreed to drop the charges against Sklyarov in exchange for his testimony. He was home in Moscow by New Year's Eve.
• He returned to San Jose to testify at ElcomSoft's trial in December 2002. On December 17, the jury found the company not guilty on every count.
• Sklyarov stayed at ElcomSoft for another decade, cracking Canon's photo-authentication system in 2010, then moved to Positive Technologies, where he leads reverse engineering.
• With colleagues there he dissected Intel's Management Engine in 2017 and was credited by Intel in 2021 for a hardware flaw in its processors.

The Life of Dmitry Sklyarov

Sklyarov's Early Years

Dmitry Sklyarov grew up in Moscow and studied at Bauman Moscow State Technical University, the country's oldest engineering school. By 2001 he was a graduate student there, researching cryptanalysis.

He was also married with two young children, which meant a day job. He found one at ElcomSoft, a small Moscow company that sold password-recovery tools, the kind of software that gets people back into their own spreadsheets and archives.

Breaking weak protection schemes was the company's business. Sklyarov turned out to be very good at it.

The Advanced eBook Processor

Adobe's eBook format wrapped PDF files in a layer of restrictions. A publisher could decide whether a buyer was allowed to print a book, copy text from it, have it read aloud, or open it on a second computer.

Sklyarov studied the encryption behind those locks and found it thin. ElcomSoft packaged his work as the Advanced eBook Processor, a Windows program that stripped the restrictions and produced a plain PDF the buyer could use however they liked.

Adobe didn't see fair use. On June 26, 2001, it reported the software to the FBI.

DEF CON 9

Sklyarov and a colleague, Andy Malyshev, had been invited to speak at DEF CON 9, held July 13 to 15, 2001, at the Alexis Park Resort in Las Vegas. Their talk, "eBooks security: theory and practice," walked through how flimsy the commercial eBook formats really were.

He gave the talk on Sunday, July 15. On Monday, July 16, as he was preparing to leave Las Vegas, FBI agents arrested him.

The charge was trafficking in a tool designed to circumvent copyright protection, a crime under the Digital Millennium Copyright Act of 1998. Nobody had ever been criminally prosecuted under that law before.

Free Dmitry

The hacker community reacted first. Within days, supporters were organizing "Free Dmitry" rallies with help from the Electronic Frontier Foundation, and a website, freesklyarov.org, tracked his status like a prisoner-of-war bulletin.

Adobe folded fast. On July 23, after a meeting with the Electronic Frontier Foundation, the company announced it no longer supported the criminal case against him.

The government didn't care. Sklyarov was moved through the federal prisoner transfer center in Oklahoma City to San Jose, and only on August 6, three weeks after his arrest, did a judge release him on $50,000 bail, with orders not to leave Northern California.

On August 28, 2001, a grand jury indicted both Sklyarov and ElcomSoft on four counts of circumvention and one of conspiracy. The EFF, which took up his defense, calculated the maximum exposure at 25 years in prison and $2.25 million in fines.

Going Home

Sklyarov spent the autumn of 2001 in California, thousands of miles from his family, waiting. The case had become a referendum on the DMCA itself, and his lawyers argued that applying an American copyright law to a Russian programmer writing legal software in Moscow was absurd.

On December 13, 2001, the Justice Department blinked. Under a pretrial diversion agreement, it'd drop the charges against Sklyarov personally, provided he testified truthfully at ElcomSoft's trial.

Six days later his supporters threw him a victory party at a San Francisco restaurant, with ElcomSoft's president and EFF lawyers among the speakers. He was back in Moscow with his family by New Year's Eve.

United States v. ElcomSoft

The company's trial went ahead a year later, after a string of motions challenging the DMCA's constitutionality failed. Sklyarov returned to San Jose to testify, as promised, in December 2002.

The defense argued that the software had legitimate uses, that it'd been written in Russia where it was legal, and that ElcomSoft had never willfully broken American law. The prosecution argued that the company knew exactly what it was selling and to whom.

On Tuesday, December 17, 2002, the jury found ElcomSoft not guilty on all counts. "When you are bringing good cases under new statutes sometimes you are going to lose," U.S. Attorney Kevin Ryan said afterward.

The first criminal DMCA prosecution had ended with no conviction for anyone.

Cameras and Secret Keys

Sklyarov went back to work at ElcomSoft and kept doing what had gotten him arrested: finding the weak spot in systems that claimed to be unbreakable.

In November 2010 he showed that Canon's Original Data Security system, which professional and forensic photographers used to prove a photo was unaltered, could be defeated by pulling the secret signing key out of the camera's memory. ElcomSoft published forged images that passed Canon's verification software, and warned that no firmware update could fix a design that left the key inside the camera. Five months later the company did the same to Nikon's Image Authentication System.

Inside Intel

Sklyarov later moved to Positive Technologies, a Moscow security firm, where he became head of reverse engineering. He also lectures on information security at Bauman.

His targets got deeper. In 2017 he gave two conference talks, at TROOPERS in Germany and Black Hat Europe in London, on the Intel Management Engine, the hidden computer inside every Intel chipset, explaining its firmware and its previously undocumented flash file system.

In November 2021, Intel published an advisory for CVE-2021-0146, a hardware flaw that let an attacker with physical access switch on test and debug logic in Pentium, Celeron and Atom processors. It credited Mark Ermolov and Dmitry Sklyarov of Positive Technologies and the independent researcher Maxim Goryachy.

There was an irony in that credit line. In April 2021, the U.S. Treasury had placed Positive Technologies under sanctions, saying the firm supported Russia's FSB and hosted conventions used as recruiting events for the security services.

Dmitry Sklyarov: The Programmer Who Beat the DMCA

Sklyarov never set out to be a test case. He wrote a program, gave a talk, and spent five months learning what an American copyright law could do to a foreigner who'd broken no law at home.

The case established something lasting: a jury of ordinary people, shown a DMCA prosecution up close, declined to convict. Later DMCA fights, from DVD decryption to printer cartridges, were argued in the shadow of the ElcomSoft verdict.

Today he's still in Moscow, still taking apart other people's secrets, now at a company the U.S. government has sanctioned. The man the FBI arrested in Las Vegas turned out to be exactly who he said he was: a researcher, with a talk to give.