MPAA's student P2P sniffer pulled over copyright issues

By Ed Oswald, BetaNews

December 4, 2007, 2:45 PM

In an embarrassing blunder for an organization that has made copyright one of its signature issues, the MPAA is now being accused of violating copyright itself.

As part of the organization's fight against the pirating of movies, the Motion Picture Association of America had been urging universities to install an Ubuntu-based toolkit that would assist it in tracking and reporting students who were participating in file-sharing. The Association proposed the so-called "University Toolkit" as part of letters sent to 25 universities back in October.

MPAA's software was not above criticism: One security researcher found it could pose significant privacy concerns depending on how the school's network was set up.

But that's not the whole of it. On Monday, it was disclosed that the organization is actually breaking copyright itself by providing the toolkit. One of the developers behind the Ubuntu toolkit began defending the distribution by issuing takedown notices.

Ubuntu is licensed under the General Public License. In order to comply with the terms, developers creating applications must not only provide the binary, but the source code behind it as well as publish changes made. Without the source code, distributing the binary alone constitutes copyright infringement under the GPL.

Obviously, such a setup would not benefit MPAA. With source code in hand, enterprising hackers would probably be able to find ways to subvert the tracker, and continue to trade files.

When Ubuntu developer Matthew Garrett caught wind of the MPAA's activities, he complained to the organization directly. However, the group didn't respond to his e-mails, and calls to the organization's office were met with bewildered receptionists unsure of how to direct his call and with promises that he would be called back.

Frustrated, Garrett took it to the next level, contacting the group's ISP and demanding that the offending content be removed from its servers. It apparently has complied, and the package was missing from the MPAA's Web site as of Tuesday.

"MPAA don't [expletive] with my [expletive]," Garrett wrote on his Web log Monday.