Satellite Pirates

To the American heartland, they're information-age Robin Hoods, dispensing cheap cable access. To the cable industry, they're organized crime, pulling in half a billion dollars a year.Their story has never been told. Until now.
A Wired Exclusive by Charles Platt.

The Hacker Connection

Paradise Island, Bahamas: In a Holiday Inn, I sit watching the ocean, listening to the air conditioning, waiting for the phone to ring. I'm here to make a connection, to meet a figure from the information underground.

He's been described by one law-enforcement expert as "one of the kingpins" in video piracy. For the past eight years, he's been supplying black-market hardware to hundreds of thousands of families scattered across rural America. The hardware has one simple purpose: to descramble TV transmissions so that people who own satellite dishes can watch superstations and sports events without paying the usual fees.

This so-called kingpin has a sense of humor. His alias is "Ron MacDonald" (the misspelling is deliberate). But his business is no joke. Consumers may be spending as much as half a billion US dollars every year to receive pirated satellite TV.

The numbers are hard to believe, but they can be extrapolated. In the United States, according to the Satellite Broadcasting and Communications Association (SBCA), there are about 3.7 million home satellite TV dishes. Most are owned by farmers, country folk, the last types you'd expect to be law breakers; yet according to General Instrument, designer of the decoder hardware, only 1.8 million dishes are equipped with legitimate descrambling modules. This means that nearly 2 million dishes are unaccounted for. If they have no descrambling equipment, they can only receive a few stations: the Home Shopping Network, the Weather Channel, and various religious networks that are broadcast "in the clear." How many people do you think spend thousands of dollars on a dish for home shopping networks? Let's be conservative and assume that fully half of the 2 million "mystery users" are depriving themselves in this way. That still leaves at least a million who do want to watch movies, superstations, and the other scrambled goodies. Those viewers must use illegal equipment to achieve that goal.

Usually, a TV dealer is the intermediary who buys parts and software from a pirate such as "Ron" and then discreetly offers to modify a dish owner's decoder so that it will receive many stations for free. The federal penalties for this back-room electronics handiwork are mind-boggling: a US$500,000 fine or five years in jail, or both. Some dealers have been imprisoned, yet my sources indicate that there are still at least a thousand operating outside the law, because the money is good, or because they are ornery individuals who feel there's a principle involved. As a dealer in Arkansas told me, "The airwaves should belong to the people. If a TV signal comes trespassing onto my property, I should be free to do any damn thing I want with it, and it's none of the government's business."

In Canada, the story has a different twist. In order to protect Canadian culture, the government limits the amount of US programming that local cable networks can carry. As a result, consumers buy dishes so that they can watch American TV. This, however, creates a problem: most American programmers don't own the right to sell their wares outside the United States. Consequently, they can't accept subscriptions from Canadian viewers, which means that of approximately 500,000 dishes in Canada, almost all are violating US copyright law, quite apart from regulations on the export of decoder equipment.

In Mexico and in the Bahamas, the situation is the same: you can't legally subscribe to US programming, which means that every single viewer, by definition, is violating US law.

The capital of the Bahamas is Nassau, located just the other side of a bridge from my hotel room on Paradise Island. The town is an uneasy mix of ultrarich and ultrapoor and has been scarred by two waves of imperialism. The British installed a government, laws, some funky little roads, and the metric system. The Americans added an airport, dollar-denominated currency, and a bunch of modern tourist resorts.

Colonel Sanders and Tony Roma are doing business overlooking the marina -- but that's just a facade, a clumsy imitation of Mall Town USA, catering to visitors for whom familiarity breeds contentment. Two blocks back from the water, Mall Town gives way to Shanty Town, where local families live in colorfully painted tumbledown huts. Dogs lie around in the dirt, and skinny kids haul water from a communal faucet. Still, even here among thickets of date palms and cypresses, you find 8-foot dishes aimed at the sky. The only local channel is a graveyard of old movies and threadbare sitcoms, and the craving for ESPN, CNN, and HBO is universal. Even some of the humblest homes on the island have dishes outside.

Put together Canada, the United States, the Bahamas, and Mexico, and you find that at least 1.5 million people are using illegal hardware and illicit authorization codes to descramble satellite TV. Typically, a user pays $15 a month for code updates and maybe $100 a year for hardware upgrades that are necessitated by ECMs (electronic countermeasures) that General Instrument uses in its ongoing war against piracy.

This means that the average illegal user may be paying $300 a year for television access. Multiply that by 1.5 million, and you see how satellite video piracy is a business worth half a billion dollars annually. Truly, it's a multinational, information-age version of organized crime.

But amazingly, this has barely been reported by the national media. In fact, it seems that none of the big-time video pirates has ever been approached by a journalist. Ron MacDonald will be the first to go public -- assuming he follows through and calls me on the phone.

His activities appear to be legal in the Bahamas, which is why he recently moved to Nassau from his home town of Burlington, Ontario. Even so, he's extremely cautious. Bounty hunters have occasionally seized video pirates, slapped handcuffs on them, dragged them onto US soil, and turned them in for reward money. Mindful of this, Ron never tells outsiders where he plans to be at any particular time, and he has communicated with me via a private computer bulletin board that he maintains in Nassau to serve his network of dealerships.

He offered me a simple deal: if I was willing to fly to Nassau, rent a car, drive to the hotel on Paradise Island, and wait in my room, he would call me at 5:00 p.m. with further instructions.

I was willing. So now I wait.

Marooned at Pirates Cove

The phone rings at 5:02. He sounds relaxed, amiable, like the manager of an auto dealership, or maybe the owner of an appliance store -- a straight-shooting businessman in his 40s, offering the customer a fair deal. "I'll see you at Tony Roma's at eight," he tells me.

Tony Roma's? This doesn't sound like the glitzy subculture of data theft romanticized by such writers as William Gibson. I guess that's the difference between fact and fiction: I'm stuck here in a middle-American tourist trap.

When I venture down to the hotel lobby, I see a van in the parking lot with "Cruising and Boozing" hand-lettered on its side, releasing a mob of lobster-red ocean enthusiasts. They've had a heavy afternoon of drinking and swimming and fishing and drinking and will soon be ready for a night of serious action at the local casino. Here they come, stumbling up the steps, dizzy from rum and sunstroke.

This Holiday Inn happens to be located on a bay named Pirates Cove, so the doorman wears a full pirate costume, including eye patch andtricorner hat. He ushers the sun worshippers into the lobby, where an amplified Caribbean steel band is playing loud enough to drown the screaming of caged parrots, and teenagers in swimsuits are wandering around looking hot, wet, and horny.

Meanwhile, out at the back, free plastic cups of nonalcoholic Caribbean punch are being served beside the swimming pool, and a calypso band has set up on a life-sized fake galleon on the beach. The pirate motif is everywhere; teenagers are wearing skull-and-crossbones T-shirts, and little kids brandish cardboard pirate masks.

To the vacationers, piracy is a Disneyland concept, a laugh from the past. They'd be surprised to learn that it still flourishes here in the Bahamas and is now lucrative beyond Captain Hook's wildest fantasies.

Ribs, with a Modem on the Side

When I get to Tony Roma's shortly after eight, I see them right away: two guys sitting side by side at a table where they can watch the door.

One of them has graying hair brushed straight back, a neat mustache, and a rounded, sunburned, prosperous-looking face. He's a large man, resting his arms calmly on the table. His companion is younger, taller, thinner, paler, with a few days' worth of a beard. He's wearing glasses, and he looks nervous. He has "hacker" written all over him.

I go over to them, and we shake hands. The big man is Ron; the skinny guy is Fred Martin (he refuses to say whether this is his real name) -- he's the one who writes most of the counter-encryption code. The mood is very uptight, and neither of them makes much eye contact. Vacationers close by are talking about moisturizer and sunblock. Reggae-Muzak is playing in the background. The waitress wants to know what we want to eat. Ron orders ribs; I go for marinated chicken.

I figure the best way to get acquainted with a hacker is to show some hardware, so I pull out my laptop computer, which uses a 14.4 PCMCIA modem the size of a credit card. Yes, this breaks the ice. Fred eyes the modem covetously. "Have you opened it up, yet?" he asks me in a soft, shy Canadian accent.

"He always opens things up," says Ron. He chuckles. "And sometimes he even puts them back together again."

Ron sounds like somebody's uncle, indulgent, fond of the slightly younger fellow sitting next to him. I imagine them doing a comedy routine, with Fred the Hacker saying something like, "Hey, Ron! I just got a great new idea for disassembling the code in a U-11 chip. It'll make us 10 million bucks. Can I use the electron microscope? Can I?"

And Ron the Businessman says, "Not till you eat your greens, Fred."

The three of us make small talk, since this obviously isn't the place for an interview. After we finish eating, Ron pulls out his Motorola cellular phone. He murmurs something into it, then nods. "All right," he says to me, "I think you should see an actual setup. A dealer who fixes boards. Are you ready?"

The Code Distribution Network

They tell me to leave my car and travel with them. We follow a maze of back streets, through Shanty Town and out the other side, into a middle-class suburban neighborhood. The lush landscape reminds me of canyons in Los Angeles, except that the tropical vegetation here is wilder and denser, and I see satellite dishes instead of swimming pools.

We pull into a concrete driveway where an open garage door spills light into the night. A fellow is waiting for us outside. He looks around 30, short-haired, fit, clean-cut, with clear, penetrating eyes. For the purposes of this article, he asks me to call him Conchy Joe (the conch shell being a folksy national symbol here in the Bahamas).

His garage has been taken over by electronic equipment. Two black vinyl bar stools stand in front of a workbench where there's a monochrome television monitor, a satellite TV descrambler, a control unit for the dish outside, an old Kenwood stereo, an MS-DOS computer with flying toasters on the screen, a soldering iron, an EPROM burner, and some items that I don't recognize. A washer-dryer stands close by. Circuit boards have been heaped on the bare concrete floor. Crickets are singing in the night outside, and the warm night air ruffles the fronds on a nearby palm tree.

Fred homes in on the circuit boards and pulls one out for my inspection. "This is the original, the first release of the VC II," he says.

VC stands for VideoCipher, the scrambling protocol that General Instrument devised in the early 1980s. For its audio portion and key management system, VC uses the Data Encryption Standard (DES) controlled by the federal government. GI also has the exclusive license to use VideoCipher technology, which means it has total control of both the hardware and the software. This is the kind of market dominance that even Microsoft would envy.

I inspect the board and see that a wire has been added and a chip has been soldered off, allowing a socket to be put in its place. In the socket sits an EPROM -- Erasable, Programmable Read-Only Memory. This is where Fred stores his program code, which takes control of the board and overrides its usual instructions.

"How easy was it to hack?" I ask him. "Such as this," says Joe. He holds up the heat gun, which is one of the items I didn't recognize before.

"If you use it right," says Fred, "you make the epoxy pliable without frying the components underneath, and then you just carve it away with an X-Acto knife."

He sounds as if he wants to do a demo, but Irecalls. "We let it sit on the board overnight -- and the next morning, half of the board was missing. But then someone came up with the bright idea of using a Black & Decker heat gun."

"Such as this," says Joe. He holds up the heat gun, which is one of the items I didn't recognize before.

"If you use it right," says Fred, "you make the epoxy pliable without frying the components underneath, and then you just carve it away with an X-Acto knife."

He sounds as if he wants to do a demo, but I'm more interested in the way the boards are used than in the exact techniques for modifying them.

Codes and Countermeasures

Before I came to the Bahamas, I gave myself a crash course in satellite TV by downloading 300 Kbytes of files from Ron MacDonald's bulletin board, which calls itself "The Caribbean Connection."

Membership in this BBS usually costs $75 a year and is strictly controlled. If you're not part of the hacker underground, you'll have a hard time getting full access, though anyone can log on to look around.

The board is like a toolbox for safe crackers. It maintains a complete list of current codes for decrypting TV transmissions and has a huge library of software to reprogram EPROMs on chipped boards. If you can't find exactly what you need, friendly neighbors such as "John Buster," "Barney Rubble," and "John Conman" will be happy to help you out. The board's slogan is, "The Pirates of the Caribbean have returned!" and it's so laid back, you can almost forget the nightmarish penalties -- the five years in jail and the $500,000 fine. When you log off, though, your screen displays a little reminder:

BANG... BANG... BANG...
Did you hear that!
Was that a knock on your door?

By sifting data and asking a lot of questions, I mapped the structure and history of satellite TV. It runs like this:

A programming company like HBO uplinks its signal to a satellite so the satellite can rebroadcast its signal across all of North America. Originally, this setup was purely intended to serve local cable TV companies, which would receive the signal, pay for it, and distribute it to their cable subscribers. But in the early 1980s, home users started buying their own dishes, paying up to $10,000 for a complete installation, and tapping into the free stream of data.

Ever since the earliest days of television, these heartlanders had been poorly served with a handful of channels and unreliable, snowy reception. Now, suddenly, they had access to literally hundreds of options, from news to movies to international sports events.

Of course, it was too good to last. In January 1986, Time Inc.'s subsidiary, HBO, started scrambling its signal, and one by one, the other satellite programmers followedsuit, using technology provided by General Instrument.

At first, only cable TV companies were given descramblers. Home users weren't given the option to buy them -- at any price. Six months later, after their howls of fury had finally penetrated the executive suites at HBO, VC IIs were offered for up to $700 apiece.

If you opened up the box and did a chip count, you found fewer components than in a home computer akin to the Commodore 64, yet the price was twice as high. But there was worse to come. The descrambler would do nothing unless it was given a wake-up call -- a special authorization code that the programmer could send along with the regular TV signal. It could be addressed to an individual box, because each box had a unique identification number stored in one of its chips.

How could a user receive this vital code? Simple: by paying a monthly subscription fee to the TV programming company. If you stopped paying, the programmer wouldn't send you next month's authorization, your decoder would stop descrambling that channel, and you wouldn't be able to watch it anymore.

The people of the American heartland felt as if they had just been held up for ransom by a bunch of city slickers in New York and Los Angeles. And to complete the picture, HBO wanted to charge them a subscription fee that was much more than cable subscribers were paying. This was like taxation without representation, and even the slowest student of American history should have been able to foresee the consequences.

Six months after the VC II was marketed, the first video pirates started circulating the first fix. According to an industry commentator quoted in The Transponder, a respected industry journal, a four-month survey showed that 95 percent of satellite TV dealers were ready and willing to sell illegally modified decoder boards, and 98 percent of them believed that their customers were ready to buy.

The first hack did not actually crack the code that encrypted the TV transmission. Instead, the pirates "cloned" hundreds of boards so they all shared the same code number and would all respond to the same authorization signal. This "all for one, one for all" system was nicknamed a "Three Musketeers" fix. Subsequently, as GI retaliated with electronic countermeasures and hardware revisions, the hackers had to resort to increasingly complicated workarounds.

After three years of this struggle, GI basically admitted defeat and introduced a totally new encryption system: the VC II Plus. They warned consumers to send back their old boards for a free Plus replacement right away, because the old VC II system would be phased out completely.

According to Jim Shelton, former vice president of North American consumer products at GI, 300,000 of the 1.9 million VC II owners took advantage of this offer. Unfortunately, though, it didn't apply to people whose decoders had been illegally modified. As a result, 1.6 million of these "chipped boards" remained in private hands.

How could they be saved from extinction when the old VC II signal was discontinued? Well, it turned out that the signal wasn't going to disappear after all -- at least, not for a year or two. For reasons that still remain a mystery, GI continued broadcasting VC II authorizations to cable companies that were hanging on to their old decoders. Suppose an employee at one of these sites could be persuaded to copy the "seed keys" from one of the decoders. These special code numbers could then be inserted -- by someone who knew how -- in a home VC II decoder. After that, the decoder could process the authorization signals and decrypt them, yielding a number known in the trade as a "wizard code."

What did all this mean? It meant that the "wizard code" could be manually punched into any modified home VC II box, and this would serve as a substitute for the authorization that GI refused to send out anymore.

The pirates sold new software to the dealers, who used it to create EPROMS that would upgrade the boards. The dealers then obtained the necessary "wizard codes" from someone like Ron MacDonald and passed them on to the customers, who started keying the numbers in each month. Everyone was back online, happy again, although still mad as hell that the programmers had tried to hold them for ransom.

But the war wasn't over. GI started switching things around so that new codes weren't needed just once a month, they were needed almost every day. And they introduced a separate, 44-digit number for each channel. Imagine a little old lady in some rural outpost, peering at the numeric keypad through her bifocals, punching 44 digits to decode each of fifty channels, every two days, just to watch TV. Obviously, this wasn't going to work.

The pirates were undaunted. In 1992, an enterprising pair of guys named Jeff Carr and Jeff Mayes came up with a radical concept which they named VMS. This was a subassembly which could be mounted on the old VC II boards and could enable a board to receive its "wizard codes" automatically from a local dealership, by phone, as often as necessary. In this way, the data that people needed to descramble TV transmissions could be distributed over regular telephone lines, and no one would need to key in code numbers anymore.

According to industry sources, Jeff and Jeff (as they were known in the trade) used their VMS modification to set up an automated code-distribution system that would pass the "magic numbers" through a chain of dealers across the entire continent. This was such a big hit that Ron MacDonald commissioned Fred Martin to reverse-engineer the product so they could market their own version of it. Today, a lot of Ron's business depends on "wizard codes" being distributed via modem.

In 1993, Jeff and Jeff were raided by US Customs agents who hauled away many VMS business records. In response, the two Jeffs published a disclaimer in a trade magazine calmly stating that it was all an unfortunate mistake. Their VMS system had never been intended for signal theft (although, of course, it could potentially be used that way). VMS, they claimed, was not an acronym for Video Modem Service, as many people believed; it meant Video Marketing Service, and its original purpose was to distribute advertising messages to TV screens.

As a cover story, this might have seemed a bit hard to swallow. Still, charges against Jeff Carr were eventually dropped, and no further charges seem to have been filed. Meanwhile, as of May 1994, VMS was still under investigation, and further developments are still possible.

We're Only in It for the Money

In his Nassau garage, Conchy Joe turns to his TV monitor. "Let's suppose you want to watch a particular channel, and your authorization has run out. Here's all you have to do." He presses a single button, and I hear a cascade of touch tones. "The modem in my decoder is now dialing the local dealership."

There's a pause. From somewhere inside Joe's house, we hear a phone ringing.

"Seems like the dealership is very close by," I say.

"Very, very close by," Joe agrees blandly. "But suppose you were a customer outside, calling in. You wouldn't know what number the modem had dialed, and so long as it's a local call, it wouldn't show up on your phone bill."

"This keeps the dealer secure," says Ron.

There's the hiss of a connection being made, and the screen lights up with text. "Connected to Deep Thought," it reads. "System operational."

"Now the dealer's computer starts sending the updated 'wizard codes' to the decoder here," says Joe.

Numbers on the screen begin counting bytes and packets.

"But where does your dealership get the codes?" I ask.

"From Ron's bulletin board," says Joe. He turns back to the screen. "See, this system also does billing."

I look at the message. "Send $35 for the next three months," it reads. "Make checks payable to Ron or Joe."

I look at him in surprise. "People pay you by check?"

Joe smiles. "You're in the Bahamas, now."

"And all boards in Nassau use this system?"

"Not all," says Joe. "You can buy a legal, unmodified VC II Plus decoder through an American dealer, who will subscribe on your behalf to the channels that you want, using a fake American name and address. Naturally, you have to reimburse him for the subscription fees, plus his service fee. But this is a violation of US law, and if General Instrument finds out, they stop sending your Plus board authorization codes, and it's permanently dead."

"Permanently?" I ask.

Up till now, the mood in the garage has been upbeat. Now, there's a silence. Everyone is uncomfortably aware that the VC II Plus has not yet been successfully hacked, while more and more TV channels are using its new encryption standard.

Fifty stations still use the old VC II standard, including the superstations and the sports networks. But the numbers are slowly dwindling, and some dish owners are finally deciding that the party's over. They're biting the bullet, going legal, paying $400 or more for a VC II Plus and subscribing to a package of channels for an additional $300 a year. After all, it doesn't cost much more than paying the pirates, and it buys a better choice of stations.

Joe drags another board out of the stack. "This is a VC II Plus," he says.

Fred points to the largest component. "They put together five separate chips in that VLSI chip."

"That's the bugger that nobody can crack," says Ron. There's another thoughtful pause. "Actually," he says, "I will tell you that I've seen electron micrographs of that chip. Inside it, and also in the code that we found in it, there are the words "Team Bonsai." We think that's what the guys who designed it call themselves. You see...." He seems to be thinking carefully, deciding how much to reveal. "We happen to have a VC II Plus board, an 029, which is an early version, which we bought for $5,000. It came out the back door of General Instrument in Puerto Rico, prior to its security bit being set in the U-11 processor. That, of course, makes it vulnerable. Eventually, we'll turn that unit on and work on it."

I ask why he hasn't done it already.

He laughs. "I'm waiting for somebody else to spend the money. I figure we've already spent $60,000 to $70,000 so far on small projects related to the Plus. It would take another $150,000 to crack it."

"You have to understand, we don't believe in doing everything ourselves," says Fred. "Why reinvent the wheel? If someone else has something and it's good, we go with it."

Is that what happened with the VMS system? Do they regularly steal from their competitors?

Ron sighs. "Jeff Carr was a member of my BBS. Over a period of two or three months, he kept telling me about the software he was writing, to download 'wizard codes.' Eventually, Jeff showed up in Canada with a working sample. The original selling price was $100,000, but then he decided it wasn't for sale, and he wanted to market it through my BBS. I agreed to this. The first software disks we sold for $5,000 each, and each decoder required a VMS modem attachment, which sold to dealers for $100. I was buying the software from Jeff for $2,500 and the VMS modems for $65. That represented a reasonable, healthy profit."

So what went wrong?

"They agreed not to sell to anybody else in Canada. I had the exclusive rights, and all orders would go through me. Three months later, I found they were selling to somebody in Ontario. I complained about this, so Jeff said he would give me $7 commission on each Canadian sale. When he owed me $20,000 in commissions, and I hadn't seen a nickel, we reverse-engineered the board inside of six weeks." He shrugs. "I did what you'd expect a pirate to do."

(Attempts to reach Carr for comment have been unsuccessful, but his business partner, Jerry McCarter, still maintains that the VMS system was never intended for video piracy. He insists that VMS is a legitimate, tax-paying US corporation.)

"Basically," says Fred, "there are three kinds of people in this business. There are people who do no R&D at all and rip other people off. Like there'll be a guy who pays $1,000 for a program disk from us, makes three copies, and sells them to three friends for $500 each, and each of his friends sells a copy to three of his friends for $250 each, and so on, with each person making a profit. Then you've got another type of guy who looks for stuff on BBSes, downloads it, packs it up with documentation, and resells it for $2,000 to $3,000, whatever he can get, even though it's already available free. There are maybe two or three people doing that full time, and we know who they are. And then finally there's people like us, who actually do original work."

"You have to understand," says Ron, "everybody is in it for the almighty buck. Go to the street market in downtown Nassau, and for $10 they'll sell you 'wizard codes' that have been downloaded off our own bulletin board."

So, even the pirates are being pirated. In which case, shouldn't they try to protect their information more carefully?

"No." Fred sounds very decisive. "As soon as you start trying to restrict what people do with the information they get, you become the enemy."

"We don't want to become a policing force," Ron agrees. "That's the worst side of this industry."

How to Eliminate Video Piracy

The next day, I receive instructions to go to a pizza parlor in a mini-mall. When I get there the decor looks like Burger King, all red and yellow Formica. Outside the big windows, palm trees and white hotels stand against a brilliant blue sky.

Fred Martin comes wandering in, even more unshaven than the day before, with his computer in a case hanging from his shoulder. He dons a dowdy black cotton jacket to ward off the air conditioning.

He orders tea; I have an individual pizza. A large, deeply tanned, disapproving couple is sitting at the next table, wearing sunglasses. They stare in our direction as we drag out our two computers. I start typing notes on mine; Fred doesn't use his, but he seems to feel better having it open beside him.

I ask him how he got into the piracy business.

"I've known Ron for about ten years. He called me in to take a look at the very first VC II. Somebody had already done a lot of work on it. I did some debugging on a chip, fixed it up." He shrugs.

I ask him how the VC II was cracked so quickly.

"It's no secret that information has been leaked from General Instrument. I have some myself, papers that say, 'General Instrument, Sensitive Materials, Do Not Release.' Now, how they came out of a high security factory, I don't know."

It sounds as if he does know.

"Well," he says, "it would have been in the interests of GI to see that the VC II was hacked as quickly as possible. They sold a lot more units once people could use them to get free programming."

Is he saying that the corporation knowingly released its own secrets, after taking development money from broadcasters and promising them that the system couldn't be compromised?

He nods.

I ask if he personally resents the way that programmers market their product. "Sure, it makes me mad. You pay 30 bucks a month, and what do you get? You're being overcharged and not getting enough in return."

If it cost less to buy programming, would his outlook really change?

"GI has said from day one that people pirate the signal because they don't want to pay for it. But everyone who's using a pirate modem in a

VC II board is now paying for it! The fact is, people are willing to pay, but only so much. In computer software, when games cost $100 to $150, there was a big piracy problem. It went away because the software is now reasonably priced, and dealers can make money selling it. If you want to eliminate video piracy, all you have to do is bring down the prices and let dealers sell the programming."

The New Orleans Sting Operation

Fred is 30 years old and has lived most of his life in his native Canada. He's happy to be in the Bahamas, now, because he loves hot weather. I get the impression that although he seems shy and soft-spoken, he has a tough, unyielding personality. Often, in a conversation, he refuses to let go of a topic until it's been thoroughly examined to his satisfaction. And when he digresses and mentions his love of bicycle riding, it quickly becomes clear that he's the sort of militant rider who kicks cars if they cut in on him.

I ask if he ever gets scared, as a lawbreaker. He starts telling me about the big bust of 1993, in which General Instrument supported a sting operation through US Customs, luring a number of hackers (including Jeff Carr) to New Orleans, where, they thought, they were going to purchase the elusive fix for the VC2 Plus. The customs agent, who called himself Richard Collins (his real name was Richard Coleman), almost persuaded Fred to join the party.

"Originally," Fred recalls, "he got in touch with us by ordering our products, as if he was a dealer. Then one day he left a message on the BBS saying he had a friend in Arkansas who had developed a Plus fix and would only sell it through Collins.

"It seemed odd to me that he'd been an amateur, and suddenly he was a kingpin. There's a lot of scams that go around, and I've seen people who take a board, solder some wires, and say look at my fix, for only $100,000 you can have this. So I figured this guy was bullshit. But, I try to keep my mind open, so I went and met him in a shopping mall in Buffalo.

"He wore cowboy boots, blue jeans, a white shirt. He was in his mid-30s, clean-shaven, average weight. What sticks in my mind, though, is that he was really paranoid. He kept asking where we were going and exactly what would happen. Well, we went and talked in a restaurant in the shopping mall. I seem to recall I had a fruit cup. They didn't sell fruit cups, but I got them to make me one. Anyway, Richard said he had the modules in a briefcase in his car trunk, so we went and visited a dealer I knew nearby and borrowed his shop for a couple of minutes.

"The boards were regular Plus boards, except the big chip had soft brown epoxy all over it. I was given a demonstration that convinced me that the codes in the original board had been cloned. So he asked me if I was interested in buying it. He said a few select people were being invited to New Orleans, and they should bring $50,000 each, and they'd each walk away with the Plus fix."

And was Fred really tempted to go?

"The guy was convincing. He got me hyped up. Sure, I wanted to go! But then we started getting calls from little guys, out in the boondocks, who knew nothing or less, and they had been approached with the same kind of line. Ron said something smelled fishy about it, so we stayed home."

Others weren't so cautious, and in September 1993, they fell into the trap. The headline in Satellite Business News announced, "Customs Sting Nabs Hackers." According to the article, "satellite signal pirates took a major blow this month with the arrest of at least six key underground players.... The project culminated Sept. 7 during meetings in Kenner, La., near New Orleans, where agents demonstrated 'modified' VideoCipher II Plus decoders prepared by General Instrument Corp.'s (GI) VideoCipher Division. Customs is believed to have videotaped the meeting. As a result of the investigation and subsequent raids, federal agents seized key computers feeding wizard codes to chipped VideoCipher modules, leaving thousands of owners of modified units unable to steal programming. The operation sent shock waves through the hacker underground."

But according to Fred, this wasn't the most interesting aspect of the story. Two of the people arrested were Jeff Carr and Jeff Mayes, originators of the VMS modem system. In the course of reverse-engineering the VMS system to develop his own version of it for Ron, Fred had found a "back door" in its program code. In other words, if someone knew a secret password, that person could dial into any dealer's VMS system without being detected. Moreover, because all the dealers' systems were linked together so that codes could be passed along automatically, the intruder would be able to step through the entire dealer chain from top to bottom, gathering every dealer's name and every customer's phone number along the way.

To Fred, it looked as if "Jeff and Jeff" had written themselves an insurance policy. If they were ever arrested, they could plea-bargain by offering to hand over the back-door password that would unlock their entire system.

When all charges against Jeff Carr were dropped after the New Orleans event, Fred felt that his suspicions were confirmed -- although, of course, he couldn't prove anything.

But there was another implication that was even more mind-boggling. As Fred put it: "GI can now pull ECMs on modems." In other words, if General Instrument was given the secret password, the corporation could perform an electronic countermeasure to gain access to every user's VMS modem and sabotage the onboard program code. So far as anyone knows, this has never happened; yet it's entirely plausible. General Instrument has spearheaded industry efforts to crack down on piracy and has already used complex data patterns, inserted with regular TV programming, designed to shut down "chipped boards" while leaving legitimate decoders untouched.

There's a bizarre symmetry to this situation. The programmers built a network for TV distribution, which was threatened by hackers. In response, the hackers built their own network for code distribution -- and it has now been threatened by the TV programmers.

Meanwhile, somewhere in this war of hack and counterhack, bewildered consumers are wearying of the whole game. After all, they just want to watch TV.

Friends in High Places

After an hour or so, Ron MacDonald and Conchy Joe join us at the pizza parlor. Ron has his laptop with him, so now our red Formica table has three computers on it. "I want to show you something," says Ron. He goes into Norton Commander, which he uses to keep a simple database. "See here, this list of names and addresses. This is the kind of list that a satellite TV dealership might have." He points at names scrolling up the screen.

The display stops, seemingly at random, at a man named Ford. His title is US Deputy Chief of Mission to the Bahamas.

"It's fairly common knowledge where his house is," says Joe. "I can tell you how to find it. You might want to stop by and look at his dish. You see, everyone in Nassau is breaking US law. I even know some DEA agents down here who have chipped boards. It's accepted. There's nothing to it."

Perhaps this seems like a long chain of suppositions, but consider the facts. If a dish has been installed, we can assume that someone wants to use it. If it's being used to receive American programming, copyright violations are almost certainly involved, because American programmers don't generally own the right to distribute their fare in foreign countries. Moreover, if a dish is receiving scrambled channels, there are only two ways this can be done: by using a "chipped board" (which is itself illegal) or a VC II Plus, which cannot be exported legally from the United States. Thus, anyone who uses a satellite TV dish in the Bahamas almost inevitably violates at least one US law.

Ron closes his computer. "Now," he says, "were there some other questions that you wanted to ask me?"

I tell him I want to know how he got started in the business.

"I was renting out videos back in the early 1980s, when I realized that I could tape HBO from satellite broadcasts and rent copies of the tapes to my customers. My customers loved them, because the titles weren't available on video in Canada. Then I started selling satellite TV systems. But in 1986, when HBO started scrambling its signal, I was driven out of business. I had dozens of customers for whom I was in the process of doing site checks and dish installations, and I lost all of those sales because HBO was no longer available."

After that, for a while, Ron went on the road as a salesperson for auto parts. But he maintained his interest in satellite TV, and a year or so later, at an industry convention, he found someone who had the first VC II fix. "I came back on the plane with it," Ron recalls. "It was a partnership investment that I made in collaboration with another Canadian. The only problem was, we couldn't get enough of the modules to modify. The distributors were gouging the satellite retailer on pricing. So we went directly to the United States, bought two or three hundred pieces at a time for $339 each, drove them back to Canada, cleared them through customs legally, chipped some, and sold the rest.

"Then a dealer who had the VC II fix, whom we were dealing with, screwed us out of $58,000 and ended up in trouble, closing down his business. I made an offer to his three employees and formed another organization called The Blues Brothers. Around that time, GI introduced the 018 board. No one had a fix for it, and nobody could pull seed keys and write software for it. Through the efforts of my new team, we extracted seed keys and started selling them through the United States and the Caribbean, and eventually sold seed-key pullers. We accidentally released the first set of seed keys to one Canadian and one US guy; within 24 hours, they were sold throughout North America and the Caribbean, and we lost $500,000 on that. That was the famous set of seed keys, 97FA, and after that we realized that pirates will pirate pirated software from other pirates, any time of the day or night. It's the nature of the industry."

But he seems to set himself apart from that dog-eat-dog mentality.

"It's ultimately self-defeating," says Fred. "People trust us today, more than anyone else in the business, because they know we don't bullshit."

Is there a truly positive aspect of video piracy?

"Absolutely," says Ron. "If it wasn't for piracy, the price of programming would not be as low. We have forced programmers to compete with the cost of chipping the VideoCipher."

"And when you consider that reasonable pricing was all we asked for at the start," says Fred, "we had to go through a lot of shit to get it."

"You also have to remember," Ron continues, "other organizations are just as much involved in this. All along the border between the US and Canada, small cable companies grab Canadian signals and put them on their systems, and vice versa. And then you have Can Com. Can Com was stealing Detroit TV, uplinking to a satellite, then sending it out to snowbound towns in northern Canada and charging them an arm and a leg."

I ask Ron if video piracy involves any weapons or threats of violence.

"I know of two suicides caused by the FBI raiding small satellite dealers who chipped boxes," he says. "But no other violent acts."

"I met one guy who claimed to be well connected with the Mafia," Fred puts in. "But I've never had anyone stick a gun in my face or threaten me."

I tell Ron and Fred that when I get back home, I'm planning to call General Instrument for their side of the story. Does either of them have a message for the guys at GI?

"I'd like to know why GI continues playing the game," says Fred. "Why don't they upgrade all their signals to the Plus format? Are they still trying to prove to the programmers that their old system is secure? Are they having fun doing ECMs or what? They've had the Plus out for three years, and every legitimate consumer has one now. GI could upgrade their last commercial customers real cheap and shut down the VC II system completely. I don't understand why they don't do that."

I turn to Ron. Does he have any questions?

He smiles. "I'd like to know about the rumor that GI paid John Grayson $3 million for his version of a Plus fix. You know, Grayson definitely owns the capability. He did all the necessary background work."

"I saw it," Fred agrees. "There was a strong indication he was planning to release it in March, 1994 -- and then it just didn't happen."

Who is this man Grayson?

"He built his own proprietary implementation of the VC II several years ago to compete with GI. It was a completely different, legal board. He was in the midst of negotiating to set up his own authorization network and uplinks when GI organized a raid on his business. They went after him for copyright and patent infringements, although I'm not even sure the product is patented in Canada."

"After two years of trying to follow the case through the courts," says Ron, "I lost track. The point is, Grayson has marketed no product for the last two years -- yet an engineer who works for him just bought a new helicopter."

(Subsequently, my attempts to verify this story with Grayson are unsuccessful. He seems to have left the United States, and pirate sources claim to have no idea where he's gone. The story remains just another unconfirmed rumor, in a field where rumors are common currency.) I ask Ron whether, if he had a Plus fix himself, he would be tempted to sell it to GI, assuming GI was willing to negotiate.

He's quiet for a moment, and I imagine he's weighing up the money that would be involved. Then he shakes his head. "No," he says. "If I had a Plus fix, I'd have more fun and I'd make more money by marketing it than by selling it back to those pompous pigs at GI."

Chipping for Fun and Profit

If and when someone does market a Plus fix, TV dealers will find out about it easily enough. All they'll need to do is open up their monthly copy of Satellite Watch News.

Satellite Watch News is a living tribute to unfettered capitalism. With unabashed pleasure, it informs dealers of every new opportunity for signal theft, and it even lab-tests some of the illegal products that it advertises in its own back pages. These ads are even more outrageous than the editorial content, offering VC II fixes via mail order and instructional videos to take the neophyte step by step into the black art of chipping boxes in the privacy of his own basement workshop.

Ron MacDonald advertises in Satellite Watch News, and I made my initial contact with him simply by dialing the number listed in his ad. Other suppliers are equally accessible, although they prefer not to talk about their products over the phone. As Ron said when I first called, "You already know what we sell, and you know what it does, so we don't need to go into that."

Getting the products into the United States is tricky, since importing them carries that same maximum penalty of $500,000, a five-year jail term, or both. In some cases, products have been smuggled in via Native American reservations. For obvious reasons, no one wants to discuss the details.

The publisher of Satellite Watch News is Dan Morgan, a former subscriber who purchased the magazine in January 1994. Unfortunately for Morgan, after the New Orleans sting, advertisers have backed off. He seems unconcerned, however. "The advertising has dropped," he says, "but I foresee, in the near future, a revolution in the pirate industry. You would be amazed if you could see the work that's going on in laboratories right now."

Morgan is a Vietnam veteran, a gun-owning, liberty-loving, heartland American who is deeply disturbed by trends toward greater government control and regulation. He believes in free access to the airwaves and is outraged that in 30 states, local laws make it a crime to own descrambling equipment even if you never actually use it. "I think you should be able to possess any damn thing you want, so long as you don't hurt people," he says.

He describes himself as an R&D engineer, and he says that his company, Morgan Engineering, designs electronic devices. Does that include VC II modifications?

"I just report on the industry," he says carefully. "It would be foolish for me to get involved in any way. But I will say that it's people like them [video pirates] who make the world a great place."

Does this mean he endorses piracy?

"I'm in a position where I cannot say that piracy is OK. However, I believe in the Constitution of the United States very strongly, and I think that officials in the industry are losing contact with the Constitution.... They've come down harder on dealers than they have on cocaine addicts."

Psychological Warfare

The man who can take most of the credit for this crackdown is Jim Shelton, who was at General Instrument until just recently. Shelton, 42, is a deceptively mild-mannered, amiable, laconic Southerner who learned about cryptography when he worked on top-secret communications in the US Air Force.

When Shelton took his job at GI, he felt that the company was mishandling the piracy problem. They were dealing with it, he recalls, "as British soldiers dealt with the Indians. They were very staunch and proper, while they got slaughtered. Myself, I deal with them on their own level."

While at GI, Shelton was an avid reader of pirate magazines such as Satellite Watch News. He sent undercover agents to infiltrate the pirate community. And he practiced psychological warfare, timing his ECMs to have maximum effect. He released one during a trade show where pirates were known to gather, forcing them to abandon their meetings, re-book their air tickets, and go running back to Canada to cope with floods of phone calls from dealers whose chipped boards didn't work anymore. Another time, Shelton waited till the coldest day of winter, figuring that consumers depend most heavily on their TVs when they're snowed in. "Have you ever had cabin fever?" He chuckles happily. "You get to know your family real well."

When I speak with him, Shelton seems to get active enjoyment out of his cat-and-mouse game; but when I suggest there's a humorous side to it, he quickly reverts to a more corporate tone. "It's no more amusing," he says, "than people who don't pay their bills."

I ask if the name Ron MacDonald means anything to him.

"Oh, yes. He's a big-time pirate. He's made a lot of money. I met him at a trade show one time. When I started doing some background checks, I found out he was one of the kingpins involved in piracy.... I was very disappointed he didn't come to Louisiana [for the New Orleans sting operation]."

Is Shelton aware of the rumor that General Instrument released its own encryption secrets to boost the demand for decoders?

"I can find no evidence of that activity," he says. "And once security was broken, aggressive countermeasures were taken, followed by realization that a complete rework was needed, with the focus on the consumer market." He adds: "Our initial purpose for encryption was not for the home market, but to secure the cable market using commercial decoders." He seems to be saying that if GI had known that there would be such a huge consumer demand, they might have taken more trouble to make the VC II more secure.

According to Shelton, it was the rumor that GI released its own secrets that gave him the original idea for the New Orleans sting. "I said, what

if we do break [security on the Plus]? We know how. We can go out and sell it -- and bring these guys in that way! So the pirates themselves

gave me this idea. Everything I've done comes from the pirate underground. Thanks to Satellite Watch News, I know who to target. Thank God for freedom of speech! If they didn't talk so much, my job would be much harder."

Does he have any sympathy for the concept that the airwaves are a public resource to which everyone should have free access?

"We grew up with broadcast signals that were advertiser-supported. Then cable came along, and people said, 'You mean, I got to pay for the programming? That's not right!' But people are now starting to understand that HBO will show better quality movies and in greater quantity, because part of the money goes back to the studios for production.

"You're always going to have theft," he goes on, "just as department stores have theft. But to what degree? At one point, it was calculated that 80 percent [of satellite TV dealers] were involved. It was a matter of getting it under control. You know, Turner Classic Movies was launched thanks to the direct-to-home market, because there are now 1.7 million authorized decoders receiving satellite TV. So the market base is there, and we are going to have better quality programming."

This sounds reasonable. Yet Shelton's smooth, amiable manner distracts from the darker implications of his work. GI has been accused by many satellite TV dealers of hiring ex-FBI agents who are paid on a commission basis to entrap dealers, subjecting them to penalties that seem cruelly severe compared with their crime. John Norris, whose title is manager of special projects at GI's Access Control Center, has a direct, hands-on involvement in this legal process. He describes himself as "Jim Shelton's trigger man."

"I've testified recently at trials where guys got ten months in prison," he says, calmly, unemotionally. "In Great Falls, Montana, a guy got 37 months in prison. All these guys were thumbing their noses at the system, and now the system is coming back and whacking them."

He's helped to achieve more than 100 convictions. Does this give him any mixed feelings?

"I don't feel good or bad about it," he says. "It's up to the justice system to decide what they deserve. I merely provide help gathering and presenting evidence. And I will sit down and drink with any people who have been arrested through my testimony, and they'll say I acted like a gentleman. Many of them respect what I've done, because I didn't take it personally, I dealt with them in a proper way."

Norris sees piracy in very simple terms: "It's not so different from a movie theater. Some kid opens a side door and lets people come in -- and as a result, the theater may go out of business."

So Norris protects the business by rounding up the kids and putting them behind bars.

I ask him about the aftermath of the New Orleans sting. How many people were actually arrested? And how many of them are plea-bargaining or set free in exchange for evidence against their former comrades?

Norris is reluctant to comment. "Four to six were lured to New Orleans," he says. "I cannot tell you what they're charged with. Several were charged with smuggling, hand-to-hand exchange of contraband. Other statutes could apply: copyright violation, wire fraud, mail fraud."

I sense he's holding something back. Why isn't GI publicizing all the details of the operation to discourage other pirates? He doesn't want to talk about it.

So I thank Norris for his time, and I place a call to the US Attorney's Office in New Orleans. A friendly flak named Robert Boitmann listens to my inquiry and promises to send me the arrest records and court transcripts (which are, of course, public property). But when I call him the next day, he claims he can't find any record of the case. He believes I must have made an error.

Satellite Watch News has already published a copy of the criminal complaint against Jeff Carr, sworn by customs agent Richard Coleman in US District Court, Eastern Louisiana, on September 8, 1993. So I am able to tell Mr. Boitmann the case number.

This does not please him. He sounds considerably less friendly as he tells me that he'll check again and get back to me. But he never does call back, and when I make further attempts to contact him, my calls are not returned.

Maybe I'm picking up the low-key paranoia that pervades the pirate community, but it seems to me that someone, somewhere, doesn't want us to know exactly what has happened to the people who were arrested in Louisiana.

It's Only Television, Right?

When I try to contact Carr at his home number, I reach an elderly woman who tells me, with elaborate caution, that he's out of town and that she doesn't know when he'll be back.

In the meantime, however, I've made contact with one of John Norris's victims, who was caught in a previous sweep. He currently participates on Ron MacDonald's bulletin board under a fake identity, but he's so nervous, he refuses to use even this name during our telephone conversation. He refers to himself simply as "Dave."

"There was a knock on my door," he recalls, "and I looked out and saw all these guys with bright orange letters on their dark blue windbreakers. FBI, Customs, police. There were guys at the front door, the back door, the sides of the house. They were in the car port -- it was like I was Charlie Manson. They scared the shit out of my wife and kids. They searched every room, and they took photographs when they came in and when they left, so I couldn't claim they tore the place up. They took everything, all my guns, my cash, my records, my UPS shipping book. It was unbelievable."

Dave is certain that he was caught because another pirate betrayed him. "There's no honor among thieves, in this business. Under the federal system of determinate sentencing, if you've done a crime over a certain amount of money, you get a lot of points against you, but you can work those points off by pleading guilty or by cooperating. Somebody cooperated and gave the Man my name, and I got hit, and I'm not proud to say it, but I ended up cooperating, too, so I wouldn't have to go to prison. I gave them my customer list. I don't know what happened. They never called me to testify against the people I named."

Dave lost just about everything he owned. "My house is up for sale: they took all the cash I had, and my new pickup truck. It's called civil seizure. Anything they figure that I bought with money from the pirate business, they can take away."

Like many people in the business of chipping boards, Dave served in the armed forces and is largely self-educated in electronics. "I didn't graduate from high school. I went through the military, I was overseas, I got some training in cryptography and some radio stuff, and in 1986 I realized -- hell, this is not that hard to do. I wasn't hurting anybody. And the money was good. I'd say I made close to a quarter of a million in the first three years. I've been to Okinawa, to Le Havre, to London -- we took trips you wouldn't believe, based on the money from this. It was big money, and it was easy money."

He's now partway through five years of probation. If he gets caught again during that period, he'll serve jail time not just for the new charges but for the old ones as well.

Even so, he says, "I'm still involved with the business, because it's the only way I know how to make a living."

Like many others, Dave was invited to New Orleans. Fortunately for him, he didn't believe that the Plus fix was real, so he chose not to go. "If

I had," he says, "I'd be in prison right now."

Dave was personally acquainted with the man in Montana whom John Norris helped to put in jail. "His name was Jack Lande: he's an Indian, he was operating out of a reservation, so he figured he was safe. But he had the FBI there, and Customs, and the Bureau of Indian Affairs, and now he's doing 37 months in prison. I mean, prison, for more than three years! It's only television, right? I don't think it should be such a serious crime. We've got drug dealers out there, gangs, but for some reason, the government thinks this is more important than going after the Crips and Bloods and everybody else. Seems to me, GI must have undue influence over the government."

For Dave, it's partly an issue of freedom. "I feel there are constitutional issues. I think the airwaves are free, and I have a right to see what's out there. I should have the right to own guns, too. I had a collection, from muskets to old Winchesters, a Mauser, a Walther PPK. They took everything. One of the agents went in there when they were doing their search, and he said, 'What are you, trying to start an uprising?' It's none of his business. If I like guns, the Constitution says I have the right to own them, and it doesn't say I can only have just one. I'm not a vigilante, I'm not crazy. I'm not an off-the-wall guy, but I feel I have certain rights. And if I want to watch television, and I figure out a way to watch it, I don't think I should be a felon."

Does he think that satellite TV piracy still has a future?

"Among the end users, there's maybe 10 percent who are die-hards and won't go legal no matter what. The rest are waffling. Some of them have bought the VC II Plus from me, because I can sell that legally. I pick up maybe $40-a-board profit, not very much. They'll use that for their Playboy channel or HBO, and then they'll still use their old modified VC II board for the other channels it can get, so they don't have to pay $200 a year for that programming."

And so, cautiously, Dave continues to eke out a living, aided by Ron MacDonald's code distribution system.

"Ron has promised me that he's got my name, and all the subscribers to his bulletin board, locked in a bank vault in the Bahamas. I've got a lot of faith in this guy, but if he ever sells off that list, you can probably say goodbye to piracy -- unless somebody comes up with a crack on the Plus."

Would that really make a difference?

"Oh, yeah. If you pop the Plus, it'll start all over again. I would be willing to move anywhere and start a new business under a different name, change my fingerprints, whatever it takes. I would make a million dollars in 30 days, then relocate to Australia or somewhere."

Surely, it wouldn't be that easy.

"Yes, it would. Here's how it goes. I walk into a customer's house and I've got me a busted Plus. I plug it in and tell them, you watch it for a week, and I'll come back, and if it's still working, you buy it from me for $700. Believe me, they'll buy. I could drive across this country with a van full of boards, and I could stop at every satellite dish, and every place I stop, I could make a sale. I guarantee it."

But General Instrument claims there are ECMs inside the Plus just waiting to be set off.

"I don't know that I believe that. See, they can't change the access keys so often, because there are so damned many boards out there. Only 300,000 VC II boards were ever authorized, so they can change the code every three days. But they got damn near two million Plus boards, and they can't change it every three days, because they can't process the keys fast enough."

If Dave is correct, the Plus is a disaster waiting to happen, and as the installed base keeps growing, the temptation to exploit it becomes greater. Sooner or later, it seems inevitable that someone, somewhere, will hack this board.

The only thing that might prevent it is General Instrument's introduction of yet another encryption technology.

And this is exactly what the company plans to do.

Not-So-Smart Cards

MPEG is a new, relatively untried system for digitizing a video signal and removing redundant data. When a video picture is stored or transmitted, MPEG can squeeze it by a factor of ten. And theoretically, this means that ten times as many channels can be broadcast from the same number of satellites.

Some programmers are already considering digitized uplinks, although this would potentially exclude the home dish owner, who has no way to process an MPEG-coded signal in order to view it.

To address this imminent situation, GI has proposed DigiCipher, an MPEG-compatible system that could scramble the digitally compressed TV signal at every point in the distribution system -- not only in satellite TV, but also inside cable distribution networks. Since GI would retain exclusive control over DigiCipher technology, the corporation would acquire the sole right to manufacture or license the manufacture of DigiCipher decoders for sale to every satellite TV subscriber and every cable TV viewer in every city in America. As a result, more than 30 million consumers would be forced to buy the GI product.

Tele-Communications Inc. (TCI) ofDenver has greeted this possibility by already ordering 100,000 decoders. But other GI competitors are less eager to embrace the monopoly. In March 1994, The New York Times reported that in response to complaints, GI has been the target of a six-month investigation by the Justice Department's antitrust division, which is also scrutinizing the incestuous relationship between GI and TCI. The results of this inquiry are not yet known.

Most recently, in April 1994, Satellite Business News reported that the FBI's office in Hickory, North Carolina, "has opened an investigation in an effort to determine how the technology used to compromise the VideoCipher system was distributed into the hacker underground.... General Instrument maintained a major distribution and repair facility in Hickory until last year and still has a small office there."

Of all the people I spoke to while researching this article, no one had a kind word to say about General Instrument Corporation -- not even the TV programmers. When I asked the publisher of a conservative trade journal if he thought it was conceivable that GI could have paid John Grayson $3 million not to release his fix for the VC II Plus, the publisher questioned whether Grayson would have accepted such a deal, but he didn't doubt that the corporation might have made the offer. Rightly or wrongly, GI is perceived as a company that has cut more than a few corners to achieve total market dominance.

In the meantime, while the investigations run their course, and while DigiCipher is nothing more than a promise or a threat, GI is test-marketing a decoder that provides additional security using the existing VC II Plus format. Named the VCRS, it allows "Renewable Security" via a permanent telephone-line connection and a "smart card" inserted by the user. If the card isn't valid, the unit won't work; at any time, the unit can be tested over the phone.

This may seem like anti-hacker overkill -- even so, the pirates are unimpressed. Smart cards have already been used in European satellite TV decoders, and hackers there have already defeated them. According to John McCormac, who was interviewed in the underground publication Scrambling News, one way the card has been beaten is by making counterfeit copies with the addressing and turn-off routines removed. McCormac says this is known as the Ho Lee Fook hack -- not because it came from Asia, but because its name "conveys the sense of dismay" that TV executives feel when they first learn about it.

Another strategy (which McCormac modestly lists as "The McCormac Hack") involves "lifting a live data stream from inside a decoder and using it to activate other decoders in the area." In other words, the validation code is taken off the circuit board and broadcast via a small radio transmitter to other decoders that have been fitted with miniature receivers. The signal will be virtually impossible to detect, since it will last only for a few milliseconds.

As for DigiCipher -- if it is ever introduced, even this may be vulnerable, since it, too, resembles schemes that have been hacked in Europe. Moreover, if GI's dream comes true and DigiCipher is used in every cable network in America, video pirates will be motivated to spend almost any amount of time and money to crack it. Thirty million viewers feeling mad as hell about being overcharged and exploited is a lure that few pirates could resist.

In the same way that a monoculture is more vulnerable to pests than a diverse ecology, a single encryption standard would be far more vulnerable to piracy than the mosaic of different schemes used by cable networks today. "In a way, we're hoping that GI goes with DigiCipher," Ron MacDonald says cheerfully. "It will renew the pirate underground."

Legalized Signal Theft

In Europe, TV programmers can't use the law as a weapon against piracy. Most countries have no laws against descrambling TV signals that originate outside the national border.

In the United States, of course, video piracy is illegal -- or is it?

Pirates quote the 1934 Communications Act, which banned the use of jamming or scrambling equipment and guaranteed the right of all Americans to receive any form of radio transmission. There was an important underlying principle behind this legislation: the radio spectrum is a limited natural resource, like air or sunlight, and everyone should have access to it.

In 1984, however, the Cable Communications Policy Act changed all that. Nudged by lobbyists for programmers such as HBO, Congress decided to make satellite TV transmissions a special case, exempt from public access. The Act begins, "No person receiving, assisting in receiving, transmitting, or assisting in transmitting, any interstate or foreign communication by wire or radio shall divulge or publish the existence, contents, substance, purport, effect, or meaning thereof...."

This reads like an attempt to protect the privacy of communications that are addressed to specific individuals. How can it apply to television broadcasts?

Well, the next section of the Act suggests that "satellite cable programming" isn't really a broadcast at all. It's a private communication, and if the signal is encrypted, the Act protects it from interference.

But that's an odd phrase, "satellite cable programming." Why is the word "cable" there?

The phrase is defined a little further on: "video programming which is transmitted via satellite and which is primarily intended for the direct receipt by cable operators for their retransmission to cable subscribers."

So, the intent is now clear. Satellite TV is considered a private communication because it is "primarily intended" for cable companies, not for broadcast to the general public.

Unfortunately, in the ten years since this Act became law, the situation has changed radically. Can HBO still claim that its signal is a form of private communication (please, don't call it broadcasting!) when there are hundreds of thousands of dish owners now paying to watch it legitimately? Can Turner Classic Movies be considered "satellite cable programming" when it is being sent only to home dish owners, and not to cable networks at all?

A new development promises to test the law even more severely. The first Direct Broadcast System is being marketed in the United States by DirecTV. This form of satellite TV is aimed at city dwellers and country folk alike. The small dish is cheap, because it isn't movable. It points only at one satellite that transmits multiple channels in a digitally compressed format. Direct Broadcast System is obviously a broadcast system intended for consumers. It can't possibly meet the criteria of the Cable Communications Policy Act.

This raises the interesting possibility that someone who hacks the system may be able to claim that the signal is unprotected by federal law. At that time, a whole new chapter of legal video piracy could begin.

The Will of the People

Satellite TV sounds like a dull little backwater, far from the cutting edge of personal communications. Yet its quirky history offers lessons that are painfully relevant to our immediate future.

Lesson Number One: The airwaves aren't free anymore. Sections of the radio spectrum are being reserved for paying customers only, and this trend will probably continue as more forms of data are sent via satellite. Do we care? Should we try to fight it? At the very least, shouldn't we question the process by which segments are being seized by those corporations with the greatest political influence?

Lesson Number Two: Never underestimate grass-roots opposition. Backlash against scrambled satellite TV astonished companies such as GI and HBO, who thought they had fixed the whole thing with the aid of some friendly lawmakers in Congress. They grossly misjudged the stubborn anger of everyday people in the American heartland who are hypersensitive about their liberties and unimpressed by laws that serve special interests alone. If more than a million plain folks were once willing to endure the risk, inconvenience, and anxiety of committing a felony on a continuing basis, despite coordinated attempts to scare them into compliance, they could do it again.

Lesson Number Three: There ain't no such thing as secure data. The DES algorithm is mathematically impregnable and has never been broken, even now, by any of the pirates. That doesn't mean, however, that if you use it to scramble a signal, the signal is safe. Sooner or later, if it's going to be of any use to anybody, the signal has to be descrambled. At that precise moment, it becomes vulnerable. The decoding device can be cloned, or its decryption keys can be copied, or the signal can be tapped and retransmitted. All these techniques have been used by hackers. This point is relevant in the current debate over encryption standards: you don't necessarily need to break an encryption code in order to break into the system.

Lesson Number Four: Encryption protects little guys better than big guys. When a scrambled TV signal is sent to millions of decoder modules, that signal becomes easy pickings. When two individuals exchange a brief encrypted message, that message is relatively secure. Video pirates have started test-running PGP (Pretty Good Privacy, the "people's encryption software") to protect private messages that they exchange via their bulletin boards. This doesn't just put the pirates on equal terms with the programmers, it gives them an edge. Cypherpunks have promoted PGP as protection from a potential police state, while the Clinton administration sees it more as a threat to law and order. Evidently, both sides are correct, but there's no point in arguing about it anymore. The genie is out of the bottle.

Lesson Number Five: Computers really do empower the individual. We've heard this so many times, but now we're starting to see the results. For eight years, a handful of hackers have battled some huge, cash-rich corporations, and the corporations still haven't won. In an information economy, a powerful institution can be thwarted and maybe even ruined by a few smart, ornery people owning microcomputers.

Lesson Number Six: Protecting your data may cost you more than you'd lose by letting people steal it. Encrypting satellite TV required a huge capital investment, while millions more went into unsuccessful attempts to defeat piracy. Public money has been wasted on elaborate police operations to trap hackers, and more money is now being spent to keep some of them behind bars. Lives have been ruined, lasting resentment has been created in rural communities, and respect for government and the law has been eroded -- all because HBO wanted to restrict public access to its data stream. In fact, dish owners were never the primary market, anyway. The TV programmers could have simply ignored them, and the loss of potential revenue would have been bearable.

An analogy can be drawn here with copy protection of floppy disks. For years, software publishers wasted countless work-years devising byzantine protection schemes, while hackers wasted an equal amount of time cracking them. "Bit-nibbler" software was cheaply available for anyone who wanted a bootleg copy of dBase or Lotus 1-2-3. Meanwhile, legitimate consumers were maddened by disks that couldn't be backed up and programs that didn't run properly on hard drives.

In the end, the software publishers gave in and abandoned copy protection. None of them has gone out of business as a result. As Fred Martin points out, many consumers are willing to pay for the legitimate product when the price is reasonable, especially if they reap extra benefits such as proper documentation and technical support.

But this compliance cannot be achieved by moral or legal pressure. For most people, theft of data is in no way a moral issue; it doesn't create even a twinge of guilt. Consumers today are unimpressed by the legalities of copyright or the potential penalties involved.

Bearing this in mind, which is the better policy: to make concessions to consumers or to clamp down and try to force them to obey?

The history of copy protection proves that concessions can be workable. The history of satellite video piracy indicates that clamping down leads to draconian law enforcement, huge unforeseen expenditures, and a flourishing black market patronized by everyday, law-abiding Americans. Our system tends to function best when consumers are given a fair shake and freedom to choose. Trying to limit their options and beat money out of them with a bigger and bigger stick has never been a viable long-term policy.

Satellite TV Terminology: A Quick Reference Guide

Note: some of these terms have additional meanings outside the field of satellite TV. Only the TV-related definitions are included here.

Authorization code: A signal added to the usual TV data stream, addressed to an individual decoder module to authorize it to descramble that channel. Also known as a hit.

Cable head-end: The entry point in a cable TV system, where signals are received via a set of satellite dishes and are decoded for retransmission to cable subscribers.

Chipped board: A printed circuit board, usually in a decoder module, which has had one of its chips replaced illegally with an EPROM.

Chipper: A person (usually a dealer) who removes one or more silicon chips from a decoder module and substitutes other components that will enable the module to descramble satellite TV.

Data stream: The TV transmission from a satellite.

Dealer: An installer of TV dish equipment who may also deal in products that enable signal theft.

Decoder module: A device to descramble satellite TV signals. The VC II is the most common decoder module hacked by video pirates.

DES: Data Encryption Standard, a mathematically impregnable code controlled by the federal government.

DigiCipher: A system of digital compression and encryption proposed by General Instrument Corporation but not yet implemented.

Digital compression: Removal of redundant data from a digitized video signal, so that it takes up less "room" when it is transmitted.

ECM: Electronic countermeasure. A signal or set of codes designed to defeat a successful hack.

EPROM: Erasable, Programmable Read-Only Memory, a chip that can store a computer program. The computer code is easily and cheaply installed by a desktop gadget known as an EPROM burner, usually driven from the serial port of a PC.

Hack: (n) Hardware and/or software that is designed to defeat a data protection scheme. (v) To create such hardware/software.

Head-end: See cable head-end.

Hit: See authorization code.

Identification number: The unique number assigned to a decoder module so that it can be addressed individually by an authorization code.

MPEG: A standard for digital compression of video.

Plus break: A way to fix the VC II Plus so that it will descramble satellite TV without requiring the usual authorization code. This has not yet been achieved.

Plus fix: See Plus break.

Seed keys: Unique numbers stored in a chip on each VC II or VC II Plus decoder. These numbers are necessary (in conjunction with the identification number of the board) for descrambling a satellite TV signal.

Transponder: A device, usually on a satellite, that receives an uplinked signal and retransmits it, usually with greater power.

Uplink: The TV signal that originates on the ground and is sent up to a satellite.

VideoCipher: An encryption standard invented and owned by General Instrument Corporation, which devised it for scrambling satellite TV signals.

VC II: Abbreviation for VideoCipher II, an encryption standard; also a decoder module designed to descramble satellite TV signals.

VC II Plus: A new version of the VC II, not yet successfully hacked by the pirate underground.

Wizard code: A number derived from the seed keys of a VC II decoder module, in combination with an authorization sent by a programmer. The wizard code can be used subsequently in other VC II boards, to descramble a selected channel.

Useful sources for additional information

Bulletin Boards

TCC-BBS Sponsored by The Caribbean Connection (Ron MacDonald's organization) in the Bahamas. For 9600 bps, dial +1 (809) 322 2996 or +1 (809) 322 2997. For 14,400 bps with V.32/V.42 bis, dial +1 (809) 322 2998 or +1 (809) 322 2999.

Satellite Watch Sponsored by Satellite Watch News. For 2400 bps, dial +1 (517) 685 2450. For 14,400 bps, dial +1 (517) 685 2451.

Publications

Satellite Business News Mainstream biweekly magazine that includes coverage of developments in video piracy. Editor/Publisher: Bob Scherman. 1050 17th Street NW, Suite 400, Washington, DC 20036. +1 (202) 785 0505.

Satellite Watch News Underground monthly aimed at dealers and programmers who are interested in piracy. Editor/Publisher: Dan Morgan. Morgan Engineering Co., P.O. Box 475, Rose City, Michigan 48654. +1 (517) 685 3410.

Scrambling News Irregular, slim publication offering down-and-dirty investigative pieces with no advertising, for dealers interested in piracy. Editor/Publisher: Dave Lawson. 1552 Hertel Avenue #123, Buffalo, New York 14207. +1 (716) 874 2088.

The Transponder Controlled circulation, conservative trade publication for the satellite TV industry. Editor: Tim Jackson. 4250 North State Street, Salamanca, New York 14779. +1 (716) 945 5091.