On the morning of July 16, 2001, FBI agents arrested a man whose crime was knowing how to read. More precisely—helping others read books they had purchased on any device, not just the one approved by a corporation. Dmitry Sklyarov, a twenty-seven-year-old programmer from Moscow, had flown to Las Vegas to speak at the DEF CON 9 hacker conference about vulnerabilities in Adobe's e-book protection. Instead, he became the first person in the world arrested for violating the anti-circumvention provisions of the Digital Millennium Copyright Act—a law that turned software research into a potential criminal offense.
Advanced eBook Processor did what seemed like an obvious owner's right: it allowed converting a purchased e-book from Adobe PDF format into a plain text file that could be read on any device, printed, or backed up. Technically, the program decrypted Adobe Content Server protection, which tied a book to a specific computer and prohibited copying text even for personal use.
ElcomSoft, the Moscow company where Sklyarov worked, developed and sold AEBPR in Russia starting in 2000. Russian law had no direct prohibition on creating such tools—copyright protected content, but not the technical locks on it. The program cost $99, was sold legally through the company's online store, and was positioned as a means for lawfully managing one's own purchases.
Adobe saw the situation differently. For the corporation, any tool capable of circumventing technical protection threatened the entire model of control over digital content—regardless of whether it was used for piracy or for reading one's own books on an unapproved device. On June 26, 2001, Adobe filed a complaint with the FBI, stating that ElcomSoft was violating the DMCA by selling the program to American users over the internet. The law was on the corporation's side: according to §1201 of Title 17 of the U.S. Code, creating, importing, or distributing technologies to circumvent copyright protection became a federal crime in 1998, regardless of whether copyright itself was violated.
Sklyarov did not create a pirate library, did not distribute stolen books, did not call for breaking the law. He wrote a program in a country where it was not a crime, and came to talk about how weak Adobe's protection was—standard security research practice. But American law did not distinguish between researcher and pirate if both touched the same code.
DEF CON—an annual gathering of hackers, security researchers, and curious engineers—took place at the Alexis Park casino. The conference atmosphere was built on the principle of complete openness: speakers demonstrated vulnerabilities in corporate systems, showed how locks were picked and DRM protections bypassed, shared reverse engineering techniques. Sklyarov's talk was titled "eBook Security: Theory and Practice" and detailed the weaknesses of Adobe's protection mechanisms—including the use of symmetric encryption with predictable keys and the absence of data integrity checks.
The presentation took place on July 15, the day before the arrest. Sklyarov spoke in academic language, showed slides with technical diagrams, explained why Adobe's current protection implementation could not be considered cryptographically secure. FBI agents sat in the audience. They did not interrupt, did not ask questions, did not stop the talk. They just listened and took notes.
The next morning, as Sklyarov was preparing to leave the hotel and return to Russia, he was stopped in the lobby. Federal agents presented an arrest warrant on five counts: four related to violating §1201(b)(1)(A) of the DMCA—creating technology to circumvent copyright protection, one—conspiracy to violate that same law under §371 of Title 18 of the U.S. Code. Each count carried up to five years in prison and a fine of up to half a million dollars. Sklyarov did not understand what exactly he had violated—in Russia his work was legal, at the conference he had not distributed the program, only talked about its principles. But American jurisdiction extended to everyone who found themselves on U.S. territory, regardless of where the actions took place.
The community's reaction was instant. Already on July 17, mobilization began in programmer mailing lists and hacker forums: Sklyarov became a symbol of the conflict between the right to research technology and corporate control over software. The Electronic Frontier Foundation took on coordinating legal defense, while organizations like Free Dmitry launched public protests.
Adobe found itself in an awkward position. The company had counted on a quick legal victory that would scare off other developers of similar tools, but had not expected the case to turn into an international scandal with the arrest of a foreign citizen. On July 20, four days after the arrest, Adobe published an official statement: the corporation no longer supported criminal prosecution of Sklyarov and asked federal prosecutors to drop the case. Adobe representatives explained that their goal was to protect the technology, not to punish a specific person.
But the American legal system does not work like corporate customer support. Criminal prosecution is the prerogative of the state, not the injured party. The U.S. Attorney's Office for the Northern District of California ignored Adobe's request and continued the process: the case was bigger than a private incident, it was supposed to establish a precedent for applying the DMCA to developers of circumvention tools. Sklyarov was released on $50,000 bail only on August 6, three weeks after his arrest, but was prohibited from leaving Northern California. The Russian programmer was stuck in a foreign country where his work was considered a federal crime.
Protests gathered momentum. In San Francisco, New York, Boston, programmers took to the streets with signs reading "Free Dmitry" and "DMCA Kills Innovation." Petitions collected tens of thousands of signatures. Open source developers and security researchers understood: if Sklyarov were convicted, any publication about DRM system vulnerabilities would become a potential criminal case.
On December 13, 2001, five months after the arrest, federal prosecutors offered Sklyarov a deal: charges against him would be dropped if he agreed to testify against ElcomSoft in court. The choice was simple—either remain a defendant in a case with an unpredictable outcome, or return home to Russia on condition of cooperating with the investigation. Sklyarov agreed. His status changed from defendant to witness, and he received permission to leave the United States.
The prosecution switched to ElcomSoft. The company was charged with the same five counts of DMCA violations originally brought against Sklyarov. The case was heard by Judge Ronald Whyte in federal court in the Northern District of California. In January 2002, the defense filed a motion to dismiss the charges, arguing that the DMCA violated the First Amendment—freedom of speech, since program code is a form of expression, and a ban on its distribution is equivalent to censorship. The judge rejected the motion, ruling that the DMCA regulates not speech, but actions—creating tools to circumvent protection.
The trial dragged on, but the prosecution could not prove the main point: that ElcomSoft intentionally created a tool for violating copyright, rather than for legitimate use. The defense insisted that AEBPR was intended for lawful purposes—creating backups, converting content between devices, ensuring text accessibility for people with disabilities. The law required proving intent to violate, but the program itself did not violate copyright—it merely removed a technical barrier that could, but did not necessarily have to be used for piracy.
On December 17, 2002, the jury returned a verdict: ElcomSoft was not guilty on all counts. There was no precedent. The DMCA remained in force, but the first attempt to apply it against developers of DRM circumvention tools failed.
The Sklyarov case exposed a fundamental problem of the digital age: laws have borders, software does not. AEBPR was created in Russia, where its development was not a crime. It was sold over the internet, which knows no customs. Sklyarov spoke at a conference about technical details of protection, which in any other industry would be called security research. But as soon as he crossed the American border, all of this turned into a federal crime.
The DMCA established a principle that sounds logical on paper and absurd in practice: circumventing technical protection is a crime regardless of whether copyright is violated. You can crack the protection on your own book to read it on another device—that is still a violation of the law. You can create a tool that theoretically allows legal use, but if it can bypass DRM—its distribution becomes criminal. The law protects not the content, but the lock on the content, and the quality of the lock does not matter.
ElcomSoft's acquittal did not repeal the DMCA and did not make such programs legal. It only showed that proving intent for mass piracy is harder than prosecutors thought. But the very precedent of arresting a security researcher for a public talk changed the rules of the game: conferences became more cautious about inviting foreign speakers, companies began requiring employees to clear trips to the United States, and DRM system researchers switched to anonymous publications.
Twenty-five years later, debates about the balance between protecting copyright and an owner's right to control purchased devices or content have not subsided, but have spread to new areas. Farmers sue tractor manufacturers for the right to repair their own equipment, smartphone owners fight for the ability to install third-party applications, medical device researchers risk lawsuits by publishing pacemaker vulnerabilities. The DMCA has become not a shield for authors, but a tool of corporate control over what happens to a product after its sale—and this model is spreading ever wider, from e-books to cars with autopilot.
Dmitry Sklyarov returned to Russia and continued working at ElcomSoft. Advanced eBook Processor disappeared from sale, but its source code spread across file-sharing networks and is still used by those who believe that a purchased book should be read wherever the owner finds convenient. Adobe abandoned strict DRM protection in favor of softer mechanisms, but not because it recognized users' right to control, but because the market demanded convenience. DEF CON continues to be held every year in Las Vegas, and talks about hacking protection systems remain one of the main parts of the program—but speakers now consult with lawyers before showing a working exploit in public.
The question posed by the Sklyarov case remained unanswered: can the law of one country criminalize technology research conducted in another if the results are available over the internet? As long as digital borders remain permeable and jurisdictions do not, every programmer crossing a border with code on a laptop risks finding themselves in a situation where their work is legal at home and criminal abroad. The arrest in Las Vegas turned out to be not an anomaly, but a warning about how law works in a world where laws are national and technology is global.