The Illegal Prime Number Was Never the Crime
Wendover Productions builds its episode around a sensational proposition: an ordinary number is so dangerous that possessing it can get an American arrested. The actual legal history is considerably more complicated, and the distinction Wendover erases is the most important part of the story: US copyright law targeted the distribution and use of circumvention technology, not the mere possession of a mathematical number.
The distinction is explicit in the Digital Millennium Copyright Act. Section 1201 prohibits circumventing technological protection measures and manufacturing, providing, offering or trafficking in tools designed to defeat them. It does not establish a general offence of possessing a number that represents computer code.
U.S. Code
The court case that made DeCSS a major legal controversy was Universal City Studios v. Corley. Eight film studios pursued Eric Corley and his company, 2600 Enterprises, over publishing DeCSS and linking to websites distributing it. The Second Circuit upheld an injunction against those activities in November 2001. It did not convict Corley of possessing a number.
Justia Law
The prime came after DeCSS had already defeated CSS
The chronology alone undermines the episode's central impression. The Second Circuit's account records that Jon Johansen and two collaborators reverse-engineered a licensed DVD player in September 1999, extracted the information needed to decrypt CSS, and developed DeCSS. The software was already being distributed in 1999.
Justia Law
Phil Carmody's famous 1,401-digit prime came later, in March 2001. Carnegie Mellon's computer science archive identifies it as a number encoding gzip-compressed C source code for a CSS descrambling algorithm, without its tables. In other words, Carmody converted existing software into a mathematically interesting representation; he did not discover the vulnerability or create the original decryption program.
CMU School of Computer Science+1
There is an important difference between a number that decrypts a DVD and a number that represents instructions for software that decrypts a DVD. The prime must be converted back into its underlying data and decompressed to recover the source code. Its mathematical property is not what defeats CSS.
The episode reverses cause and effect when it implies that the number made the protection useless and that bootlegging programs followed because of it. DeCSS existed long before Carmody produced the prime. The number was a later representation of an already-distributed program.
RSA encryption has almost nothing to do with the DVD exploit
The episode spends considerable time explaining prime-factorization cryptography, then connects that explanation to DVD decryption. These are different technical problems.
RSA uses a public modulus constructed from two secret prime factors, alongside public and private exponents. NIST defines the public key as \((n,e)\) and the private key as \((n,d)\), with \(n=pq\). The two prime factors are important, but they are not, by themselves, the complete private key.
NIST Publications+1
Wendover's example of a bank checking whether 11 and 13 multiply to 143 is not an accurate description of RSA authentication. A party holding the private key demonstrates its possession through cryptographic operations; a bank does not authenticate a customer by checking whether two secret factors multiply to a number sent by that customer's computer.
More importantly, DVD encryption did not depend on factoring an RSA modulus. The court record describes CSS as a separate encryption system using an algorithm and player keys. Johansen obtained those keys and the necessary technical information by reverse-engineering licensed DVD-player software.
Justia Law+1
The prime-number demonstration is therefore a distraction from the actual technical breakthrough. Carmody's number represented a program that attacked CSS; it was not an RSA key, a secret prime factor, or a mathematical solution to DVD encryption.
Access control and copy protection are not interchangeable
Wendover says CSS was designed to stop people downloading or duplicating films. The legal record is more precise: the Second Circuit distinguished between Section 1201(a)(2), which targets tools that bypass access controls, and Section 1201(b)(1), which targets tools that defeat technological protection of copyright owners' rights. The Corley litigation concerned the former.
Justia Law+1
The court also acknowledged an unresolved technical issue: the evidence did not clearly establish whether CSS itself prevented copying an encrypted DVD to a computer's hard drive or whether other restrictions imposed through DVD-player licensing did that job. DeCSS decrypted the content and bypassed whatever additional copying barriers existed. Describing the entire protection system as one lock that a single number destroyed is an oversimplification of the court's actual findings.
Justia Law
The law does not criminalize a number sitting in your pocket
Wendover's assertion that "just the possession of this number is enough to get you arrested in the US" is the episode's most consequential error.
Section 1201 prohibits actually circumventing technological protection and manufacturing, importing, offering, providing or trafficking in circumvention technology. Mere possession is not listed as an offence. Section 1204 provides criminal penalties for willful violations undertaken for commercial advantage or private financial gain.
U.S. Copyright Office+1
That does not mean publishing the number is necessarily legally protected. If an encoded number can be decoded into circumvention software, its distribution could attract an argument that it constitutes trafficking in that software. But that is a different legal question from privately possessing the number.
In fact, legal scholar Andrés Guadamuz examined this precise problem in a 2002 Journal of Information, Law and Technology article. He identified the application of the DMCA to prime numbers, images and poems representing DeCSS as an unresolved question, noting that the publishers of those alternative representations had not yet been taken to court.
ERA+1
The actual federal case was Universal City Studios v. Corley, a civil lawsuit brought by eight film studios against Eric Corley and 2600 Enterprises. The Second Circuit upheld an injunction against posting DeCSS and knowingly linking to websites distributing it; it did not establish a criminal offence of possessing the number. Crucially, the court recognized that computer code conveying information qualifies as First Amendment speech, while holding that its functional ability to circumvent copyright protection could justify restrictions on its distribution.
Justia Law+2
There was another American case, DVD Copy Control Association v. Bunner, but it involved California trade-secret law rather than the DMCA. In 2003, the California Supreme Court held that the First Amendment did not categorically prevent an injunction if the underlying trade-secret findings were valid; on remand, the Court of Appeal reversed the injunction in 2004 because the DVD association had failed to establish that the information remained secret when Bunner published it. The court expressly limited its conclusion to the available record rather than making a final determination of the underlying trade-secret claim.
California Supreme Court Resources+1
These distinctions matter. There was a genuine legal battle over distributing decryption software, but the episode turns that dispute into an unsupported warning about possessing a number.
Even the mathematics deserves a correction
The video claims that determining whether 43,721 is prime requires 21,861 calculations. That is unnecessary: trial division only needs to test prime divisors up to the square root of the number, approximately 209.1. There are just 46 prime candidates to check. The challenge of discovering enormous primes is real, but this example exaggerates the work required to test an ordinary number.
Linux Journal
The Electronic Frontier Foundation's $250,000 figure is also real, but its context matters. Its Cooperative Computing Awards encouraged distributed computing; its first $50,000 award went to the discoverer of a two-million-digit prime found using tens of thousands of computers. The programme was not a general market for purchasing cryptographic keys.
w2.eff.org
The linking restriction in Corley was also narrower than a general ban on hyperlinks. The court required knowledge that the destination contained DeCSS, knowledge that it was circumvention technology, and an intention to disseminate that technology through the link. It upheld that specific restriction, not a blanket prohibition on discussing or linking to controversial information.
Justia Law
The verdict
Wendover takes three separate subjects—RSA encryption, DVD decryption and American copyright law—and connects them with a dramatic number. The connection is much weaker than the presentation suggests.
The genuine story is more interesting. A group of programmers sought to make DVD playback possible on Linux, where licensed players were unavailable. Their reverse engineering exposed weaknesses in a proprietary licensing and encryption system. The resulting software became the subject of a serious constitutional dispute over whether executable computer code could be restricted despite its protection as speech.
Phil Carmody subsequently turned an existing descrambling program into a mathematical curiosity. That was an ingenious demonstration of how information can survive restrictions by changing its representation. It was not the discovery that cracked DVD encryption.
An educational video can simplify complicated subjects. It cannot turn an unresolved legal question into an established criminal offence, confuse two different encryption systems, and reverse the chronology of the event it claims to explain.
The number makes a memorable headline. The actual history makes a much better story.
References
1. TWL #7: This Number is Illegal — Wendover Productions, May 3, 2016. The original episode and the claims examined in this critique.
2. 17 U.S. Code, Chapter 12: Copyright Protection and Management Systems — U.S. Copyright Office. Sections 1201 and 1204 distinguish circumvention, trafficking and criminal liability; neither establishes a general offence of possessing a number.
3. Universal City Studios, Inc. v. Corley, 273 F.3d 429 — U.S. Court of Appeals for the Second Circuit, November 28, 2001. The controlling appellate decision explains what the studios actually challenged and why the injunction against DeCSS distribution survived First Amendment scrutiny.
4. Prime Number Encodings of CSS Descramblers — Carnegie Mellon University, David Touretzky's DeCSS Gallery. Documents Carmody's prime encoding and identifies the underlying compressed source code.
5. Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography, NIST SP 800-56B Rev. 2 — National Institute of Standards and Technology, March 2019. Defines the actual RSA public and private key components, exposing the inaccuracies in the episode's banking analogy.
6. DVD Copy Control Association, Inc. v. Bunner — California Court of Appeal, February 27, 2004. Explains why the evidence did not justify continuing the trade-secret injunction against Bunner.
7. DVD Copy Control v. Bunner — Supreme Court of California, August 25, 2003. Establishes that First Amendment protection does not categorically prevent injunctions against publication of misappropriated trade secrets, subject to the necessary factual findings.
8. Trouble with Prime Numbers: DeCSS, DVD and the Protection of Proprietary Encryption Tools — Andrés Guadamuz, Journal of Information, Law and Technology, 2002. Examines the unresolved legal question of distributing DeCSS through prime numbers and other alternative representations.
9. The Prime Internet Eisenstein Search — Bob Bruen, Linux Journal, June 30, 2005. Explains why large-prime discovery requires more sophisticated methods than the elementary division exercise in the video.
10. Big Prime Nets Big Prize — Electronic Frontier Foundation, April 6, 2000. Documents the actual purpose and structure of the Cooperative Computing Awards.