[rec.video] Scrambling of Pay TV channels

die@frog.UUCP (Dave Emery) (05/03/88)

	The standard scrambling techniques:

	1.  Sync suppression.  There are several versions of this very
popular scheme including sine wave, pulse, and tri-level systems.  They
all work by reducing the amplitude of the synchronizing pulses used
to keep the horizontal sweep of the set synchronized with the timebase
of the video source so that the sync separator circuits in the TV
cannot reliably distinguish picture from sync and the picture tears.
Usually a reference signal that can be used to reconstruct the correct sync
is transmitted by AM modulating the normally FM sound carrier or as a
subcarrier (in over-the-air systems) on the sound carrier.   

	2.  Jamming tones - a strong AM modulated carrier in the lower
sideband of the TV signal or near the sound carrier destroys intelligability
of picture and sometimes also sound unless a sharp, deep notch filter
between the set and cable is used to remove it.

	3.  Video inversion.  This method is rarely used alone, most
often is combined with sync suppression.  Several of the most popular
modern cable and on-the-air scrambling schemes invert the polarity
of the video (turning black to white and visa versa) randomly under
command of a control bit transmitted in either the vertical blanking
interval or as AM on the sound carrier.

	4.  Digital sound transmission.  This scheme combined with
sync stripping is reputed to be the basis of the Oak Orion scrambling
used to encrypt Canadian satellite TV and various private satellite feeds. 
I have seen it stated that no encryption of the digital sound information
is used (or only a very simple one) , I have not verified this.

	5.  DES encryption of the sound.  This is the method used by the
videocipher II system that encodes most cable satellite feeds.  The
sound is converted into a digital bit stream and encrypted with DES. The
picture is inverted, and all sync is stripped (the sync time and vertical
blanking interval is used to transmit the digital sound and authorization
messages), and the color burst is shifted in level.

	6.  Time serial transmission of the picture as separate luminence
and chrominence components multiplexed in time.  The picture is split into
3 separate components which are transmitted one after the other line by line.
The starting point of each line is delayed by a psuedo-random amount under
control of a DES based key.  Audio is sent digitally encoded with DES.
This scheme, called B-MAC (Burst-Multiplexed Analog Components) is used
to encrypt the Holiday Inn satellite TV feeds and various other satellite
services (EG Australian TV).

	7.  Chopping the video up into little slices and transposing them.
under control of a pseudo random key. This scheme (Videocipher I) is used to
encrypt certain CBS satellite network feeds.  Reconstruction of the transposed
video is accomplished by storing the scrambled video into appropriately
pseudo-randomly chosen places in a digital frame store.  Allegedly the
pseudo-random sequence used is based on DES.  Sound is DES scrambled.

	8.  Conversion of the video into a complex digital bit stream using
sophisticated compression transformations implemented with high powered
specialized signal processors followed by encipherment with DES (or other)
encryption.  This technique is used by many satellite teleconferencing
systems. Sound is also transmitted digitally under DES or via telephone 
lines.

		Breaking scrambling 

	Some of these scrambling schemes are very easy to break (and
mostly used on older cable systems), others can be broken only via
unfortunate weaknesses in the key control and update firmware (such as 
Videocipher II), and some are presumably nearly unbreakable (depend only
on the crypographic strength of DES used in a strong mode).

	As for the legality of descrambling TV signals, the ECPA of 1986
makes it a felony punishable by 5 years in jail and a $250,000 fine to
deliberately intercept a "scrambled or encrypted" signal from an "electronic
communications system" if the information on the signal is "not readily
accessible to the general public".  As of yet no court has interpreted these
words, and nobody has been prosecuted for violating this provision of the
new law.

	Section 705 of the Communications Act of 1934 allows reception
of unscrambled satellite TV but explicitly makes it illegal to intercept
scrambled satellite TV.  I am unaware of many actual prosecutions under these
provisions either.

	And most states (including this one - Mass)  now have cable theft
of services statutes that either explictly or by broad language
forbid unauthorized descrambling of cable TV for the purpose of fraudulently
obtaining premium services.  There have been quite a number of prosecutions
around here of dealers who make and sell illegal cable boxes set up to
descramble pay services.  Users caught with illegal boxes are usually just
made to pay for the services they could have received for the entire period
they had the illegal box and the box confiscated.
 
----
David I. Emery
Charles River Data Systems
983 Concord St.
Framingham, MA 01701
Tel: (617) 626-1102
uucp: ...!decvax!frog!die
-- 
----
David I. Emery
Charles River Data Systems
983 Concord St.
Framingham, MA 01701
Tel: (617) 626-1102
uucp: ...!decvax!frog!die