In early February, a few weeks after Black Sunday, Dave's hacker gave him a new card for only $60, advising him to take good care of it. The card worked fine, and a few days later one of Dave's neighbors borrowed it, supposedly for a pay-per-view movie he wanted to watch. Instead, the neighbor -- a former vice president of a major defense contractor -- took the card to an incompetent hacker who ruined it in a bungled attempt to make a copy. Dave was irate, and his skilled hacker in Rosarito was upset with him for lending out the card. The hacker told him to buy a receiver so he could try to program a fresh card.
Dave had heard that the Wal-Mart stores sold an RCA receiver, with card, for $50. When he and some friends went to pick them up they discovered they were not the only pirates looking for new cards in the wake of Black Sunday. From late January through at least part of March the Wal-Mart stores in the county would sell out of the cheap receivers within hours of receiving them, when they were able to get them in at all. At one point even their main warehouse had none in stock. The National City Wal-Mart had posted a sign limiting purchase to two per customer, and a salesperson there said the hot items "go out as fast as PlayStation 2." A clerk at one of the San Diego Wal-Marts explained the reason for the shortage: "Half the people are buying them legitimately, the other half are buying them to get the card so they can get free programming." (Wal-Mart also sells more expensive receivers, such as those made by Sony, but thrifty folk like Dave, who wanted only the card and not the box or the dish, were clamoring for the RCA product.)
Some retail outlets -- like Best Buy, Tweeter, and Circuit City -- will not sell the DirecTV hardware unless the buyer also signs up for the service, for which the stores receive a percentage. They require that a customer also use a credit card. Dave sent a friend to a Tweeter store in the South Bay to purchase two boxes (one for his neighbor), but the salesman declined to sell without activation and pointedly asked if the products were going to be taken to Mexico. A week later a manager at the same store told me that "anyone buying the receiving box without activation is just looking to pirate the signal. There's no legitimate purpose to it. And a store that sells the system without requiring activation knows what's going on. If they continue to do that the problem will never end." He said his stores wanted to retain good relations with DirecTV.
A Wal-Mart spokeswoman said from company headquarters in Arkansas that they saw no problem in selling the stand-alone system and that their store left it up to their customers to enroll. She also pointed out that the new boxes had a different card, not the old ones that could be altered by criminals. DirecTV likewise had no problem with Wal-Mart selling the hardware without activation; they said they assumed the buyers would call them to enroll in the service.
The "old cards" that the Wal-Mart spokeswoman referred to were, when they first appeared around 1997, produced in a Tijuana maquiladora, or border factory, according to a Tijuana businessman who also enjoys the illicit U.S. signal. Massive in-house theft of the valuable cards prompted a relocation, and the new generation of access cards are now produced in Israel. Most of the hacked cards, he believes, are smuggled in from Canada.
People knowledgeable about the business say that the cards that were burned on Black Sunday are what DirecTV calls H cards. These were on the market for a few years in the late '90s, but a flaw that made them easy to hack forced the company to replace them with HU cards, which are supposed to be impervious to hacking.
Elias Levy is the chief technology officer for SecurityFocus.com, a San Mateo company providing electronic-intelligence services. He follows the battles between the corporations and the hackers. "What I found so interesting is that the media went on and on about what a great job DirecTV did stopping the hackers and taking down all those cards. But they all quickly lost interest in the story and forgot to check after the fact. I think it's really just as interesting how the hackers got around the DirecTV measures and are now back in business. It's an endless war: DirecTV comes up with something and then the hackers come up with something else."
Levy points out that even the burned cards can be reprogrammed to some degree and are protected by using an old PC to take any future ECM hits. But more important, he's heard rumors in the hacker underground that the new HU cards, which carry the image of a football player, have finally been hacked.
DirecTV has a sister company in Central and South America called DirecTV Latin America. It uses a different satellite than does the U.S. company; of course, the programming would also be somewhat different. Salvador Galvan owns the Baja dealership for DirecTV Latin America, and he says that the pirating of the American signal south of the border hurts his business. And he doesn't know why the U.S. company doesn't use the system employed in Mexico to foil hackers. Each prospective subscriber is carefully checked out, and the system is leased to them, never sold.
Two years ago, Galvin says, at the urging of the Baja satellite and cable companies, the Mexican attorney general's office, working with local police, raided a number of bars that were offering premium televised sporting events, mostly by pirating the U.S. company's signal. "We told them they had to pay for the rights and that they had to have Mexican equipment. More than 95 percent of them did it, after some people were arrested and some places were fined." As for those who continue to resist, "For the bars to get people to come they have to advertise. And as soon as they advertise, we go [to visit them]. The paper is my best salesman."