Digital rights management

	Main Article	Discussion	Related Articles  [?]	Bibliography  [?]	External Links  [?]	Citable Version  [?]
	This editable Main Article is under development and subject to a disclaimer. [edit intro]

Digital rights management (DRM) refers to the laws and technologies which provide intellectual property owners control over the distribution and use of their material by controlling consumers' use of it. The claimed goals are to prevent copying of digital media and to restrict access and content use to what is allowed by copyright law.^[1]

Critics refer to it as "Digital Restrictions Management", and argue that many of the restrictions it enforces go well beyond the rights granted by law.

History[edit]

Copyright law is the earliest form of intellectual property protection. This area of law developed for print media, long before copying machines and digital media, and has not necessarily kept pace with technology.

Legal Background[edit]

The copyright since its formal creation in 1710 by the British Statute of Anne and its inclusion in the U.S. Constitution^[2] has been the main protection scheme for intellectual property rights for creative information goods and services.

Article I, Section 8, Clause 8 of the U.S. Constitution: "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries."

Copyright law grants exclusive legal ownership of information under specific conditions and terms. Through two major revisions of U.S. copyright law in 1909 and 1976,^[3] the range of content and media forms covered by legislation were expanded.

During the pre-digital era, large-scale copying was expensive and usually resulted in degraded content. The development of electronic and digital media transformed the production and distribution of information goods and services. In digital form, the content could be copied perfectly or easily converted to another form or format, and thus lifted the physical constraints of copying. The rise of digital media and networks made sharing and copying not only easier for traditional information "pirates", but also made it easier for individuals. Unlike the "pirates" whose unauthorized copies were for commercial gain, individual copying stems from behavioral norms from traditions of fair use and first-sale rights.

The rise of unlicensed and illegal copying and distribution of intellectual property cast doubts on whether a copyright provided enough protection in the wake of continued digital innovations. Copyright owners responded by developing technological copyright protection mechanisms (CPM) in order to make copying more costly and difficult. For CPM to succeed, legal enforcement was needed to ensure the uniform adoption of technologies and that any attempt to circumvent them would be criminalized. The U.S. 1998 Digital Millennium Copyright Act (DMCA) provided for enforcement of copyright protection mechanisms. The development of schemes that were capable of not only preventing or limiting copying, but also controlling the distribution and uses of digital media eventually became collectively known as digital rights management^[1].

Music: The first to be hit[edit]

Initially, writing and written works were the primary focus of this legislation: technology, or lack of it, protected other art forms, such as film and music, from being easily copied or distributed in a way that required heavy enforcement.

The Conditions[edit]

However, as technology improved exponentially in the past half century, the copying of these art forms became more and more an issue. Eventually, a tipping point was reached, and music was the form of media that was hit head on with the problem of copying becoming so easy, that copyright violation became an unenforceable law. Although there are many theories as to why music was first, several factors are credited:

• Digitized Format: The digital Compact Disc format, first published in 1988 by Philips and Sony, was the primary medium for music storage and sale by the early 1990's. As music was already distributed mainly via this digital medium, it made it easy to make digital copies with minimal effort and a home computer. This is in stark contrast to other media, such as books, which were still widely sold on a physical, non digital medium, and would take more then a computer and quite a bit of effort to fully copy digitally.

• The format of Albums: For decades the common format of music sale has been the Album, a collection of music tracks typically related in some way and produced by the same artist. A album typically has between 10 and 20 tracks on it, and each track is typically 3 to 5 minutes long. Although the album itself is considered extremely important to the format of music, each track is easily enjoyed by most of the general public outside the context of the album as a whole. Therefore, sharing a single track off an album is extremely common, and a single track is small and easy to share. An album's segmentation therefore makes sharing it easier. This is in contrast to a film, where no such segmentation exists; Most people get very little utility out of just part of a film, rather than the film as a whole.

• The consumer base: Although people of all ages enjoy music, most music is marketed (and sold) to adolescents and people in their 20's. As it so happens, these young people are the people most adapt to new technology, and the quickest to adapt it to save them money and time.

• Previously Unenforced Conditions: Some copying of music via tapes was technically illegal before, but rarely enforced. Other copying, such as making a cassette to play in the car, was not; the record companies had argued that all the way to the US Supreme court and lost. As a result, the average consumer did not perceive copying music to be illegal.

• The MP3 format: The MPEG Audio Layer 3 format, released in the early 1990's, is considered one of the leading reasons as to why music was so quickly hit with the copyright problems leading to DRM. As the Cotton Gin is often blamed for the boom in the institution of slavery^[4], so is the miracle of the MP3 format often blamed for blindsiding the music industry. Music and sound formats, such as Microsoft's WAVE format, were available long before the MP3 format. However, the compression of a high quality music track into a media file with an average length of 4 megabytes, allowed for the ease of transmission needed for widespread copying.

• Wide Internet Adoption: The exponential adoption of internet access into the average American household in the early 1990's allowed for a ubiquitous, cheap, and quickly growing medium to transmit data distances that were previously unheard of. Without the internet, music would only be able to be shared as far as you could walk it^[5].

• Limited Record Company Adoption: With previous improved formats, such as cassette tapes and CD's, the music industry has been fast to adapt, develop, and switch to these new forms of media to satisfy the demand. However for digital music this was not the case. Although computers with CD burners and MP3 player sales were skyrocketing in the early 90's, from 1999 (the release of Napster) to 2003 (the opening of the Itunes Store), there was no digital music service offering any of the music produced by the big 4 record companies (Warner, Sony BMG, EMI, Universal). As a result, the lack of service drove people to acquire their music via illegal copying.

• Development of distributed file sharing: Internet-based technologies grew to encompass distributed file sharing, with no central distribution point at which unauthorized distribution could be stopped.

The Reaction[edit]

As a result of these conditions, starting with the release of the Napster sharing service in 1999, the music industry began to react to the growing amount of file sharing that was occurring via various services. The music industry, through the RIAA, decided on three primary avenues of advance to thwart this growing problem:

• Shut down the services: Napster was the first to be sued by the RIAA, and shut down (as a free service) in July 2001^[6]. Subsequent services, such as Kazaa have been sued but have reacted by moving offshore, outside the jurisdiction of the RIAA.

• Offer services to consumers: The record companies began to give licenses to digital distributers, allowing them to sell their music. Under almost every circumstance, some sort of DRM clause was in the contract initially. In recent months however, record companies have begun to bow to demand and allow DRM free services to start.

• Make Examples of Sharers: In order to drive up the perceived "cost" of sharing music illegally, the RIAA began to sue people who were sharing large libraries of music online^[7]. Although most of these cases were settled out of court, the settlements stretched into tens of thousands of dollars and cost much more due to legal fees.

Consumer Backlash to the RIAA[edit]

In purely economic terms, the record companies were executing textbook strategy: Lower the cost of purchasing a track online, raise the cost of sharing or downloading one, and eventually your consumer base will switch to the cheaper option.

However, the RIAA failed to consider the nightmare they could produce by suing their consumers, many of whom were children^[8]. As a result, there was a backlash towards the RIAA and big music in general^[9], and although sales of digital music rose quickly, the PR of the music industry took a heavy hit.

Additionally, the introduction of DRM was not as well received as the industry would have liked. The fact that DRM soiled a product that consumers were used to purchasing without strings drove many away from the services offered by the record companies.

Recovery: The movement away from DRM[edit]

Responding to consumer demand and the practicality of the changing industry, a host of music services have recently begun to sell music that is DRM free. Although the record companies are slow to accept this reality, it is beginning to become an industry trend. ^[10]

Some services to recently offer DRM-Free services are:

• Apple iTunes music store
• Rhapsody
• Amazon ^[11]
• Sky ^[12]

Film: Learning from Music's Mistakes[edit]

Trying to not make the same mistakes as their music counterparts, the film and TV industry is attempting to be faster in the adaptation of digital distribution.

Forms of DRM were introduced in both the DVD and Blu-Ray formats. The DVD format was cracked in the 90's, and weaknesses in Blu-Ray were found within months of release. ^{[13] [14]}

However, the industry as a whole is beginning to accept the idea that fewer and fewer consumers are accessing their content via physical media, and more and more are switching to digital or streaming services.

Rather then fighting the tide of digitization as the music industry did, the film and TV industry is trying to move faster to offer reasonable services to consumers that match the demand:

• In order to have immediate access to shows and movies, most cable services are now offering On-Demand services via digital cable. These services differ from traditional pay-per-view services in that they typically have a much wider selection, and often have a wide selection of free films and TV shows that come with the package.^[15]

• In order to counter services such as DailyMotion and YouTube, distribution networks are beginning to offer TV shows and Movies streaming online with commercials and / or banner advertisements. Such services include
  • ABC.com
  • Hulu ^[16]
  • SouthParkStudios.com ^[17]

DRM Approaches[edit]

Encryption[edit]

Early DRM relied on encryption, using a content encoding system and then limiting access to the decoding technology. All control over future use was lost once the content was decoded, and any protection against illegal copying still relied on copyright law.

CSS[edit]

An example is the DVD Forum's Contents Scrambling System (CSS) which provided a common means of encoding for all movies on DVD. Any firm producing players or software to view the encoded movies was supposed to license the decoding system from the forum. Despite industry claims, this scheme was not designed to prevent copying — a bit-for-bit copy of a DVD would play on any player that the original would.

What it did attempt was to control usage of the DVDs. CSS includes a system of region codes such that, for example, a DVD sold in North America (region 1) will not play on a player sold in Europe (region 2).This allows the movie companies more control over their markets, for example charging higher prices in some regions or holding back DVD release for a region until after the cinema release there. There are other controls as well; for example the fast-forward control is locked out during the opening section of the disk so that a user cannot bypass the advertising or movie previews there.

Not all vendors follow the Forum's rules; there are many "region-free" DVD players on the market; see for example, this site. Also, some players that normally implement region codes can be set to ignore them, either in software or by replacing a chip; there are guides on the net for that as well. In some markets, such as China, nearly all players are region-free. In others, such as Europe, buyers tend to prefer them. One of Britain's largest retailers, Tesco found massive demand for such players and asked the movie industry to drop region codes altogether ^[18]. NASA sent Sony players, modified to be region-free, to the International Space Station [23]; Sony were not entirely happy about this.

There is a later variant called RCE or "regional coding enhancement" [24] intended to block play of new discs on region-free players.

DeCSS[edit]

For playing DVDs on a computer, the CSS scheme is easily bypassed; there are a number of programs which do this. The first one to become widespread was a decoder for Windows known as DeCSS.^[1] There was a great deal of controversy on the net and in the courts over this.

• The Motion Picture Association of America (MPAA) took the position that DeCSS was a "circumvention device" under the US Digital Millennium Copyright Act and sued many people, including web sites who only linked to the code. These suits succeeded and court orders were issued to take down some copies of the code and links. Of course, copies are still readily available from places outside US jurisdiction.
• The DVD Content Control Association (DVD-CCA) argued that breaking CSS involved misuse of trade secrets and sued on those grounds. These suits failed.

There are archives of documents from both cases at Harvard and EFF. Harvard also has a FAQ document covering both legal and technical issues.

One issue was whether the DeCSS code qualifies as protected speech under the First Amendment of the U.S. Constitution. A earlier court ruling in the Bernstein case over export restrictions on cryptography had set a precedent that those protections sometimes apply to code. However, in the MPAA case, the judge ruled that they did not apply to DeCSS. So some code is protected, other code is not. Computer science professor David Touretzky has a Gallery of CSS Descramblers exploring where the border might lie.

CSS analysis[edit]

CSS is obviously a flawed cryptosystem. It is weak in theory — David Wagner testified in one case that he asks his Berkeley students to break it as a homework assignment — and weak in practice since DeCSS (a reasonably short, simple and fast program) defeats it completely. What went wrong?

First, CSS was designed to be weak; it used a stream cipher for the bulk data encryption, and some additional things for key management The system as a whole used only a 40-bit key, to comply with cryptography export laws of the time (mid-90s). For why a short key makes any cipher inherently weak see brute force attack. For discussion of debate about those laws see politics of cryptography. In this case, it may not have been US law that imposed bad cryptography. CSS was designed by Mitsubishi engineers and at the time, Japan also had strict export laws.

Second, CSS was designed and even standardized in secret, without a public review that might have caught various design weaknesses. In some court cases DVD-CCA even claimed its inner workings were trade secrets. This violates Kerckhoffs'_Principle; no cipher should be trusted until it is published and reviewed. See cryptography is difficult for discussion of this common problem.

For a full paper cryptanalysing CSS, see Cryptanalysis of Contents Scrambling System. It indicates that CSS did not even achieve 40-bit security, more like 25; this is so weak it can conveniently be broken on demand.

Later DVD encryption[edit]

Later DVD products such as DVD audio use a block cipher called Cryptomeria or C2. It is a Feistel cipher which uses S-boxes. It has ten rounds, 64-bit blocks, and a 56-bit key.

C2 is used in Content Protection for Recordable Media and Content Protection for Pre-Recorded Media, collectively known as CPRM/CPPM. The cipher itself has been published, but the S-boxes are secret and different for each application.

There has been some published cryptanalysis of the cipher ^{[19] [20]}.

Blu-ray disks[edit]

For the new higher-density Blu-ray disks, Intel designed a new DRM system called High Definition Content Protection; this is administered by Digital Content Protection LLP. It has been broken.

AACS took years to develop, and it has been broken in weeks. The developers spent billions, the hackers spent pennies.

There is no future in which bits will get harder to copy. Instead of spending billions on technologies that attack paying customers, the studios should be confronting that reality and figuring out how to make a living in a world where copying will get easier and easier. They're like blacksmiths meeting to figure out how to protect the horseshoe racket by sabotaging railroads. The railroad is coming. The tracks have been laid right through the studio gates. It's time to get out of the horseshoe business.[25]

Some have argued that DRM is a major reason Blu-ray is not doing as well as expected in the market^[21].

Marking[edit]

This DRM approach entails the encoding of markers into the digital content that can be used for description, identification, protection, monitoring, tracking, and limiting uses of that content. Combining this approach with the technology to read the markers and abide by the markers allows for even greater control over management of digital content than the encryption approach.

It may also provide ways of tracking down copiers. For example, if a "pirate" DVD version of a film appears when the movie has only been legally released in theaters or as video-on-demand over cable, it maybe possible to find markings in the DVD version that show which theater or which cable customer provided the material.

Examples of the marking approach to DRM can be found in downloaded music from content providers such as Apple, Microsoft, RealNetworks, and Sony. A future example is the broadcast flag system which is being proposed for U.S. digital television which would allow cable networks to limit the copying or distribution of their programming.^[1]

Some marking methods hide the markings using techniques from steganography. In other cases, the markings are quite visible; for example photographs on the web often have the photographer's name or the website URL printed across them to discourage copying.

NEC have announced [26] an advanced marking system, to be included in the MPEG 7 standard, that puts a mark on every frame of a video.

Rights Locker[edit]

The "rights locker" approach drastically changes the way in which digital content can be used. Instead of owning copies of the digital media, the consumer owns a set of rights to access the content from a central digital network using a specified range of devices.^[1] Examples of this approach include On-demand TV content and Netflix's watch instantly service where users are allowed temporary local copies while viewing the programming.

Difficulties of DRM[edit]

Digital rights management, or DRM, is based on the idea that we should design computers that consult an internal policy document written by a third party to check if anything the owner might want to do is a permitted task. If you hit control S or control C to save the work or copy the work, your computer would be able to stop you. I think your computer should never say no, it should always obey you.^[22]

Consumer attitudes[edit]

Many people find DRM systems to be a hindrance to the use of the media they have purchased, and some consumers actively boycott companies and products that use DRM. Many consumers express a preference for material that is not 'hindered' with DRM protections. The attitude of companies that use DRM is widely perceived as "the customer is always wrong".

DRM also seems to be doing very little to stop copyright infringement: "today, infringement is more widespread than ever"^[23].

One online joke collection includes "Copy Protection: A clever method of preventing incompetent pirates from stealing software and legitimate customers from using it."[27]

Access and Usage Concerns[edit]

Consumers have many concerns in regards to access and usage of various content due to DRM systems/restrictions. Consumer opinions are to keep the rights of the consumer from the analogue realm to be the same in the digital realm. Some rights that users are concerned about losing are their abilities to create private backup copies, excerpt, transition data from one device to another, record for future use, and editing content for personal use.

More explicitly, consumers worry about the loss of data because of restrictions on transferring from one format to another. This may force consumer into repurchasing digital data in another format, when they can easily have the capability of transitioning the format themselves. Another outside concern consumers ask is how do DRM Systems handle the expiration of copyright terms. Do DRM systems release their restrictions when the copyright term expires?^[24]

In an interesting development, one company removed DRM from their product about a week after releasing it:

Our approach to countering piracy is to incorporate superior value in the legal version, This means it has to be superior in every respect: less troublesome to use and install, with full support, and with access to additional content and services. So, we felt keeping the DRM would mainly hurt our legitimate users. This is completely in line with what we said before the release .... We felt DRM was necessary to prevent the game being pirated and leaked before release. This purpose has been served, so we are pleased to let our users enjoy the full freedom of game usage they deserve.[28]

Privacy Concerns[edit]

The main user concern in regards to privacy is the ability for the DRM systems to record and transmit consumer usage of particular products and digital data. This becomes a double edged sword. Some users enjoy this feature; for instance, recommended music/videos/books appeals to some users when trying to find something new to experience. Other users complain about this claiming they are being targeted more easily by data/media providers. There are also concerns in passing private information over the internet such as credit card information to make purchases. These are difficult concerns to balance for DRM systems.

Consumers recommend the following: DRM Systems should store "no more data than necessary" and store data for "no longer than necessary". These systems should also be complex enough to inform consumers of all data that is shared about them. Consumers should have the opportunity to regulate how much the DRM system can/can't report or share.^[24]

Interoperability Concerns[edit]

Interoperability is a difficult concern to deal with because it tries to balance users being able to use their media on many machines/programs without any problems, but the industry must also worry about how to protect against the distribution to unauthorized users. Some recommendations are to allow for portability and compatibility with multiple devices, an open standard for the various devices, and no platform restrictions for consumers. Consumers should not have to re-purchase media for use on another device.^[24]

Security Concerns[edit]

There is a concern that some DRM systems will require an internet connection and opening up vulnerabilities to the consumers' computers or limit the ability of current software on their computers. This concern falls mostly with "trusted computing" which in order to work, according to consumers, "trusted computing" providers must be a certified provider and must allow the consumer to set the level of security.^[24]

Business Concerns[edit]

Consumers do not like where some of the business concepts are going such as all post purchase control, inability to share across multiple devices used by the consumer, usage tracking, and file expiration. Some other concerns are the advantages bigger companies have over smaller/medium sized companies in regards to DRM licensing costs, the price control of online products versus conventional counterparts, and technology advances that will be held back by embedded players/devices. ^[24]

Legal problems[edit]

There are a number of legal issues around DRM. Similar issues turn up in all jurisdictions, but any of them may play out differently in different legal systems. This makes dealing with them immensely complex, especially in designing a DRM system to be used in many countries.

Fair use[edit]

There is a basic principle of copyright law, called fair use ^[25] in US law. For example, copyright does not prevent quoting a work in a review or analysis, or using it in education. Nor does it prohibit a blind user from using software that will read an e-book aloud for him. Other legal systems have the same principle, but the name and the details vary from country to country. British and Canadian law call it "fair dealing".

The principle is clear, but the border is by no means sharply delineated. Between the black of copyright infringement and the white of perfectly legal fair use, there is a large grey area. This is being narrowed down by various court rulings and sometimes altered by new legislation, but will likely never go away entirely.

That principle greatly complicates the design of DRM systems. Copyright law allows fair use; how can DRM software manage that? What do you do about the grey areas? If you ignore fair use, or just misjudge some grey areas, you will infringe on the users' legal rights; what are the market or legal consequences of that? Some current DRM software blocks legitimate fair use; for example some DRM systems will prevent a blind use from having software read a book aloud and, if it worked as designed, CSS on DVDs would prevent a reviewer from using an excerpt in a review. Beyond that, how can a DRM system adapt to changes in the law?

Fair use arguably includes the right to time shifting, for example using a VCR to record a TV program to watch later. In one case that was fought all the way to the US Supreme Court, the court ruled that recording TV programs for home use did not violate copyright, so Sony could not be held to be contributing to copyright infringement by selling VCRs. A similar issue is space shifting, for example copying music from a record or CD to cassette tape for listening in the car or copying a DVD to videotape to watch in another room. In another case, the court ruled that the Rio, "a portable digital audio device which allows a user to download MP3 audio files from a computer and to listen to them elsewhere.", is also legal fair use. Those decisions appear to mean that it is legal fair use for users to copy music from their CDs, or movies from DVD, onto their hard drives and/or into a portable player.

However, if the DRM allows those applications, how can it prevent the users from sharing the files? If it does not allow such things, can users legally break the DRM to enforce their rights? Will they just avoid DRM-protected products?

See also our article on Fair use.

First sale doctrine[edit]

Another issue is the legal doctrine of first sale, essentially that once a company sells a product they no longer control it.

The doctrine applies when a company sells to a distributor; the contract may restrict what the distributor then does with the product, but copyright law imposes no restrictions.

The law on this is somewhat complex. In the US, it goes back to a 1908 Supreme Court decision that a publisher (Bobbs-Merrill) could not prevent a department store (Macy's) from offering books at a discount, even though they had printed right on the flyleaf a statement that no-one was authorised to sell the book below their set price. Later, the first sale principle was explicitly written into the 1976 revision of the Copyright Act [29]. Since then, there have been rulings both ways. In a 1998 case [30] involving American-made hair care products that in the US were marketed at premium prices through salons but were sold more cheaply in Europe, the Court made a unanimous decision that the manufacturer had no right to prevent a New york discounter from buying the products from a European distributor and selling them cheaply in the US. However, in a more recent case [31] the Court upheld a lower court ruling that a retailer (Costco) violated copyright in importing watches made abroad and selling them without authorisation from the manufacturer (Omega). In yet another case, the court ruled that a Thai student who was importing cheap editions of university textbooks from Thailand to the US and selling them on Ebay was not violating the publisher's copyright [32].

The first sale idea also applies to the consumer. For example, it would be illegal to copy the DVD and give someone else the copy, but once you have bought it you have the right to use it as you please.

Critics of DRM argue that, for example, movie companies simply do not have the right to prevent a user from fast-forwarding past advertising or buying a DVD in the US and playing it in Europe. To the critics, DRM systems that restrict users in such ways are best described as BAD, for Broken As Designed. There is no technical reason for such "features"; a system without them would actually be simpler; therefore there is no reason to imagine that users ought to put up with them. One anti-DRM website is called Defective by Design.

The argument on the other side is basically that the copyright on the content plus the license agreements for the equipment and content give the companies those rights. Some sort of licensing restrictions (or perhaps some other legal mechanism) seem obviously essential — for example, buying a ticket to a concert should not give the right to record it and sell CDs, and movie companies definitely do not want to give anyone who buys a DVD the right to show it in a theater. The movie and record companies believe that various other restrictions are important as well, and that their licenses give them the right to impose those; this notion is quite controversial.

Other issues[edit]

All copyrights expire; they are only created "for limited Times", to quote the US law. Both legal and technical questions come up when copyright on a DRM-protected work expires.

Privacy laws may be an issue if a system with DRM "phones home" to provide usage information to a vendor. What information is provided? How is it used? How is it protected? Is the user informed, or asked for permission? This becomes more complex if the information crosses international boundaries in the process.

Illegal DRM?[edit]

Some DRM may itself violate laws. For example, the "region codes" on DVDs are intended to segment the market, preventing for example a European (region 2) or Australian (region 4) customer from buying cheaper DVDs from US (region 1) vendors. Film companies insist that this is necessary, but nothing in copyright law grants them that sort of control over their market. Critics argue that the whole business of region codes is a conspiracy by a cartel of film companies, violating the competition and price-fixing laws of many countries and the WTO restrictions on Technical Barriers to Trade.

Such arguments appear to carry little weight with governments; no media company has ever been prosecuted for such actions. However, Australia and New Zealand have banned the sale of DVD players unless they are either region-free or come with instructions for disabling region code enforcement. The US government, on the other hand, has passed the DMCA making it illegal to provide a "circumvention device" which bypasses "technological protection measures". That is, in the US it may be illegal to defeat region codes, while in Australia it may be illegal to implement them.

Similar arguments apply to DRM on video games. In at least one case ^[26] the Australian Competition Commission intervened on the side of someone being sued by Sony for "chipping" a game console, arguing that region codes exist not to prevent copying but to make certain games unplayable.

The Sony rootkit[edit]

Then there was Sony's DRM "rootkit", of which the chairman of the US Federal Trade Commission said "Installations of secret software that create security risks are intrusive and unlawful" [33]. This was software on music CDs that secretly, and without asking permission, installed various things on any Windows computer that played the CD, and hid them from the user with "cloaking" techniques that are commonly used by trojan horse programs to hide their activites.

Mark Russinovich discovered it ^[27] while testing a tool designed to find rootkits; the things an attacker leaves behind after breaking into a computer and acquiring root (administrator) privileges. Imagine his surprise when he found one, installed by Sony!

Sony took a great deal of media flak BBC, CNET USA Today over that. There was also a consumer class action suit, settled out of court. Bruce Schneier's analysis is interesting: "While Sony could be prosecuted under U.S. cybercrime law, no one thinks it will be." and "What do you think of your antivirus company, the one that didn't notice Sony's rootkit as it infected half a million computers? ... This is exactly the kind of thing we're paying those companies to detect -- especially because the rootkit was phoning home." ^[28]

Ubisoft DRM rootkit[edit]

In 2012, the DRM system for one edition of the game Assasin's Creed was found to install a backdoor that allowed remote control of the victim PC. [34]

DRM that violates copyright[edit]

Media companies may be quite interested in protecting their own "intellectual property", but in some cases they may not have much respect for other people's.

In 2010, a German firm sued Warner Brothers, accusing them of using pirated anti-piracy technology.

Technical problems[edit]

DRM is attempting a fundamentally difficult task. Security author Bruce Schneier states of DRM: "Trying to make digital files uncopyable is like trying to make water not wet." ^[30]

In particular cases, the costs may be quite high. Another well-known security expert, Peter Gutmann, wrote of Microsoft DRM efforts: "The Vista Content Protection specification could very well constitute the longest suicide note in history"^[31].

Why is this so difficult? Assume you are a totally legal user of the material protected by DRM, and all the security tests for your music, or your software, are successful. To hear the music, it has to be put into a form the speakers will reproduce. At some point between the DRM-protected recording and the speaker, the signal has to be put into a useful form. Once it is in that form, how does the DRM enforcer prevent it from being copied?

One of the great problems with encryption is hiding decrypted content. In order to hide it from user applications, DRM-enabled players decrypt content in kernel mode and check for unsigned drivers. Some DRM developers suggest using a TPM chip to ensure that the operating system is genuine and only signed drivers can be loaded. In such systems DRM drivers can control computer completely and perfectly hide the decryption process.

The problem of protecting material on a DVD or other physical storage device are simple when compared to delivering content across the Internet. Think of pay-per-view television. Even in encrypted form, it has to pass through intermediate distribution points on the Internet; the general distribution problem here is part of inter-domain multicast routing (IDMR). How do the legal users get the decryption key for the program for which they have paid, and only for that program? Can anyone along the path from content user to content buyer intercept that key and use it? If so, will the legitimate user still be able to use it? Alternatively, can the stolen key be distributed?

The ACM run an annual workshop on DRM.

DRM Implementations[edit]

Several music sellers and distributors over the years have tried a number of DRM implementations:

Apple iTunes[edit]

Apple was the first company to capitalize on the digital music market by being the first acquire music selling licenses from the big 4 record companies. Apple's Music Service, iTunes Store, has infamously used DRM since it's inception. Although their DRM is easily cracked^[32], recently iTunes has introduced a new iTunes Plus service which offers DRM-free music, and Apple is toying with the idea of removing DRM from it's services altogether^[33].

Rhapsody[edit]

Rhapsody, the digital music service started by RealNetworks, is one of the most popular online music services with 2.25 million paid subscribers^[34]. Rhapsody offers streaming music and DRM music downloads for a monthly subscription fee^[35]

Napster 2.0[edit]

Napster 2.0 or the Napster Pay Service, is a DRM-enabled (specically Microsoft's Playsforsure-protected) music licensing service offering unlimited licensed MP3's for a monthly fee. As of April 2007, Napster 2.0 is reported to have 830,000 subscribers^[36]. Napster also has a DRM free version of it's music store, which was opened in mid-2008 ^[37]

imeem[edit]

imeem is a streaming music social network. Until recently, imeem only offered music via DRM, but has recently removed DRM from it's services, reflecting an industry trend^[38]

References[edit]