Cory Doctorow's take on DRM legislation

The venerable EFF old hand Cory Doctorow has written a long and interesting expose of the back-room dealing which goes into DRM governance and legislation. He quotes Otto von Bismarck (not a known supporter of open government): "Laws are like sausages, it is better not to see them being made."
I have yet to see a situation in which legislation and technology mix well. Too often the legislators are either out of their depth in understanding the technical details, or just plain corrupt. Can anyone think of another reason for the following governmental decisions? (my best guess in brackets):

1. Ireland's RFID passport (Incompetence)
2. Germany's Bundestrojaner (Incompetence mixed with Ideology)
3. The US's Digital Millennium Copyright Act (Corruption)

In each of these cases, an atrocious piece of legislation has been passed without real consideration for the technology and costs involved. The negative impact for me personally from the first two are degraded security and privacy. The DMCA impacts me tangentially by giving the content industry free hand to be foolish, and kill their own industry.
Any other guessed causes? Feel free to comment.

Entertainment industry encourages piracy

The DVD Copy Control Association want to render DVD ripping impossible, according to the Register. Allegedly, they are doing this to prevent piracy. However the result is likely be exactly the opposite.



To see why this is the case, consider the efficacy of copy control mechanisms so far. They do not work. Every DRM system requires an encryption scheme and a licence key. Most modern encryption schemes are so advanced that with a sufficient key-length, it is very unlikely to be cracked by brute force. No-one is going to break AES-256 in order to watch Die Hard. They don't need to, because the key must be available in the user's system, and key security is always a weak link. Ironically the DRM for DVDs, CSS, is so weak that both encryption and key-finding attacks work just fine.



The current proposal to strengthen the (badly broken) CSS system is as follows:

"DVD products, alone or in combination with other DVD products, shall
not be designed to descramble scrambled CSS data when the DVD disc
containing such CSS data and associated CSS keys is not physically
present in the DVD player or DVD drive (as applicable), and a DVD
product shall not be designed to make or direct the making of a
persistent copy of CSS data that has been descrambled from such DVD
disc by such DVD product."

In a nutshell, if you don't have the original DVD in the drive, then software won't play. Playing from a file on your hard drive won't be allowed.



Sound robust? Not a bit. Programs like DeCSS remove the CSS crud layer, leaving the file in the clear. There is nothing to stop it playing.



The desired effect may be to make the physical reproduction of discs more difficult, i.e. necessitating CloneDVD or similar. However the serious pirates are already well equipped, they can make 1:1 copies without effort.



So, who is affected by this proposal? The normal consumer who is not aware of DVD decryption tools. S/he will be unable to make backups of DVDs bought via legal channels, and will therefore look for alternatives. My expectation is that this will drive average consumers to seek out non-CSSed physical discs, probably directly per mail-order from Malaysia.



My counter-proposal to the entertainment industry would be to stop considering your customers to be either criminals or suckers, and start to satisfy their needs. Drop all DRM efforts, and concentrate on cultivating the consumers who are willing to pay for content. There are plenty of us about, all we require are reasonable products to buy.

Powered by ScribeFire.

Hex 09 f9 11 02 9d 74 e3 5b d8 41 56 c5 63 56 88 c0

The hexadecimal number in the title is really quite remarkable. It is a widely distributed example of an AACS "processing key". As noted by Ed Felten on Freedom to Tinker,

"Together with a suitable computer program, the key allows the decryption
of video content on most existing HD-DVD and Blu-ray discs".

The AACS Licensing Authority has been desperately trying to eliminate this string from the Internet, by sending out "cease and desist" letters to websites. Their campaign is doomed to failure, because the key is now so widely available that for every desisting site, there are hundreds more who will post it. See the Digg blog for Kevin Rose's explanation of why they're no longer attempting to suppress the publication of "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0".

I don't own a HD-DVD or Blu-Ray player. I own no HD-DVD or Blu-Ray discs. I have no interest in pirating HD movies. I have no need for this key. However I think that it should remain available. DRM has failed as a technology. Using legal antics to prolong the futility of DRM is of no benefit to consumer or copyright holder. The sooner we move on to more sensible models for digital content distribution the better.

Powered by ScribeFire.

Microsoft Vista and AACS - a match made in Hell

Microsoft launched Vista worldwide yesterday. This will undoubtedly be a commercial success, because the desktop operating system market essentially belongs to MS right now. But it may not be a good thing for our computers.

I first heard on episode 73 of Steve Gibson’s great Security Now podcast about the problematic Vista implementation of Advanced Access Content System (AACS), the DRM system used for high-def DVDs. New Zealand researcher Peter Gutmann had written a cost analysis of implementing AACS in Vista, it turns out that this makes the OS far less attractive to users. Peter’s analysis is by necessity qualitative rather than quantitative, but it’s nonetheless a compelling argument to not upgrade to Vista.

Let me be clear - I don’t advocate piracy – content producers should be paid a fair amount for their work. However right now, DRM is killing the goose who laid the golden egg. In a vain attempt to assure revenue streams, Hollywood and music labels are riding roughshod over consumers’ computers. Serious pirates will not be put off by this, only normal users who want to use their paid content on all their devices. See the Doom9 forums here, here and here for new hacks to bypass the protection. A new attack from Alex Ionescu seems to go one better.

My problem with all this is that Microsoft has failed to provide a compelling operating system, but rather prefer to sell us crippleware. The technical specifications were drafted by lawyers with the intention of locking down rather than providing features for the users. The use of tilt bits and promotion of closed source hardware drivers will make our systems more expensive and less reliable.

Microsoft’s response to the controversy has been fairly tepid; see this Windows Vista blog entry. Some of the main criticisms are answered – e.g. suspect video signals will “only” be degraded for premium content, never the user’s own content (it’s incredible that the specs were not clear on this point). However the use of unnecessary CPU cycles; tilt bits and crowding out open source software is just shrugged off, on the assumption that the consumer is ready to accept these inconveniences in order to support high-def DVD playing.

My own personal conclusion is that I won’t be buying any version of Vista. Am I alone?