I work for the Electronic Frontier Foundation, a member-supportedcharitable organization that works to uphold the public interest intechnology law, policy and standards. For nearly four years, I'vespent my time attending DRM standards meetings, consortia, and treatymeetings at the United Nations. In that time, again and again, I'veseen tech giants like HP take suicidal measures to voluntarily crippletheir products to make them more palatable to a few entertainmentcompanies, even though this measure makes them less palatable tovirtually all of your paying customers.Nothing epitomized this more than Carly Florina's inaugural CESaddress in which she promised to put DRM in every HP product. Readingthat in my office in San Francisco (I live in London now), I thought,well, hell, I guess I'm not buying any more HP products. I'm prettysure I'm not the only one.I've had innumerable conversations with engineers, lawyers and execsabout DRM, but it's rare that I get the chance to systematicallyexplain how DRM fails as a technology, as a moral proposition, and asa commercial initiative. I'm grateful that HP has given me that chancetoday. I'm looking forward to your questions after my talk.Now, onto the talk, in which I will try to address the security, moraland commercial aspects of DRM.THREAT MODELSThere is no such thing as "security" in the abstract. You can't bemade "secure." You can only be made "secure" *against a specificattack*. All security discussions must begin with an analysis of athreat and a proceed to address that threat with countermeasures.In discussions of DRM, radically different threat-models are usuallyconflated to sow confusion and to disguise the implausibility of DRM.In the paper at hand (as in many other cases), privacy-protection isconflated with use-restriction. But these have totally differentthreat-models:* PrivacyIn privacy scenarios, there is a sender, a receiver and an attacker.For example, you want to send your credit-card to an online store. Anattacker wants to capture the number. Your security here concernsitself with protecting the integrity and secrecy of a message intransit. It makes no attempt to restrict the disposition of yourcredit-card number after it is received by the store.* Use-restrictionIn DRM use-restriction scenarios, there is only a sender and anattacker, *who is also the intended recipient of the message*. Itransmit a song to you so that you can listen to it, but try to stopyou from copying it. This requires that your terminal obey mycommands, even when you want it to obey *your* commands.Understood this way, use-restriction and privacy are antithetical. Asis often the case in security, increasing the security on one axisweakens the security on another. A terminal that is capable of being
Leave a Comment