DRM: What did you buy? (An Essay.)

[pdurrant]

Originally Posted by rkomar

My understanding is that they managed to extract keys from crappily written player software. Blue-Ray AACS can revoke keys from future media, so I guess you would need constant updating of the stolen keys. That's a lot more work than for decrypting DVDs and current e-books. I can't see Joe Schmoe going to that kind of trouble with his legally purchased books. I _can_ see him going to the darknet, though, which is a different problem than what we're discussing in this thread.

Actually, the master HDCP key leaked in September, meaning that it's now possible to decrypt encrypted HDMI data. This isn't the same as breaking the Blue-Ray encryption, but the effect is similar: the high-resolution digital data can now be decrypted and copied.

[Harmon]

Originally Posted by rkomar

Everyone who is okay with DRM because they can strip it off at the moment, think about what it will mean for you when you can no longer do so.

Yeah, at a minimum you have to spend your time constantly "upgrading" your stripping script. It's like dealing with computer viruses, which is why the term "DRM infected" is a good one.

I strip DRM to move my Kindle books to my Sony, and vice-versa. Personally, for portable reading, I prefer the Sony 300 to the Kindle or any of the others I've seen, including the Kobo, the Nook, the iPad, the iPhone and a few others. (I wish I preferred my Sony 350 to all the others, but I don't have one.) The EBR I like best is my DX, which unfortunately is only portable in the sense that I have to carry it around in a bag if I want to have it with me. So for home and air travel, it's the DX, but otherwise I use the 300.

So long as specific EBRs are locked into (or out of) specific stores, I hope to be able to continue stripping the DRM. At some point, I might not be able to keep up. By then, maybe the publishers will be less paranoid about pirating.

[gmw]

Originally Posted by rkomar

Sooner or later, the bozos in the DRM business will figure out how to do it right (i.e. make it practically unbreakable by the average Joe).

Earlier I have noted a couple of things in passing: Review your Windows licences and think about what would happening if publishers were owned by someone like Microsoft or Google; and I questioned what people thought of the agreement they made to access these forums. These two lines of thought come together in online applications.

One of the reasons why forums like this are able to enforce their rules is the fact that they have an useful stick. Cause them too much trouble and your account is closed - simple.

Now take a look at the software industry. They are all thoroughly loving all these new "connected" devices like the Kindle, the iPhone etc, because for most people that means getting locked into a particular service. If Microsoft can migrate people to online versions of Word etc then copyright enforcement is so much easier for them: because, by providing software as a service, they have the stick of being able to withdraw that service. For years I've been encouraging clients to use Terminal Servers for much the same reasons, security is so much easier to manage and enforce.

Where I could imagine ebooks going is the ability to only be able to read it using online applications. For relatively open readers like the Sony this wouldn't stop clever people from creating software to capture a book as you scrolled through (although the result could be much like a photocopy of a paper book in terms of quality), but it would quite likely could put a stop to the more casual strip-n-copy spoken of here. I can see movies eventually going much the same way.

[rkomar]

Originally Posted by pdurrant

Actually, the master HDCP key leaked in September, meaning that it's now possible to decrypt encrypted HDMI data. This isn't the same as breaking the Blue-Ray encryption, but the effect is similar: the high-resolution digital data can now be decrypted and copied.

I vaguely remember this now (the key was stolen from Intel, wasn't it?). Okay, point taken; DRM is very hard to make practically difficult to break even for people who just want to back their stuff up and/or format shift. I still won't buy DRM'ed books, but I have more hope that it will eventually be seen to be more trouble than it's worth by the industry.

[Philippe Lemay]

I understand the need for, and the wisdom behind, DRM. I get it that the artists need to protect their money-makers in this scary new world of complete interconnectivity.

What pisses me off is when the companies like Apple and their iTunes store place obnoxious limitations on their digital products that ensure your purchase will never last longer that 4 - 6 years. With iTunes you get an actual file representing the song/episode/film that you've purchased. You can store it, move it around, hell you can even make copies. But only 5, after that the file locks up and it becomes impossible to move or copy.

Your typical storage medium will last 2 years. Not just because newer and better mediums will come to the fore, there is an actual demagnetization process that will eventually corrupt the data. Some claim their drives can last up to 5 years, but realistically you can start to expect some corruption after 2. In addition some people, like myself, like to store their files on more than one device at a time. If my experiences have taught me anything it's that computers like to fail without warning. So that gives you four years with the files sitting on 2 drives each, plus on extra.

And that extra one will be used up if... say, you want to loan the book/song/movie to a friend. A copy is a copy, under DRM.

"Hey Bill! I heard you got the latest book in the Dungeon Master saga, can I borrow it?"

"Sure! Here you go, just give it back when you're done."

That's how it used to work with paper books, now things aren't so simple.

"Hey Bill! Can I borrow that new Dungeon Master book you got?"

"Sure! I... DAMNIT. I used up all the copies making backups. Sorry man."

"Well why don't you just pass me the drive you have it on right now, it's external right?"

"My primary 1000 GB drive? Upon which I keep everything? Including a sizable pornography collection? Uh...sure, what's the worst that could happen."

It's all just become so damn complicated. People would MUCH rather download that stuff for free and not have to deal with hidden programing within the files that will come back to bite you in the ass 4 years down the road.

[Shaggy]

Originally Posted by rkomar

Sooner or later, the bozos in the DRM business will figure out how to do it right (i.e. make it practically unbreakable by the average Joe).

Won't happen. Not just because they're bozos, but also because it's technically impossible.

They more or less have done so for Blue-Ray video

Not sure why you think this. Stripping DRM from Blu-rays is already trivial, even for an average Joe.

and there's no reason to think that they can't do it for e-books eventually.

There certainly is if you know anything about how it works.

Everyone who is okay with DRM because they can strip it off at the moment, think about what it will mean for you when you can no longer do so.

That will never happen.

[Xenophon]

I'd like to respond to these posts (note that I've left out a whole bunch of others...). Please remember that I am not a lawyer; what I write below is based on my layman's understanding of my possibly-flawed class notes from a graduate seminar on IP issues for Computer Scientists. If you need legal advice on which you can place reliance, please consult an IP lawyer. And remember that a good one will be expen$ive.

Originally Posted by gmw

Most of the rest of your post(s) I have provided my opinion of in one way or another already ... but the DMCA stuff: I think you are reading way more into that act (as relates to your benefit) than actually exists at this time.
[SNIP]

I have written advice of counsel from an eminent IP lawyer on this very subject. According to her presentation in the afore-mentioned graduate seminar, wallcraft is quite right that

Originally Posted by wallcraft

They had a choice about how to define fair use protections. For example, the act could have explicitly said that stripping DRM for personal use was ok. Actually, it does say that all fair use provisions still apply but this is contradicted by its practical provisions. The Librarian of Congress has the option, every three years, to make explicit fair use exceptions to the anti-circumvention provisions (e.g. for format shifting), but has never some close to doing so.

The (supposedly controlling) preamble to the DMCA explicitly states that nothing in the act should be construed to denigrate any fair-use rights, regardless of whether those rights have been articulated by a court or not. The practical provisions of the act appear to contradict that statement. No court has yet ruled on anything that would resolve this contradiction.

In Professor purple baboon's post (quoted below), I'd like to examine the two parts I've emphasized:

Originally Posted by Harmon

(That's Professor Purple BABOON, thank you very much!)

You have to think of the DMCA as a kind of shell enclosing the copyright act. It does not change the copyright act. Rather, it is an attempt to deal with copyright as it already exists in an electronic environment, based on the premise (illusionary or otherwise) that DRM can be used to accomplish that objective.

The key to understanding the DCMA is not thinking of it in terms of DRM, though. It's thinking of it in terms of the tools which can strip DRM. Those tools effectively eliminate DRM if they are allowed to be widely distributed. That's why when you dig into the DCMA, it turns out that it is very concerned with the distribution of those tools.

For instance, it is perfectly legal for me to strip DRM from my lawfully acquired ebook, but it is not legal for you to sell me the tools to do the stripping. It is also not legal for me to pay you to strip the DRM for me. It might not be legal for you to simply give me the tools to do the stripping - I kind of think it actually is legal but I'm not entirely confident of that conclusion. [My emphasis added]

(There is actually a close analogy to the DMCA in US history, namely, the Volsted Act - aka "Prohibition." Most people think that you couldn't drink liquor during prohibition. However, under Prohibition, it was legal for someone to make and consume his own booze. BUT: it was not legal to transport it. So you could make your bathtub gin in your house, and sit on the porch in full view of the cops and get snockered. You could invite your neighbor to join you. Heck, you could invite the cop. Nothing illegal about it, so long as you didn't sell it to your neighbor. (Of course, the cop drank free anyway.) But if you took ("transported") your glass of gin over to your neighbor's house, the cop could arrest you. If you charged your neighbor for his drink at your house, the cop could arrest you. Same thing with DRM - strip it all you want "in your own house," i.e. on your own ebook. Hand over your off-brand EBR to your friend and let him read the stripped file. No problem. But don't sell the file. Don't upload it to the internet so anyone can download a copy.) [My emphasis]

The ultimate point of the DMCA is not that it changes fair use or anything else under copyright law. The problem is to preserve the rights of the copyright holder through the use of DRM, while also preserving the rights of the public. The mechanism to accomplish this is to make it illegal to strip DRM in those instances in which the stripped file is used in a fashion that violates the copyright holder's rights. But that mechanism introduces all kinds of practical problems in those situations where the public has to strip DRM in order to exercise fair use rights which already exist under the copyright law.

And that's where the Librarian comes in - basically, Congress has handed off to the Librarian the authority to write regulations dealing with those practical problems. [My emphasis again]

But you are correct in observing that if you are the baboon on the street, the DMCA has the practical effect of thwarting your fair use rights, even though as a matter of law, it does not. And what's worse is that copyright holders are aggressively using the practicalities to thwart the fair use right that, nominally, the public still has. Essentially, copyright holders (in the form of corporations like Disney) want, as a practical matter, to own ALL the rights to the product forever, even though copyright law is just a limited grant of those rights for a specific period.

It is important to note that the regulations written by the Librarian of Congress neither address illegality, nor do they establish the limits of behavior that is protected as being fair use. Rather, they establish "safe harbor" for a subset of activities that are protected as fair use. The problem is that the fair use doctrine isn't a set of rules or laws; rather it is a defense against accusations of copyright violation that has been developed over many years by the Courts in an attempt to balance the rights of copyright holders against the rights of the public. Thus, fair use arguments proceed by reasoning from the extensive — but by no means comprehensive — case law.

The written advice-of-counsel that I paid for* on the subject of DRM removal tells me that (in the opinion of one eminent IP lawyer):

• Removing DRM from legally acquired content for personal use only is a legal exercise of my fair use rights;
• Distributing content for which I lack distribution rights is clearly a violation of relevant copyright laws (whether I've removed the DRM or not);
• Providing DRM-removing code to other people within US jurisdiction is almost certainly a felony under the DMCA;
• Telling others where to get such DRM-removing programs may or may not be a felony (depending on whether or not a Court decides that it falls under "providing");
• Explaining how to use DRM-removing programs that another person has somehow acquired on their own is almost certainly not a felony under the DMCA;
• Possession of DRM-removing programs is not in itself a violation of the DMCA (although distributing them or providing them to others probably is).

This advice-of-counsel has very little legal impact. Assuming, for the moment, that I were to find myself in court over DRM-removal, it might serve to establish that I sought out an expert opinion to guide me on how to stay within the bounds of the law, and so might (might!) establish lack of felonious intent. Beyond that, it's worth the paper it's printed on.

Xenophon

*She offered written legal advice on this specific topic to all attendees of her presentation at the high price of $0.25. Apparently there's some special point about having paid for the advice — I failed to note the reasoning behind that particular point.

[Harmon]

Originally Posted by gmw

Where I could imagine ebooks going is the ability to only be able to read it using online applications. For relatively open readers like the Sony this wouldn't stop clever people from creating software to capture a book as you scrolled through (although the result could be much like a photocopy of a paper book in terms of quality), but it would quite likely could put a stop to the more casual strip-n-copy spoken of here. I can see movies eventually going much the same way.

In other words, a "streamed" ebook? Sort of like Netflix?

[Harmon]

[QUOTE=Xenophon;1246775]I'd like to respond to these posts (note that I've left out a whole bunch of others...). Please remember that I am not a lawyer; what I write below is based on my layman's understanding of my possibly-flawed class notes from a graduate seminar on IP issues for Computer Scientists.QUOTE]

Well, if I really WERE a professor, I'd give you an A for that little essay. It's clear to me that you have properly grasped the subject matter.

The only place where your paid-for advice differs from my opinion lies in the question of the distribution of the tools. The reason for that difference of opinion lies in an area that I haven't explored deeply, and your IP lawyer probably has. That area concerns First Amendment protection of speech, and the question is whether computer code (or scripts using that code) amounts to "speech" within the meaning of the Amendment.

IF that is "speech," then the only way to get past the Amendment is to connect the publication of the code or script with actual or implied knowledge that the publication will be used for unlawful purposes. So if I write a script to remove DRM, and put it on the internet for free, and do my best to inform people that the script can only be legally used to strip DRM from personally owned files, I can probably escape the penalties contained in the DMCA. On the criminal side, I believe that the prosecution would have to establish that I actually knew or should have known that a specific person would use my code or script to illegally strip DRM. On the civil side, I think that whomever was suing me would have to have a specific situation in which my code was used illegally, and that I didn't do anything to let users know that such use would be illegal.

Because if the code or script is "speech," and there is a lawful use for it, I can't be held liable for any unlawful use - which is, I believe, the basic principle in the Betamax case.

BTW, I suspect that the reason the lawyer wanted your quarter is so that she could not be interrogated by the authorities or in a civil lawsuit about the advice she was giving, since it would be protected by the attorney-client priviledge. Therefore, each reader of this post owes me a quarter for the advice contained herein. Next time you are in a McDonalds, drop it in the Ronald McDonald House spare change box. (You eat at McDonalds now & then. You KNOW you do...)

[DiapDealer]

Therefore, each reader of this post owes me a quarter for the advice contained herein. Next time you are in a McDonalds, drop it in the Ronald McDonald House spare change box. (You eat at McDonalds now & then. You KNOW you do...)

If I throw in a buck, can I consider you on retainer for the next three posts?

[gmw]

Originally Posted by Xenophon

... This advice-of-counsel has very little legal impact. Assuming, for the moment, that I were to find myself in court over DRM-removal, it might serve to establish that I sought out an expert opinion to guide me on how to stay within the bounds of the law, and so might (might!) establish lack of felonious intent. Beyond that, it's worth the paper it's printed on.

Thank you very much, Xenophon, for sharing the value of your $0.25. Even if the advice has little legal impact, it must be a comfort to know you have the seal of approval from the Purple Baboon.

[gmw]

Originally Posted by Harmon

In other words, a "streamed" ebook? Sort of like Netflix?

I am not familiar with the details of netflix ... but I seriously doubt if real streaming is required for ebooks. Since the online application that displays the text of your book is a signed component loaded from the site, its ability to tightly manage the access to the book should be quite flexible and secure. If the ebook is never fully downloaded onto your device then strip-n-copy is not a straightforward process. It may be possible to capture the book in much the same way existing software captures streamed movies, but the use of online applications may make that difficult ... and the fact of purchasing a service rather than a product may alter the legal framework too.

It may require some redefinition of what they are selling you - but since people apparently never read the agreements the don't think they are making, they should be able to make such changes without disturbing each anyone overly much. For example I can imagine some new service coming out and bragging about offering cheap access to books, and if you read the fine print access is indeed all you are buying. Since you are no longer buying a book as such, simply paying for a service that gives you access to a book, then exemptions in the law for such things as backups and so on no longer apply. And since many of these applications are innately portable you cannot claim the need for a file copy between devicies, you simply access the book from whatever device you have - as long as it can get online (and if your device cannot get online, well it cannot access the service that the service is what you have paid for, not the book). The fact that you are in fact purchasing a service has other implications regarding your fair use rights etc too.

This is all just musing at the moment, but I express it here to try and warn people so confident that effective DRM is impossible. The current approach may not be working, but by looking around at the way technology has been heading - and people's ready up-take of all these amazing connected devices - it seems quite feasible that books could go this way too.

Disturbing thought: If reading books becomes a service, what does that do to the author's royalties, which are currently based on product sales?

[rkomar]

Originally Posted by Harmon

Therefore, each reader of this post owes me a quarter for the advice contained herein. Next time you are in a McDonalds, drop it in the Ronald McDonald House spare change box. (You eat at McDonalds now & then. You KNOW you do...)

Damn you, Harmon! Stop following me!

[rogue_librarian]

Originally Posted by gmw

Since the online application that displays the text of your book is a signed component loaded from the site, its ability to tightly manage the access to the book should be quite flexible and secure.

Not if it's running on my device, that I have local access to. Encryption is only feasible if you want to keep something secret. You can't show it to somebody and hide it from them simultaneously. Sure, you can make it more difficult for a number of people for some time, but ultimately it's not going to work for a sufficiently motivated adversary. As we've seen time and again, might I add.

If the ebook is never fully downloaded onto your device

This also means I'm probably not interested, but that might just be me. I like to take my ereader places that have no net access.

Disturbing thought: If reading books becomes a service, what does that do to the author's royalties, which are currently based on product sales?

Pretty much the same as musicians and other performing artists; they get a cut out of CD sales, but are remunerated for radio broadcasts, public performances etc as well. I don't see an unsurmountable problem here.

[gmw]

Originally Posted by rogue_librarian

Not if it's running on my device, that I have local access to. Encryption is only feasible if you want to keep something secret. You can't show it to somebody and hide it from them simultaneously. Sure, you can make it more difficult for a number of people for some time, but ultimately it's not going to work for a sufficiently motivated adversary. As we've seen time and again, might I add.

I don't want to get into an extended technical discussion on this one but there is something worth noting: With online applications downloaded as they are used it may become a matter of breaking it each time (different keys, perhaps even different algorithms, per session); the major problem with current DRM (from the publishers perspective) is that one person can make the tools for breaking available to all, even those without the skills to have achieved it otherwise. With an online application it is possible to make it a battle that only the most skilled can continue and so their "problem" could be greatly reduced. (I am sure that the "weaknesses" in current DRM would not be seen as much of a problem to sellers if they only worked for those that had the skills to write them.)

Originally Posted by rogue_librarian

This also means I'm probably not interested, but that might just be me. I like to take my ereader places that have no net access.

That is a potential issue, but perhaps less and less of one - I've only had broadband here for two years, but in another two years I may even have choices. ... Actually one choice I had longer than that: satellite. For an ereader application the latency issues there would be minimal.

Originally Posted by rogue_librarian

Pretty much the same as musicians and other performing artists; they get a cut out of CD sales, but are remunerated for radio broadcasts, public performances etc as well. I don't see an unsurmountable problem here.

I don't imagine it would be insurmountable, no. But authors are generally not performance artists, so their options may be a bit more limited.