DMCA, DRM & Piracy

Blue Ray Flaw

by on July 11, 2006

Ars reports on the first of many security holes in next-generation DVD standards:

The folks at c’t magazine have discovered a simple tool for beating the content protection on Blu-ray and HD-DVD formats: the print screen button. By pressing the print screen button once per frame, you can capture an entire movie at full resolution. Of course, you’d want to automate this task, but c’t has shown that it can be done. They’re promising more details in the forthcoming print version of their magazine.

The few machines on which they’ve confirmed the hack have been running Intervideo’s WinDVD, though it’s likely that this hack isn’t specific to WinDVD. C’t also reports that Toshiba now has updates planned to disable the screen capture function while the software is running, and they may also update the AACS key in order to force users to either patch their software or be unable to decode the content.

The industry will stick its thumb in this hole, but if the record of past DRM efforts is any guide, that’s not likely to save the dike.

The Economist on iTunes

by on July 10, 2006 · 2 comments

The Economist discusses the economics of the iTunes-iPod tie in relation to the French interoperability law, which apparently was passed a couple of weeks ago. They make the familiar razors-and-blades analogy that has been discussed here on TLF before. The weird thing is, they never get around the actually making an economic argument about why the tie is economically beneficial:

The law’s opponents reach for different analogies. They compare the iPod not to the Walkman, but to printers, games consoles and razors. Buy an inkjet printer, for example, and you must buy the manufacturer’s cartridges to be sure that it will work properly. (Although French parliamentarians will not come to your rescue, European regulators might.) Indeed, manufacturers make much of their money from the cartridges, not the printer itself, which is often sold cheaply. Economists explain this business model as a clever way for companies to “meter” their customers, charging them according to use. If they could not tie their customers to their cartridges, they would charge more for the printer itself, and the kind of person who now uses his printer rarely would not buy one at all.

Apple’s business model, however, turns this on its head. Apple makes its money from sales of the iPod, not sales of music; the printer, not the cartridge; the razor, not the blade. As Bill Shope, an equity analyst at JPMorgan, puts it, the music store is a “loss leader” that serves only to boost sales of the iPod. It is as if record stores existed only to sell record players.

The article goes on to explain why this arrangement benefits Apple, but it never gets around to explaining why it’s good policy to allow Apple to tie the iPod to iTunes. I understand the argument when you’re selling cheap printers and expensive ink cartridges. That allows manufacturers to capture more of the value of the printer (by charging heavy users more) to cover development costs while simultaneously making the printer more affordable for light users, who otherwise might not be able to afford one at all.

Continue reading →

Here’s another interesting wrinkle in the CleanFlicks decision:

CleanFlicks first obtains an original copy of the movie from its customer or by its own purchase from an authorized retailer. It then makes a digital copy of the entire movie onto the hard drive of a computer, overcoming such technology as a digital content scrambling protection system in the acquired DVD, that is designed to prevent copying. After using software to make the edits, the company downloads from the computer an edited master copy which is then used to create a new recordable DVD-R to be sold to the public, directly or indirectly through a retailer. Thus, the content of the authorized DVD has been changed and the encryption removed. The DVD-R bears the CleanFlicks trademark. CleanFlicks makes direct sales and rentals to consumers online through its web-site requiring the purchaser to buy both the authorized and edited copies. CleanFlicks purchases an authorized copy of each edited copy it rents. CleanFlicks stops selling to any retailer that makes unauthorized copies of an edited movie.

This is an unambiguous violation of the DMCA’s anti-circumvention rules. Yet interestingly, the judge didn’t even mention the issue. I have to assume that means Hollywood didn’t make a DMCA argument in its lawsuit. I wonder why not? Perhaps they were confident they’d win on the other grounds, and didn’t want to inflame social conservatives against the DMCA?

The BBC reports on Microsoft’s new anti-piracy “tool,” Windows Genuine Advantage, which is automatically installed on users’ computers when they download the latest software updates:

The tool is downloaded and installed voluntarily but Microsoft has said it could become mandatory in the future.

Blogs and forums have been hit with comments and queries about the tool.

The tool was downloaded as part of a wave of security updates Microsoft offered to users. If it is not installed Windows XP will periodically remind people to download and run the program.

According to a friend of mine who administers Windows-based computers for a living, this isn’t really true. If you decline to install WGA, Microsoft blocks you from receiving subsequent software updates. Given how often security vulnerabilities are found in Windows, that amounts to a death sentence, as unpatched Windows machines are usually hacked in a matter of days.

It’s also worth noting that this isn’t Microsoft’s first anti-piracy “tool” on Windows XP. When XP was released, it included product activation, which tied your copy of Windows to your hardware and refused to function if the same software was installed on different hardware (or if your hardware configuration changed too much). The problem was that pirates just modified cracked versions of Windows to omit the activation “feature.”

WGA may prove more effective than product activation did precisely because it’s based on controlling access to a service (Windows Update) rather than trying to prevent copying directly. This is how Red Hat makes a lot of its money, for example: give the software away, but charge for regular updates.

On the other hand, there’s a risk that a lot of users will just shrug and stop using Windows Update. Which would be stupid, but many users may not realize the dangers until their computers get hacked. In fact, they may not realize it even after their computers are hacked, as many hacked computers get used for botnets without the user’s knowledge. Discouraging the use of Windows Update may simply make a lot of peoples’ computers more vulnerable.

Update: Matt Cline comments that Windows users do still have access to “critical updates,” they’re just blocked from receiving other updates. So I stand corrected on the botnet issue. On the other hand, I do think characterizing the program as “voluntary” is a bit of a stretch when users will be cut off from non-critical bug fixes and enhancements if they decline to participate in the program.

IPI has a new article up arguing that the DMCA shouldn’t be repealed because it would violate our treaty obligations. This doesn’t strike me as a particularly persuasive argument, given the amount of weight the United States carries in the international arena, and given that the anti-circumvention provisions of WIPO were inserted largely at the urging of the Clinton administration. If American policymakers thought that the DMCA was bad policy, I doubt they’d have too much difficulty getting the relevant provisions of WIPO changed.

I also didn’t think this paragraph was quite right:

The case commonly mentioned regarding the chilling effects on research of the DMCA anticircumvention provisions involved Princeton professor of computer science Edward Felten, who received a threatening letter from the Recording Industry Association of America (RIAA) regarding his proposed publication of results from a test of a new protection mechanism. (He was able to crack it.) Even after the RIAA backed off, Felten took the case to court to try to have the DMCA struck down, but was unsuccessful. His efforts were not “chilled” so much as he was seizing an opportunity to try to get the DMCA struck down in court.

This isn’t how I’ve generally heard the story told. According to news reports at the time, Felten’s goal was a declaratory judgment that publishing their paper would not be a violation of the DMCA. Although I suspect Prof. Felten would have jumped at an opportunity to get the DMCA struck down in court, I don’t think that was his goal in this case. He was simply seeking a ruling that the DMCA wasn’t applicable to his particular situation.

Update: I’ve looked up the original lawsuit. Felten and his colleagues sought “a Declaration from this Court that publication of the paper is lawful.” It then offered two specific arguments. First it argued that the plaintiffs did not violate the DMCA, and second it alleges that to the extent that the DMCA prevents the publication of security research, it’s in violation of the First Amendment.

So Hollaar’s interpretation has more merit than I initially gave him credit for. I’m still not sure I see how this proves that Felten’s speech wasn’t chilled, though. The RIAA did send Felten a letter stating that publishing the paper “could subject you and you research team to actions under the Digital Millennium Copyright Act.” That would certainly have a chilling effect on my speech if I were in Felten’s shoes. The fact that the RIAA “backed off” after their threat succeeded in preventing the publication of the paper at the Information Hiding Workshop hardly proves that Felten had nothing to worry about.

Play it Again, Dan

by on June 21, 2006

Ars reports on a new ad by the Consumer Electronics Association opposing technology mandates on satellite radio. It’s titled “We’ve heard this song before!” and features the following humorous quotes:

“I forsee a marked deterioration in American music…and a host of other injuries to music in its artistic manifestations, by virtue–or rather by vice–of the multiplication of the various music-reproducing machines…” -John Philip Sousa on the Player Piano (1906)

“The public will not buy songs that it can hear almost at will by a brief manipulation of the radio dials.” -Record Label Executive on FM Radio (1925)

“But now we are faced with a new and very troubling assault on our fiscal security, on our very economic life and we are facing it from a thing called the videocassette recorder.” -MPAA on the VCR (1982)

“When the manufacturers hand the public a license to record at home…not only will the songwriter tie a noose around his neck, not only will there be no more records to tape [but] the innocent public will be made an accessory to the destruction of four industries.” -ASCAP on the Cassette Tape (1982)

Seltzer vs. Attaway on DRM

by on June 20, 2006

The Wall Street journal has a debate between Fritz Attaway of the MPAA and law professor Wendy Seltzer about digital rights management. Frankly, I think Attaway needs a remedial course in reading comprehension. In her first post, Seltzer points to several examples of video innovations that are stifled by the DMCA: excerpting video content, playing DVDs on Linux computers, and building a video jukebox. Attaway responds by stating that there is “absolutely no evidence to support” the assertion that the DMCA stifles innovation. Well, what about the three examples that Seltzer just offered? Are those not evidence?

Seltzer tries again, pointing out that DRM will prevent consumers from using their legally purchased content in new ways. In the past, she pointed out, the creators of new devices like VCRs and TiVo’s didn’t have to ask permission before they were allowed to deploy their devices.

Attaway responds with a non-sequitur: “I think we are getting to the philosophical heart of the issue. You want to be able to take for free the intellectual property others invested their time, talent and money to create.” Nothing in Seltzer’s post said anything of the sort. She’s plainly talking about the freedom to make creative uses of a DVD or other media that one has legally purchased. Yet Attaway, bizarrely, seems to believe that if we allow people to play DVDs on their Linux computers, that people will stop buying DVDs.

I think the fundamental disagreement here is one about technology, not philosophy. Attaway believes that the flaws and restrictions imposed by DRM are temporary–kinks that will be worked out as more sophisticated technology is developed. If that were true, Attaway’s argument would have some merit. But the reality is just the opposite: as the media world becomes more complex, the flaws of DRM will only become more glaring. DRM is technological central planning. Centrally planned economies become less efficient as they grow more complex. For precisely the same reasons, centrally planned technologies perform worse as they become more complex.

A couple of weeks ago, Andrew noted that the usual suspects didn’t have a whole lot to say about the Pirate Bay shutdown. I don’t know anything about Swedish law, so I have no idea if their legal claims are plausible. But it seems at least possible that they are, and I I think the implications of that would be interesting.

A few years back most Americans ridiculed France for trying to tell Yahoo, and American company, not to make Nazi memorabilia available to their citizens. We said–correctly, I think–that France doesn’t have any jurisdiction over American web sites hosted in the United States, and that a French court certainly couldn’t override our First Amendment. Although sadly, Yahoo! ultimately buckled under pressure and banned Nazi memorabilia.

I hope the parallel to the Pirate Bay case is obvious. Now, I do think that in some cases we have a right to expect that other countries respect our copyright law. Russia’s AllOfMP3.com, for example, is plainly making their money by flouting American (and other Western nations’) copyright laws.

Continue reading →

I was catching up on some reading last night and I thumbed through the April issue of Macworld. I came across not just one, but two articles plugging Handbrake, a video-conversion utility that allows consumers to transfer a variety of video content–including DVDs–to their iPods for viewing on the road.

The first article makes a passing reference to this article which claims that using Handbrake is fair use, even if creating it was clearly illegal. (I think this is wrong–the DMCA’s anti-circumvention provisions don’t include a fair use exemption) In either event, the articles’ authors certainly don’t seem especially concerned about the prospect of urging their customers to break the law.

Something’s clearly screwed up here. The rule of law works because of widespread public acceptance. When the law is widely despised and ignored–as it was during prohibition, for example–it inevitably fails to accomplish its stated purpose and undermines respect for the rule of law more generally.

Now, it seems to me that one could reasonably go either way here: one could be outraged at MacWorld for blithely encouraging lawlessness. Or one can be outraged that the DMCA makes innocuous activities like watching DVDs on an iPod illegal. Obviously, my sympathies are with the latter viewpoint. But I worry the most about people who are comfortable with the status quo, where the law is routinely flouted and nobody cares. If the law is stupid, it should be changed.

The New York Times reports that European regulators are becoming increasingly concerned about the development of the music-download market:

Government consumer protection agencies in Norway and Sweden want Apple to remove restrictions that prevent customers from playing music they bought through iTunes on devices made by other companies.

And in Britain, one of the largest digital music markets, the British recording industry’s trade association, known as B.P.I., told a Parliamentary committee on Tuesday that iTunes music should be made compatible with other portable music devices. It was the first time the group had taken a public stance on the issue.

Early last year, European Union competition regulators opened an investigation into Apple’s pricing practices at the behest of Britain’s Office of Fair Trading. Users of the British iTunes Web site are charged 99 pence, or $1.82, for most iTunes tracks, while French users are charged 99 euro cents, or $1.25.

“European regulators are clearly concerned that consumers need to get a fair deal when they buy music online,” said Struan Robertson, a British-based technology lawyer at Pinsent Masons. “Since we share very similar competition laws across the E.U., a domino effect could cause changes across the Continent.”

I suspect that these regulators will come up with bad policy proposals; government regulators almost always do. Certainly, mandating that Apple change its format, or share proprietary details of its format with other companies, would be bad policy, opening the door to the politicization of the digital music industry.

But I can’t say I’m shocked at their concern. The DMCA (and in Europe, the EUCD) have had the unintended consequence of giving Apple a monopoly on iTunes-compatible MP3 players. And so it’s not crazy for them to be looking into ways to remedy the problem.

But the right way to deal with the problem is to repeal the law that caused the problem in the first place, not to add another layer of regulations on top. Because those regulations, too, will have unintended consequences. If you repeal the DMCA and the EUCD, makers of competing MP3 players will reverse-engineer FairPlay and add the capability to play iTunes songs. No further government oversight will be required. But if you pass additional regulations, we’ll have to come back in another decade to figure out how to deal with the unintended consequences of those regulations.