The big DRM mistake

2. DRM destroys Fair Use rights ...

... unless the consumer is willing to break the law. Thanks to the wonderful DMCA (did you catch my sarcasm?), it's illegal for anyone to break the DRM protecting a file, no matter how trivial it might be to do so, in order to exercise the Fair Use rights that are legally granted to American citizens. Rick Boucher, a Representative in Congress who actually "gets it", had this to say about the DMCA and Fair Use in 2002:

"... section 1201 of the DMCA ... created the new crime of circumvention. Section 1201 (a)(1), for example, prohibits unauthorized access to a work by circumventing an effective technological protection measure used by a copyright owner to control access to a copyrighted work. Because the law does not limit its application to circumvention for the purpose of infringing a copyright, all types of traditionally accepted activities may be at risk. Any action of circumvention without the consent of the copyright owner is made criminal."

So even though a Fair Use exemption is granted for "non-profit educational purposes", I can't really exercise that legal right with The Complete New Yorker, since it would require the commission of a felony to do so. Other uses of Fair Use include, and I'm quoting from the United States Copyright Office, "criticism, comment, news reporting, teaching, scholarship, and research". If I can't copy the text, that makes criticism or comment incredibly onerous, does it not? And so on. DRM means that Fair Use for the file protected via DRM is at the whim of the file's creator, which flies in the face of the whole idea of Fair Use. We shouldn't have to beg for our Fair Use rights, since that's the whole point of Fair Use!

3. DRM renders customers' investments worthless

DRM means that my investment in The Complete New Yorker will one day be completely worthless, unless the publishers can ensure that they will continue to support their encrypted, crippled version of DjVu for years into the future. Or, should they go out of business or decide to switch to a new format, that they'll either open the code (riiiiight) or provide some sort of conversion mechanism (suuuuure).

TiVo is a different matter, since it's essentially a closed box (although there are ways to get around that). In this, we need to trust that TiVo will not use a forced upgrade to further decrease functionality that was there when the machine was originally purchased. Seeing that the company has already done this once, by adding support for a type of broadcast flag that limits timeshifting, I don't have high hopes that TiVo will do the right thing. Hello, MythTV.

I feel especially sorry for the people that have spent hundreds or even thousands of dollars at the iTunes Music Store. What happens when Apple downgrades iTunes again, further limiting what users can do with the songs they bought? What happens in five years, when Apple moves on to another format? What happens to your music collection when the iPod is no longer de rigueur, and you want to switch to a new portable player? How are you going to get your encrypted AAC files to play on that new device, with something approaching the same level of quality?

DRM means that you have no control over the files on your computer. You can only do what the company supplying you with the DRM'd files want you to do.

4. DRM can be defeated

It may take some time, but all DRM can be defeated. Or rather, as Chris Anderson, the thinker and writer behind The Long Tail contends, "Any protection technology that is really difficult to crack is probably too cumbersome to be accepted by consumers." And anything that is not that cumbersome can be defeated (although so-called "Trusted Computing" is going to make that process a lot harder ... but I think it will eventually be overcome by those determined to get around it). Cory Doctorow put it best when he explained that the only way that DRM can work is if all of the following conditions are met:

• Every copy of the song circulated, from the recording studio to the record store, had strong DRM on it
• No analog to digital converters were available to anyone, anywhere in world, who might have an interest in breaking the DRM (since you can just avoid the DRM by ... taking the analog output off the player and re-digitizing the song in an open format)
• Peer-to-peer networks ceased to exist
• Search engines ceased to index file-sharing sites
• No "small worlds" file-sharing tools were in circulation

Although Cory is talking about music here, the same principles apply to any kind of file that can be protected with DRM. Even if Trusted Computing and Microsoft's vision of DRM'd Word documents and emails comes to fruition, if it's hot enough to protect, it's hot enough for someone looking at it - and someone does need to eventually look at it, or how can it be used? - to copy it by hand.

Of course, some might argue that it's enough that the average Joe can't break the DRM. If that's true, then why use DRM? What's the goal? If the goal is to prevent all unauthorised copies from being made and circulated, then it isn't enough to put up roadblocks; you must seek to lock down your "content" (as a writer, I hate that word) completely. If the goal is just to frustrate users, then why use DRM at all, since you must realize that un-DRM'd copies of your materials are going to circulate? And even if Joe can't break the DRM, he'll eventually figure out how to use a P2P network, or ask his nerd friend for help, and then you've got another unauthorized copy and an upset and now more knowledgeable former customer. What publisher wants that?

DRM has wormed its way into the imaginations of Hollywood, the RIAA, and publishers, and they in turn have convinced the computer industry (who, it must be admitted, needed little convincing) that DRM must be applied and supported throughout their products. To The New Yorker, I'm sure that DRM made lots of sense. In reality, though, it doesn't. DRM has angered this customer (and many others), eviscerated my Fair Use rights, ultimately rendered the money I spent moot, and it can still be copied anyway! Where does that leave the publisher? It sounds to me like we were both - consumer and publisher - sold a bill of goods. Welcome to the future!

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Scott Granneman is a senior consultant for Bryan Consulting Inc in St Louis. He specialises in internet services and developing Web applications for corporate, educational, and institutional clients.