Feeds

Western Digital's 'crippleware': Some lessons from history

The panic that wasn't

Internet Security Threat Report 2014

Seven years ago, The Register broke what became the biggest DRM story of all time. It described a plot that took place in obscure committee rooms that was quite cunning in its insidiousness. Had it succeeded and been implemented, it would have seen the demise of the open personal computer platform - without anyone realising it. For the first time, many of us became fully aware of the consequences of a locked-down PC.

This wasn't science fiction, but a very real and present danger.

CPRM was a sophisticated, cryptographically-based restriction technology designed for use on removable media, developed at IBM's Alamaden Research Lab. It's the "S" on an SD Card, and 200 million copies of CPRM media have been sold.

However, at the behest of Hollywood interests, moves began to incorporate it into PC Hard Drives, by making CPRM a part of the standard command set for ATA disks. Each hard drive would be individually signed, and total control of the media could be assumed by the rights holder. A CPRM-compliant song or movie file that resided on a CPRM-compatible hard drive could be deleted or locked-down at will: assuming you were given the right to save it in the first place.

This caused an outcry from enterprise users and their software vendors, who quickly realised that CPRM would break existing storage and backup systems. Then, as the implications spread, it became apparent that this provided the Holy Grail copyright holders had been seeking.

CPRM was incredibly hard to break. As a broadcast encryption system it provided a constantly moving target for hackers in the form of a matrix of tens of thousands of device keys; these keys could be revoked and refreshed by the rights holder. A group of manufacturers comprising Intel, IBM, Matsushita (Panasonic), and Toshiba formed a group to license the technology widely.

We published shortly before Christmas 2000, and a fascinating and fairly nerve shredding few days followed. There was no anti-DRM lobby at the time: no P2P bloggers to hound the manufacturers. But understanding this one required learning some obscure technical procedures, and a little about standards committee politics.

CNet followed-up, but the reporter failed to do the necessary homework, so was easily misdirected by PR spin. It looked like our story might die, and it was only when Dawn Chmielewski put the issue on the front page of the San Jose Mercury nine days later that I could breathe easily.

In the ensuing storm, the issue reached the boardrooms of Intel and IBM. The perception of a locked-down media appliance hurts business. What the hell are we doing? directors demanded.

CPRM on ATA was dropped from the spec - but from there we entered even more dangerous territory. The T.13 committee produces a specification that covers only the lowest common denominator set of operations, and two thirds of commands are "vendor-specific". A Western Digital or a Seagate often produces its own.

See any parallels to today? Let's see...

Secure remote control for conventional and virtual desktops

More from The Register

next story
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
Stop the IoT revolution! We need to figure out packet sizes first
Researchers test 802.15.4 and find we know nuh-think! about large scale sensor network ops
Turnbull should spare us all airline-magazine-grade cloud hype
Box-hugger is not a dirty word, Minister. Box-huggers make the cloud WORK
SanDisk vows: We'll have a 16TB SSD WHOPPER by 2016
Flash WORM has a serious use for archived photos and videos
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.