The scientist behind the CPRM copy control caper took a swipe at The Register in a lecture at Stanford University yesterday.

Unfortunately Jeff Lotspiech, manager Content Protection Technology Group at IBM's Almaden, marred an otherwise excellent talk on the subject with a display of selective amnesia.

The billing promised to debunk the CPRM 'myths': "an object lesson for the media naïve researcher."

But how well the debunking stands up to debunking itself, you can judge for yourself.

"A lot of press reports came out and said this evil thing is going to be put on everybody's hard drive," said Jeff. Which might well happen, of course. Informed soundings we've taken suggest that the initial outcry may have won only a temporary reprieve.

Although Lotspiech has been quiet since the CPRM story broke, he hasn't been idle. In fact, he's assembled an entire man, made out of straw.

"The first article that appeared implied that the way this thing worked was an IBM server somewhere [sic], that your hard drive connected to, and this server judged whether or not the file you were going to record on your HD was worthy of being recorded," he said.

Of course the first article that appeared didn't suggest anything of the sort. It's here , as way of reference. The rights management in a CPRM system is in a wrapper around the content. It looks for local keys, not over the Internet, and that's very much the point. We did describe how business users might benefit from implementing a centralized key infrastructure, but that isn't the same thing at all. And that idea was commended to us by ... IBM.

"That got people upset, but of course it was nonsense."

Compounding the felony, Jeff suggests that the intention was never to 'standardize' CPRM. Which, even allowing for some double-jointed semantic gymnastics, doesn't accurately describe the sequence of events last Autumn. The first submission to the ATA T.13 standards group specifically described CPRM as the content mechanism. The um, clue's in the name: "Content Protection for Recordable Media (CPRM) Proposal" After the October T.13 meeting, the proposal was made more generic, but the name remained the same. And T.13 is a standardization committee.

We thought we'd well and truly debunked Lotspiech's point that the proposal was only ever optional. It was, notionally. But the certainty that optional commands would remaining optional in a command spec that only covers a tiny subset of commands, and the lowest common denominator at that, has been rejected by Bruce Schneier, amongst others.

The audience was more concerned with finding out the cryptography worked, rather than apologias. Which Lotspiech explains admirably: it's recommended viewing if you're puzzled about the issue. Or even if you aren't. For CPRM is in its own twisted way, jolly clever.

One attendee at least found Lotspiech's stab for martyrdom "quitely convincing" ... although whether he means it was "quite convincing" or "quietly convincing" we're not sure. But the author, QuantumG, tells us he thinks "zdnet started all this crap about harddrives, slashdot propogated it". Which we suspect is a rapid way of losing your /. link, we guess.

Your correspondent wasn't able to make the talk, catching the video playback instead. Passing our regards to Jeff via proxy, the good man described The Register as "my biggest problem".

Which is the most flattering thing anyone's said about us for ages. And mirrors our concerns about CPRM exactly... ®

Related Links

Almost Full CPRM on ATA coverage