DRM (Digital Rights Management; the means to protect copyrighted content from being consumed illegally) is under debate, again. The organisation with the aim to complete standardise the Internet, W3C (World Wide Web Consortium), has a proposal on the table to allow DRM to become standardised. Until mid April, W3C members are allowed to vote. Keep in mind: W3C can only recommend, they can not enforce. Enforcement is done by law.
Music is DRM free
DRM has been favoured as well as attacked for many years. In the history of the Internet, the music industry went for securing their content with DRM, but in the end the publishers, labels and owners lost the battle. Now music is DRM free. Although, unprotected digital music may increase loss of direct revenue by the artist and the entire publishing and distribution chain, indirect revenues may be increased because of that. With a high level view, one can argue why it is not bad to have DRM free music, why it is not bad people copy and download music for free:
- it breaks down the centralised power in the publishing and distribution segment,
- it helps (smaller) artists to spread their music better, but
- maybe the best argument in my view is "let artists earn their money in ways done already for 100s to 1000s of years, namely by performing on stage". Only when technology was invented to record music, new ways of monetisation of music was created, selling a one time performance on some medium to anyone who would be interested in that one time recording; But it also created an unfair world, a world with powers at a few companies, whilst most artists would get a very small percentage of the price the consumer pays for the recorded piece of music; Most of the revenues were taken by the entire publishing, PR and distribution chain. Something that now has changed with platforms like Beatport (specialised electronic dance music), due to the DRM free music IMHO
Should W3C recommend standardised DRM for Video?
To answer the question if W3C shall standardise DRM for video content, is not an easy one and already under debate for quite some time.
Proponents
Proponents argue amongst others:
- DRM is already applied by publishers and distributors like Netflix, using proprietary DRM implementation as well as using their own apps (smart phone, tablets) or use Flash, Silverlight or any other browser (proprietary) plugins;
- If DRM will not be standardised, these companies will continue applying DRM, resulting in many different proprietary solutions;
- Big companies like Netflix, Google, Microsoft and maybe even Apple may jointly create their own proprietary centralised platform with the result they will concentrate the power of publishing and distribution of video content, reducing or even eliminating chances for smaller players in video distribution.
The inventor of the internet and director of W3C, Berners-Lee, states:
"The web has to be universal, to function at all. It has to be capable of holding crazy ideas of the moment, but also the well polished ideas of the century. It must be able to handle any language and culture. It must be able to include information of all types, and media of many genres. Included in that universality is that it must be able to support free stuff and for-pay stuff, as they are all part of this world."
"This means that it is good for the web to be able to include movies, and so for that, it is better for HTML5 to have EME than to not have it."
Note: EME is Encrypted Media Extensions.
On the topic of DRM is against privacy of a user ie how much a publisher gets to learn about the user, Berners-Lee reaction is
If they sell a DVD or Blu-ray disk, they never get to know whether the user watches it. From the user’s point of view they can watch each bit of it as many times as they like without the feeling they are being watched.
If they put it on the web using EME, they will get to record that the user unlocked the movie. The browser though, in the EME system, can limit the amount of access the DRM code has, and can prevent it “phoning home” with more details. (The web page may also monitor and report on the user, but that can be detected and monitored as that code is not part of the “DRM blob”)
If they put it on an app in a closed system like an iPhone, then they get to make whatever DRM they like. They also get to watch exactly how and where the user watches which bits of the movie. If they can persuade the user to allow them other access, such to the user’s calendar, they can completely profile the user, and correlate this with their movie-watching habits.
If they distribute it using an app on an open system like Android or Mac OS X, then they can get the same feedback as on an iPhone app. However as the OS is not a locked-down system, the app may be able to further abuse the user, by possibly exfiltrating further information, and also like, in the Sony Rootkit case, installing spyware on the system.
If they distribute it with their own closed system, like a game console or a set-top box, then the user is protected from spying on their computer. The publisher has complete control of information which is sent back about the user’s play and pause, and so on. The user has no way though to have this as part of their connected web life. There are no links in or out.
So in summary, it is important to support EME as providing a relatively safe online environment in which to watch a movie, as well as the most convenient, and one which makes it a part of the interconnected discourse of humanity.
Opponents
Opponents argue amongst others:
- Users are not protected adequately
- Free software market will have difficulties to implement
- Security researchers are not protected by law
Cory Doctorow of the Electronic Frontier Foundation (EFF), argues, EME:
"the Web needs to be a universal ecosystem that is based on open standards and fully implementable on equal terms by anyone, anywhere, without permission or negotiation." EME undermines the Web's compatibility by allowing sites to demand "specific proprietary third-party software or even special hardware and particular operating systems."
"The Web is moving away from proprietary, DRM-capable plugins. HTML5 was supposed to be better than Flash, and excluding DRM is exactly what would make it better. Flash and Silverlight are finally dying off."
In addition, EME:
"would give corporations the new right to sue people who engaged in legal activity." He is referring to the most recent controversy where the W3C has tried to strike a balance between legitimate security researchers investigating vulnerabilities in digital rights management software, and hackers trying to circumvent content protection.
Defective by Design, a Free Software Foundation, argues:
For years, we have been fighting Web companies and Hollywood conglomerates who want to weave Digital Restrictions Management (DRM) into the technical standards undergirding the Web. Their DRM proposal, known as EME (Encrypted Media Extensions , would make it cheaper and politically easier to impose restrictions on users, opening the floodgates to a new wave of DRM throughout the Web. This puts all Web users at risk; DRM undermines privacy, weakens security, and is incompatible with free software. To truly respect users' rights, DRM's role on the Web needs to be reduced, not expanded.
DRM erodes the foundational social contract of the free Web. It spies on users, sending their media-use habits back to companies. It chills remixing and commentary by preventing otherwise legally-protected reuse of media. It creates lock-in and walled gardens, throwing cold water on interoperability and competition. It makes it more difficult to make media accessible to people with disabilities. By definition, it denies users' control over their computers because it is black box software that is impossible to modify. Even if every company fixed every DRM vulnerability disclosed by every security researcher, these effects would persist.
Even as a half-measure to mitigate only the security risks of DRM in Web standards, we expect the guidance to be ineffective. It encourages non-binding policies which reserve companies' rights to sic their lawyers on security researchers. In fact, these policies may even empower such legal attacks by helping companies cast researchers as irresponsible when researchers are forced to break the policies to adequately protect the public. Security research expert Rich Kulawiec thoroughly laid out the security case against the W3C guidance in a recent post to the W3C's public-security-disclosure list.
DRM's dark history—from the Sony rootkit malware to draconian anti-circumvention laws—make it unrealistic to argue that adding it to Web standards will be good for users. Ratifying EME would roll back privacy, freedom, and accessibility, and set back the interoperability that is necessary for disruptive innovation on the Web.
Berners-Lee (W3C) personal opinion
Berners-Lee (W3C) stated his personal opinion in his recent blog post regarding many of the issue opponents bring to the table, summarised below; for the details, please refer to Berners-Lee recent blog post (here).
- Problems for Users
- Fair use of the material is not possible, such as excepting for commentary, educational purposes, and so on
- This prevents remixing into derivative works
- The user cannot take a backup copy
- Having a DRM blob in one’s computer is a security threat, in that it could attack the machine
- Problems for Developers
- DRM prevents independent developers from building different playback systems that interact with the video stream, for example, to add accessibility features, such as speeding up or slowing down playback.
- Problems for Posterity
- There is a possibility that we end up in decades time with no usable record of these movies, because either their are still encrypted, or because people didn’t bother taking copies of them at the time because the copies would have been useless to them. One of my favorite suggestions is that anyone copyrighting a movie and distributing it encrypted in any way MUST deposit an unencrypted copy with a set of copyright libraries which would include the British Library, the Library of Congress, and the Internet Archive.
- Problems with Laws in in more particular for security researchers
- There is currently (2017-02) a related effort at W3C to encourage companies to set up ‘bug bounty” programs to the extent that at least they guarantee immunity from prosecution to security researchers who find and report bugs in their systems. While W3C can encourage this, it can only provide guidelines, and cannot change the law. I encourage those who think this is important to help find a common set of best practice guidelines which companies will agree to. A first draft of some guidelines was announced. Please help make them effective and acceptable and get your company to adopt them.
Personal Opinion
I personally find it quite hard to form a solid opinion. I'm biased to make DRM part of the web standards, since it is and seems to be inevitable DRM will stay for a considerable time. When not standardised, the big content companies and publishers will keep on continuing their own propriotary solutions, and may even result in the big players to form a private alliance and solution, blocking new competition from entering the market. Although I do understand the opponents arguments, I think it is also too ideal to think of an Internet with free video content, at least for years to come.
What is Your Opinion?
- Are you proponent or opponent to DRM enabled (video) content?
- Do you think Blockchain technology will make DRM as such, obsolete?
- Do you think (the big) publishers will get an interest in Blockchain based solutions?
- Do you think Blockchain based solutions will create a substantial direct artist-to-consumer market taking out the middleman?
Let Your Voice Be Heard!
---
sources
- https://www.w3.org/blog/2017/02/on-eme-in-html5/
- https://defectivebydesign.org/drm-in-web-standards
- https://arstechnica.com/business/2017/03/drm-in-html5-is-a-victory-for-the-open-web-not-a-defeat/
- https://www.theregister.co.uk/2017/03/22/w3c_drm_web_standard/
---