digital rights management

for a list of resources on this topic, see the technology policy bibliography 

By Brian Chi

Digital Rights Management (DRM) is an umbrella term for software that attempts to control the ways in which an end user can use digital media or devices.  DRM is code that is embedded within the media and devices and prevents users from using software in ways that it was not intended to be used.  For example, let us presume that you purchase a digital video disc (hereafter referred to as "DVD") from your local store.  If that DVD has digital rights management copy protection, you will be allowed to watch that video on DVD players with compatible software.  However, you will not be allowed to copy the video onto your computer, view the code that backs the video, or view the files that control the video.  In essence, DRM is the gatekeeper to what you can and cannot do with the digital items that you have purchased or leased. 

            Some of the earliest forms of DRM were used on DVDs as encryption to protect against unlawful copying.  The code was originally called Content Scrambling System, and it was useful for about three years before being finally cracked by a Norwegian by the name of Jon Lech Johansen.  He was prosecuted in Norway by the Økokrim for the crime of hacking, but he was found not guilty because the development of code was not illegal nor an infringement on the provisions of the copyright act.[1]  DRM next moved into the audio industry, where the Recording Industry Association of America started copy protecting Compact Disks (henceforth known as "CDs").  Copy protection has since moved to most forms of digital media, such as the songs you download from Apple's iTunes service or the ebook you wish to purchase for your perusal.  DRM has become extremely prevalent and presents a contentious issue if we wish to move forward with our digital age. 

            One school of thought believes that if DRM continues to remain unregulated, the versatility of the internet could be lost.  The ability to create culture and share that culture with others could be lost, if DRM continues abound.  Much of the ability to edit existing content and upload new content onto the internet could be lost, and the internet may end up becoming little more than a television set, where users can choose what they watch, but they lose the ability edit and create their own culture.  This ability of the people to democratically create and share their culture could be lost if DRM continues to place restrictions on what individual consumers can and can not do with their digital content.  On the other hand, without some sort of protection, recording artists, movie studios, and other organizations that depend on sales of digital content will lose some of the stream of income provided by the lawful sale of copyrighted materials and the high quality digital content may become a thing of the past. 

            Supporters of DRM believe the internet has created new problems and that these problems can be solved by DRM.  In the years preceding the internet, it was difficult for a person to reproduce and infringe upon copyrights.  For example, a book could be bought, lent, and resold, but to copy it would require a great amount of effort; one would have to either type the entire manuscript again or go through page by page photocopying.  The amount of time and effort required to copy a 200+ page book was thought to outweigh the benefits of copyright infringement.  Essentially, economies of scale kept the publishers in business.  However, in the digital age, an ebook without DRM can be bought, copied, and given to someone else in less than five minutes.  The original purchaser keeps his purchase, but now someone else has that content as well.  This person no longer has the need to purchase this book from the publisher, and thus the publisher loses that customer.  This fundamentally changes the amount of books in existence, possibly creating hundreds of copies in a short period of time.  Herein lays the question of the World Wide Web.  How does one protect copyrights?  The answer seems to lie with Digital Rights Management.  Suppose that ebook contained DRM embedded within it that did not allow the purchaser to make a digital copy of the ebook.  Now, when the user purchases the book, the purchaser gets a copy of the ebook, and the publisher has no qualms about whether they will lose customers. 

            Windows Media Rights Manager, a form of DRM installed on over 500 million desktops[2], states that the license granted in a form of digital media allows for the lawful use by the original licensee, but these licenses are not transferable.  This zealousness by Microsoft to protect their digital media is their effort to combat piracy in this digital age.  One argument that the developers of DRM (including Microsoft) put forth is that with analog forms and tangible copies of media, copying would degrade the material so that each copy is less and less like the original.  With digital media, each copy is not degraded, and each is of exactly the same quality as the original.  Windows states that "DRM enables content providers to protect their content and maintain control over distribution.[3]"   Windows also states that DRM also helps give these content providers useful customer information which helps the providers stay closer to their consumers.  The strength of DRM lies in the fact that no decryption key is given in the code written into DRM; one would have to break "industrial strength cryptographic algorithms" for each individual Windows Media File.   Windows also retains the right to revoke service to those clients who run outdated software or whose systems have been compromised.  In addition, Windows allows for single time usage licenses, in effect allowing consumers to purchase the exact amount of usages they need, saving them some money. 

Now we come to the question of why this issue is important.  The Motion Picture Association of America contends that piracy hurts the entire movie industry, which employs 750,000 different people, from the boom handler, to the driver, to the caterer.  The MPAA provides the statistic that 6 out of 10 movies do not recoup the cost of creating the movie.  One of the ways that movies try to recoup this cost is through sales of DVDs.  However, when pirates make illegal copies, the MPAA is losing that stream of income.  If the companies that make up the MPAA can not recoup their costs of production, they will start to spend less money on production, and essentially make lower quality films and thus the public will suffer.  In addition, the MPAA argues that purchasing pirated DVDs supports organized crime and gives specific examples of when organized crime was involved in the sale of bootleg films.[4]  By increasing the scope of DRM, the MPAA hopes that it can decrease the ability of organized crime to use pirated goods as a source of revenue. 

            Many digital content providers suggest that DRM is necessary in order to enable new business models, through the protection of creators' rights.  They contend that if DRM is not placed on music, then it hampers the ability to protect copyright.  If creators cannot protect and market the media then what incentive will they have to create new content that the public wants.  The protection of the content outweighs any uses that are disabled through DRM.  If this digital content does not have the code to prevent unauthorized access and copying, then pirating will abound and artists and moviemakers will lose the revenue they need to continue making their music.  At the very least, DRM will act as a sort of speed bump; it will keep the honest people honest

            In the end, DRM is a form of authentication.  It is simply a way for manufacturers of content to ensure that the right people are using their content in the right ways.  It is similar to an ATM in this sense.  It authenticates that the user is the correct owner of the content, and is able to access the content.  No one cries wolf when the ATM asks you to place your debit card in the machine AND enter your password.  This is the goal of DRM, suggests its' supporters, to ensure that the users who are attempting to use the content have the rights to use that content. 

            The main argument proposed by critics of DRM is that it interferes with the lawful use of digital media.  The Electronic Frontier Foundation (EFF), one of DRM's largest critics, contends that the implementation of DRM prevents lawful users from creating back ups of files such as music and movies or the lawful transmittal to other users.  EFF is concerned that rights are being taken away from owners of digital content.  Owners can no longer edit the content, sample the content, use the content on non-supported devices, or resell the content.  In the times before DRM, indeed, before our digital age exploded, to own a piece of music, one bought it in the form of a CD at the local record store.  As the owner, one of the basic rights was the right to resell it to someone else.  This is no longer possible with DRM technology.  The song you purchase from Apple's iTunes Service for $.99 can only be used by the purchaser.  The original purchaser can not give the song to someone else as a gift, can not resell it for $.79 once they have lost all utils from the song, and one can actually lose the right to simply listen to the song if they use the song in a way that the original copyright holder deems improper. 

            Another argument that opponents of DRM raise is the lack of transparency.  DRM is code hidden within the program.  If regular users can not see what the code does, how can they be sure that this code is not doing things it shouldn't be doing, for example, spying on their habits.  This is exactly what the code did for Sony BMG's Extended Copy Protection DRM programs.  It reported the consumer listening habits, installed a rootkit hidden on the consumer's machine, and set up a connection the Sony BMG servers.  The rootkit opened more security vulnerabilities in the consumer's machines and was designed to be hidden, so that a consumer did not know why all of a sudden their machine was running slower or downloading malicious content.   Another program that Sony BMG included on over 20 million CDs was MediaMax Software.  This program which installed on users' computers even if they clicked "No" on the End User Licensing Agreement, hid itself on the users' machine and did not provide a way to be uninstalled.  It too, transmitted data about the consumer's listening habits, and it too, opened the consumer's computer to attacks from third party sources.  This set of DRM was so damaging that even the United States Government, Microsoft, and other anti-virus companies warned Sony about the problems associated with it.[5]  Critics of DRM contend that other forms of DRM could be doing similar things, spying on consumers, opening holes for malicious attacks, and all without the consumer knowing how to fix the problem.  The problem lies with the ability of the consumer to stop usage, but how can a consumer close these loopholes if the consumer doesn't even know they exist?  In this instance, Sony was forced to settle[6], but this has not deterred others from still attempting to push DRM forward. 

            One of the biggest problems with DRM is the lack of interoperability.  It is possible to purchase music from one source, say Windows Media, and not be able to play that purchased music on Apples iTunes program, or in the car's CD player.  This lack of interoperability creates restrictions that are not easily overcome.  In essence, this forces all digital media with these DRM schemes to be leased out, rather than directly purchased.  A purchase implies that the user has certain unalienable rights to do with his property as he will.  However, with many forms of DRM, it is impossible to even create a tangible copy of the media one "purchases."  It could be the case where after a computer with the originally purchased, DRM enabled, digital media crashes, the user must repurchase the digital media to place on a newly purchased computer.  In addition, the developer of the DRM has the ability to change the terms of a contract unilaterally.  Apple's iTunes platform retains the right to change the number of times a piece of digital media is burned onto a CD, even after the digital media was purchased under a different promise.[7] 

            The way that DRM could potentially lead to a slowdown of the expansion of technology is if it becomes too restrictive in personal computers.  It could stifle creativity and invention if new devices are not able to operate the files that are DRM protected.  It could swing the balance of power away from the ultimate end user, the consumer, and put power into the hands of the computer maker, to determine what ways the digital media is allowed to be created and edited.  In essence, Lawrence Lessig argues that the beginnings of the internet gave great power to the individual; to not only read culture, but to create culture as well.  Individuals had the ability to cut content, edit it, and share it with others.  In essence, it was a predecessor of the youtube service.  However, with increasingly restrictive DRM, one loses the ability to cut and splice digital content and make one's own culture.  That culture could become increasingly rare, as digital content providers increase DRM.  The culture that results is one where culture is thrust upon the individual rather than allowing for free expression. 

            One implication of the use of DRM is that the digital content that makes use of DRM must all become licensed, in effect, destroying the ability to "purchase."  When the word "purchase" is used, it connotes that the content now belongs to a person, and that person is able to do anything he or she wants to do with it; this person can use it as many times as they want, use it in a sense that it was not made for, and alter it in any fashion.  A CD that is purchased (in this sense, we mean truly purchased, suggesting they can do anything with it) can be used to listen to music, can be thrown as a Frisbee, can be used with other CDs to create a tanning shield.  However, when the object in question is now licensed, this suggests that the license can be revoked at any point in time, changing the dynamic of the consumer-creator relationship.  This is the future under restrictive DRM schemes.  Another difference between licensing and purchasing is that it is possible to purchase a tangible form of a piece of digital content (a CD), take it home, and be forced to agree to a license.  If that license is too restrictive for the purchaser's tastes, then the purchaser must now attempt to get a refund.    

Digital media opens a can of worms in that there hasn't been a medium like it in the past.  Currently, there is legislation attempting to deal with piracy and the infringement of copyrights.  The Digital Millennium Copyright Act of 1998 (DMCA) was signed by President Bill Clinton, and provides an attempt to regulate how digital media is protected.  Section 1201 of the DMCA states that entities have the "obligation to provide adequate and effective protection against circumvention of technological measures used by copyright owners to protect their works.[8]"  However, it also divides the "technological measures" into two different categories, those which prevent unauthorized access and those which prevent unauthorized copying.  It does not allow for the making or sale of devices or services, however, the act of circumvention is allowed in the case of copying.  This was done to protect the public's ability to create fair use of digital media.  The catch is that one must be able to circumvent in the first case, which DRM does not allow for.  As long as developers write code which does not allow for the unauthorized copying or access, regular consumers will be breaking the law if they attempt to create programs to get around the code.  The DMCA does allow for certain exceptions.  The first is for nonprofit libraries and educational institutions wishing to circumvent in order to determine whether they wish to obtain authorized access of the work.  The second allows for reverse engineering in order to ensure interoperability.  The third applies to research in the identification of flaws and vulnerabilities.  The fourth exception allows for courts to circumvent in order to incorporate the technology in order to prevent access of certain material to minors.  The penultimate allows for the circumvention when the technological measure it is circumventing is able to collect personal information about natural persons, and the last exception is for testing the security of a computer or a network, providing the tester obtains permission from the owner of the network or computer system.  Indeed, the DMCA criminalizes the altering of electronic rights management information, not only the copying, but the act that comes before copying and obtaining unauthorized access.  This criminalizes not only the act of copyright infringement, but now the step before copyright infringement is now also a crime.  If we compare this to the real world, copyright infringement would be akin to stealing.  The step before stealing would be touching the product, yet there is no law to criminalize touching. 

            Using the case MGM v. Grokster

[9], as a backdrop, the Recording Industry Association of America has vastly increased the scope of their licensing.  This licensing allows DRM to assess the usages that that a lawful purchaser may do with their digital media.  For legal purposes, the RIAA has attempted to define what constitutes online piracy.  They state that certain streaming technologies constitutes piracy, as is the download of a sound recording from an open internet site, even if that sound recording is not resold.[10] 

            Writing systems with DRM is essentially treating the end user like a criminal and imposing a set of authorized uses which only the DRM provider chooses.  It smacks of inherent distrust in the consumer, and takes away the freedoms and rights traditionally associated with purchasing a product.  One analogy that is put forth by opponents is that "it's like the difference between hardwiring a 55-mph maximum speed in a car and ticketing a speeder.[11]"  Another point that is raised is that the code that is being written into DRM is now becoming the law of the digital content.  It is giving corporations who write the code the power to decide what users can and cannot do, something that even the Congress of the United States is uneasy with.  DRM stifles creativity in the sense that it limits the ability to create derivative works and enables copyright protection that was not foreseen by the framers of the constitution.  By choosing what goes into their code, the large corporations have the ability to choose what restrictions to place on consumers, slowly taking away the rights and freedoms that were an integral part of the internet explosion.  The freedoms to create culture and express oneself to millions of people on the internet are under threat by the restrictive schemes that certain types of DRM contain. 

            DRM is one way to create monopolies on digital media.  By not allowing for interoperability, the companies that create DRM hope to keep consumers subscribed to their service and to prevent them from moving to other ones.  This business model is inherently anticompetitive in that it does not allow for consumers to change brands without losing all the media that they had previously used. 

DRM has the ability to destroy the interactivity that the internet had previously allowed, by only allowing users the ability to read the content, rather than to edit and recreate the content according to the consumer's wishes.  We risk allowing only those who have the power over DRM to be creative, and destroy the creativity that comes at the individual level, for the individual no longer has the permissions to create the digital media they wish, either through the mixing or something new, or the building off of others work. 

Indeed, many of the industry's top performers are calling for an end to DRM.  Steve Jobs has called on the industry to stop using DRM, and has to use the colloquial term, "put his money where his mouth is" with the Apple iTunes music store, where the Fairplay DRM is now only an option.  Users have the option to purchase a song without Fairplay DRM for the same price as a song with Fairplay DRM.  Indeed others are seeing the sense in the removal of DRM, with Wal-Mart, Amazon, and Microsoft offering music content without DRM. 

[1] The Norwegian DVD Case.  Elektronisk Forpost Norge.  (Dec. 22, 2003) <http://www.efn.no/DVD-dom-20031222-en.html>

[2] Windows Media DRM Faq,  (October 2005) available at <http://www.microsoft.com/windows/windowsmedia/forpros/drm/faq.aspx>

[3] Ibid.

[4] Piracy and Organized Crime, available at <http://www.mpaa.org/piracy_Piracy_organized_Crime.asp>

[5] Sony BMG Litigation Information, available at  <http://www.eff.org/cases/sony-bmg-litigation-info>

[6] Sony BMG Settlement, available at <http://web.archive.org/web/20061221221411/http://www.sonybmgcdtechsettlement.com/>

[7]Consumer's Guide to Digital Rights Management,  available at <http://www.indicare.org/tiki-download_file.php?fileId=195>

[8] Digital Millennium Copyright Act, available at <http://www.copyright.gov/legislation/dmca.pdf>

[9] Metro Goldwyn Meyer v. Grokster, 545 U.S. 913 (US Mar. 29, 2005) available at <http://www.supremecourtus.gov/oral_arguments/argument_transcripts/04-480.pdf>

[10] Piracy, Online and on the Street, available at <http://www.riaa.org/physicalpiracy.php?content_selector=piracy_details_online>

[11]  Thomas Claburn.  Is DRM Doomed?  The Case Against Digital Rights Management , InformationWeek, (March 29, 2007) available at <http://www.informationweek.com/security/showArticle.jhtml?articleID=197801668&pgno=3&queryText=>