Drm {And, Or, Vs.} the Law

DRM {AND, OR, VS.} THE LAW By Pamela Samuelson opyright industries are hoping that digital rights management (DRM) technologies will prevent infringement of commercially valu- able digital content, including music and movies. These industries have already per- suaded legislatures in the U.S., the European The main purpose Union, and other countries to adopt broad of DRM is not to anti-circumvention rules to protect DRM prevent copyright from being hacked, and courts have inter- preted these statutes even more broadly than the lawmakers infringement but to Cintended. change consumer Some copyright industries now want DRM to be mandated in expectations about all digital media devices, either through standard-setting processes what they are or through legislation. Though mandates for ubiquitous DRM are unlikely to be legislated soon, the threat of DRM mandates should entitled to do with be taken seriously. Computing professionals should be aware that digital content. private standard-setting processes may result in even less protection for consumer and other public interests than legislation that in the past has included at least some consumer-protection rules. U.S. Reps. Rick Boucher (D., VA), Zoe Lofgren (D., CA), and others, recognizing that DRM and overbroad anti-circumvention rules COMMUNICATIONS OF THE ACM April 2003/Vol. 46, No. 4 41 abjure expressing them unless forced to do so by law THE DMCA IMPEDES THE or competition. DRM is more aptly described as “code as code” PROGRESS OF SCIENCE, is [4]—a private governance system in which computer economically unjustifiable, program code regulates which acts users are (or are not) authorized to perform—than as a rights man- and lacks the balance the agement regime or as a copyright-enforcement mechanism. An alternative phrase for DRM is “digital Constitution requires of restrictions management,” given its use by copyright intellectual property legislation. industries to restrict user rights [3]. Whether users ought to be able to circumvent DRM to exercise their interfere with legitimate interests of consumers, have rights has been the subject of some debate. proposed legislation to safeguard these interests. Computing professionals who want to contribute Anti-Circumvention Rules to more balanced intellectual property policy should In response to industry concern about the vulnera- do two things: collectively articulate the positive bility of DRM technologies to hacking, the U.S. social benefits of general-purpose technologies to Congress in 1998 passed the Digital Millennium counteract proposed DRM mandates; and strongly Copyright Act (DMCA) in order to outlaw certain support consumer-protection legislation for DRM- acts of circumvention and technologies designed to protected content (such as warning labels) and pro- circumvent technical measures used to protect copy- posed reform of anti-circumvention rules. righted works; other countries have followed suit (see Dusollier’s article in this issue). Section DRM Goes Beyond Copyright 1201(a)(1)(A) forbids circumvention of technical DRM is sometimes said to be a mechanism for measures copyright owners use to protect access to enforcing copyrights [9]. While DRM systems can their works. Section 1201(a)(2) forbids manufacture certainly prevent illegal copying and public distribu- or distribution of technologies primarily designed or tion of copyrighted works, they can do far more; produced to circumvent access controls, while paral- they can as easily prevent the copying and distribu- lel provision 1201(b)(1) outlaws other circumvention of public-domain works as copyrighted works. tion technologies. Anyone injured by violation of Moreover, even though copyright law confers on these rules can sue for damages, injunctive relief, copyright owners the right to control only public and attorney fees. Violating these rules willfully and performances and displays of these works, DRM for profit is a felony. systems can also be used to control private perfor- Circumvention is permissible for some purposes, mances and displays of digital content. DRM sys- such as achieving program-to-program interoperabil- tems can thwart the exercise of fair use rights and ity and engaging in encryption research and com- other copyright privileges. DRM can be used to puter security testing. However, the statutory compel users to view content they would prefer to exceptions are very drawn narrowly and fail to recog- avoid (such as commercials and FBI warning nize many legitimate reasons for circumventing tech- notices), thus exceeding copyright’s bounds. nical measures, including to engage in research about Given that DRM permits content owners to exer- nonencryption-based watermarking technologies or cise far more control over uses of copyrighted works analyze computer viruses or worms [6]. than copyright law provides, the moniker “DRM” is A careful study of the legislative history of the actually a misnomer. These technologies are not really DMCA and the detailed structure of the anti-circum- about the management of digital “rights” but rather vention rules reveals that Congress intended for cir- about management of certain “permissions” to do X, cumvention of copy- and use-controls to be lawful Y, or Z with digital information. If DRM systems when performed for noninfringing purposes, such as were about digital management of rights, they would to enable fair uses. Circumvention of access controls need to be designed so users could express their rights was treated differently by lawmakers on the theory under copyright, too. Thus far, digital rights expres- that lawful access is a prerequisite for fair use rights. sion languages (RELs) lack semantics to allow the Unfortunately, early decisions interpreting the expression of concepts like fair use [5]. DRM cannot DMCA, such as Universal City Studios v. Corley in accommodate user rights without REL vocabularies 2000, have treated persistent access controls, such as capable of expressing them. Even if RELs developed the Content Scramble System (CSS) used in DVD semantics to express user rights, content owners may players and discs, as access controls. Universal charged 42 April 2003/Vol. 46, No. 4 COMMUNICATIONS OF THE ACM Corley with violating 1201(a)(2) for posting a CSS embed CSS in the licensed DVD players. decryption program known as DeCSS on his 2600 The recording industry hoped to achieve a similar magazine’s Web site as part of its news coverage of the result in negotiations with makers of digital music controversy about DeCSS. By ruling that DeCSS was players through the Secure Digital Music Initiative a 1201(a)(2) tool, not a 1201(b)(1) tool, the court (SDMI), a consortium organized by the major labels implicitly ruled that circumventing CSS to make fair who are members of the Recording Industry Associa- use of a DVD movie violates 1201(a)(1)(A). tion of America and that included representatives of In this and other respects, the Corley decision makers of digital music players. These negotiations adopted the copyright industry’s preferred interpreta- were unsuccessful for a number of reasons, including tion of the DMCA as virtually unlimited in its pro- diverse interests of participants and weaknesses in tection of DRM. Subsequent decisions may correct watermarking technologies SDMI proposed as stan- some errors in the Corley decision, but for now it is a dards. Princeton University computer science profes- benchmark interpretation of the DMCA. sor Edward Felten, along with certain colleagues and Constitutional challenges to DMCA anti-circum- some students, quickly discovered these weaknesses vention rules were unsuccessful in Corley, but many when SDMI challenged the hacker community to scholars of intellectual property law continue to doubt break them (see Felten’s article in this issue). SDMI their constitutionality. Even though the Corley deci- initially tried to suppress publication of Felten’s paper sion might suggest that Carnegie Mellon University about the weaknesses, claiming it was an illegal cir- researcher David Touretzky’s Gallery of CSS cumvention technology. After Felten sought a court Descramblers violates the law, the First Amendment declaration that he had a First Amendment right to of the U.S. Constitution would almost certainly pro- publish, SDMI withdrew its objection. tect his right to post this educational material on his Though the content industry must surely be pleased Web site, as well as my right to link to this gallery on by recent DRM-friendly developments, such as my course Web site. Microsoft’s Palladium initiative and the Trusted Com- Further challenges to the DMCA’s rules may be puting Platform Alliance (TCPA) for embedding DRM fueled by the U.S. Supreme Court’s recent decision in into platform infrastructure, it must also worry about Eldred v. Reno. Even though the Court upheld the three things: Microsoft and TCPA firms cannot control Copyright Term Extension Act (CTEA) of 1998, it every platform for playing, viewing, and copying digital did so because the life of the author plus 70 years was content; competition among different DRMs may frag- still a “limited time,” as the Constitution requires, ment the consumer market and suppress consumer whereas the DMCA anti-circumvention protection is demand; and as Johansen, Felten, and others have perpetual in duration. The CTEA added 20 years to proved, no DRM technology is hacker-proof. the terms of existing copyrights, thereby thwarting the Mandating standard DRM technologies in digital plans of Eric Eldred to publish works from the 1920s media devices would address the first two. Sen. Ernest on the Web. Among the authors whose works are still Hollings (D., SC) introduced the Consumer Broad- in copyright thanks to the CTEA are Bela Bartok, band and Digital Television Promotion Act of 2002 Kahlil Gibran, Robert Frost, and Maurice Ravel. The (S. 2048), contemplating that representatives of copy- DMCA impedes the progress of science, is economi- right industries, makers of digital media devices, and cally unjustifiable, and lacks the balance the Constitu- consumer groups would have 12 months to reach tion requires of intellectual property legislation.

Load more