Tag Archives: DRM

At FGI, we continue to wonder why GPO has never said that they will avoid using "Digital Rights Management" (DRM) tools to authenticate government publications. DRM technologies, which are designed for use by the entertainment industry to protect content from copying, are (or should be) antithetical to open, freely available, reusable government information. A different way to authenticate a digital document is with a "cryptographic hash."

[A] cryptographic hash algorithm is a highly complex math formula that can be used to create digital signatures and authenticate data to ensure it hasn't been tampered with. [NIST] is looking for "unclassified, publicly disclosed" algorithms that would be "royalty-free" and "capable of protecting sensitive government information well into the foreseeable future." -- NIST announces competition for new cryptographic hash algorithm, by Ellen Messmer, Network World, 01/23/07

Such "digital signatures" (each one essentially a string of numbers) could even be included in library OPAC records along with a link to the algorithm so that any user could verify the authenticity of any document using open tools that run on any platform.

• NIST Wants Comments on Draft ‘Hash’ Requirements, NIST. January 23, 2007
• Announcing the Development of New Hash Algorithm(s) for the Revision of Federal Information Processing Standard (FIPS) 180–2, Secure Hash Standard. Notice and request for comments., DEPARTMENT OF COMMERCE, National Institute of Standards and Technology, [Docket No.: 061213336–6336–01] Federal Register Vol 72, no. 14, January 23, 2007, p. 2861.

See also: Draft requirements for new hashing standard open for comment, by William Jackson, GCN, 01/23/07

Continue reading →

Continue Reading →

How will decisions about consumer electronics and entertainment affect you as a government information specialist?

Joab Jackson, of Government Computer News, hints at the answer to that question when he writes in his GCN technology blog:

Typically, we don't cover Digital Rights Management. How Microsoft Corp. and other tech companies secure digital music and downloadable movies is more of a consumer issue, hence outside our charge. But a recent paper by New Zealand academic Peter Gutmann is worth reading in that it reveals the side-effects of the DRM hooks Microsoft buried in Vista. In short, Gutmann argues that the safety measures Microsoft put in place will complicate life for all users, not just those who want to watch high-definition movies on their computers.
-- Paying the cost to run Vista. "Tech Blog" By Joab Jackson, Government Computer News, 01/02/07.

And, he might add, not just those that use PCs and Windows. The paper Jackson refers to is A Cost Analysis of Windows Vista Content Protection by Peter Gutmann. It has been receiving lots of comments and Gutmann continues to update it (the last version I read was updated on January 4, 2007). Gutmann's paper examines the new version of Microsoft Windows called "Vista," which will be available soon. In anticipation of its release, there has been a spurt of writing about it and about the digital rights management (DRM) technologies built into it. Here are two more:

• Feeding Frenzy by Robert X. Cringely "I, Cringely" PBS.org, December 29, 2006.
• How Vista Lets Microsoft Lock Users In By Cory Doctorow, InformationWeek Dec. 5, 2006.

Jackson summarizes some of the problems Gutmann finds: slowed performance, reduced fidelity of content, and the fact that peripherals could be remotely disabled by Microsoft itself. Gutmann's own summary says that Vista's content protection features will affect "all hardware and software that will ever come into contact with Vista, even if it's not used directly with Vista (for example hardware in a Macintosh computer or on a Linux server)."

Cringely looks more at the consumer and entertainment perspective and says that all "Digital Rights Management is really just an ecosystem for selling our own stuff to us again and again."

Doctorow says that "Technology called 'Information Rights Management,' [IRM] combined with copyright law and Windows Vista, give Microsoft the tools to hold users' data hostage in Office."

This is important for government information specialists to understand because, as Doctorow points out, it means that information creators and distributors will control who can read a document and what they can do with it afterwards. Imagine a world in which government information is "protected" or "secured" or "authenticated" (choose your pseudonym of preference) with DRM/IRM:

With IRM, an Office user can specify whether her documents can be printed, saved, edited, forwarded -- she can even revoke access to the documents after sending them out, blocking leaks after they occur. (Doctorow) [emphasis added]

This goes beyond what we already see in "locked" PDF documents. "Unlike a crippled PDF, a restricted Word file is encrypted. Only authorized readers will get the keys" (Doctorow). Vista will do this by relying on hardware and software built right into the hardware. The "Trusted Computing Module" on the motherboard of most PCs manufactured in recent years produces an "attestation" about the precise configuration of a PC. Cory says, "If your PC doesn't pass muster -- because you're running a third-party document reader, or a modified OS, or an OS inside a virtual machine -- then you don't get any keys" and can't read a document. And "Remote Attestation" allows software to be verified over a network. Forget about using open source or third party software to read documents written with these features.

No company has spent more time and money on preventing its competitors from reading its documents: remember the fight at the Massachusetts state-house over the proposal to require that government documents be kept in open file-formats? (Doctorow)

Here's more from Cory's article:

The deck is stacked against open file formats. Risk-averse enterprises love the idea of revocable documents -- HIPPA compliance, for example, is made infinitely simpler if any health record that leaks out of the hospital can simply have its "read privileges" revoked. No one ever opts for "less security." Naive users will pull the "security" slider in Office all the way over the right. It's an attractive nuisance, begging to be abused. The Trusted Computing Module has sat silently on the motherboard for years now. Adding Vista and IRM to it is takes it from egg to larva, and turning on remote attestation in a year or two, once everyone is on next-generation Office, will bring the larva to adulthood, complete with venomous stinger.

All this adds up to handing the government ways to further control government information -- even if libraries have digital copies of documents. We at FGI have repeatedly asked the Government Printing Office to eschew DRM, but GPO has never done so.

Continue reading →

Continue Reading →

A recent article in GROKLAW critiques the extreme way one library is implementing digital rights management (DRM) and how it impacts fair use, first-sale, and re-usability of information. While focusing on the British Library, it does an excellent job of pointing out the dangers of DRM. Can we imagine the Future Digital System having documents that expire, that can't be printed, that are bound by contractual restrictions (not copyright!), that can be read on only one machine, that can't be copied, etc. etc.? GPO should disavow such uses of DRM, but it has never done so.

• The British Library - "The world's knowledge" DRM'd and for a price. by Pamela Jones. GROKLAW (May 07 2006)

Continue reading →

Continue Reading →