Managing Rights Management

Intertrust and Feitian DRM Patent Applications

Thursdays the PTO publishes new pending patent applications.  Both of today's Spotlight Applications concern aspects of digital rights management. Assigned to Intertrust, the first of today's applications discloses techniques for protecting and governing genomic and other information. Assigned to Feitian Technologies (CN), the second application discloses techniques for accessing and protecting e-book data.

DigitalQuick

I've started using DigitalQuick from Fasoo (a spinout from Samsung). Very smart guys. App addresses a problem that's kept me off the cloud.

Vanishing Act

The NYTimes article on reports on the work of University of Washington computer scientists on "self-destructing messages."

Vanish uses a key-based encryption system in a different way, making it possible for a decrypted message to be automatically re-encrypted at a specified point in the future without fear that a third party will be able to gain access to the key needed to read the message.

The pieces of the key, small numbers, tend to “erode” over time as they gradually fall out of use. To make keys erode, or timeout, Vanish takes advantage of the structure of a peer-to-peer file system. Such networks are based on millions of personal computers whose Internet addresses change as they come and go from the network. This would make it exceedingly difficult for an eavesdropper or spy to reassemble the pieces of the key because the key is never held in a single location. The Vanish technology is applicable to more than just e-mail or other electronic messages. Tadayoshi Kohno, a University of Washington assistant professor who is one of Vanish’s designers, said Vanish makes it possible to control the “lifetime” of any type of data stored in the cloud, including information on Facebook, Google documents or blogs. In addition to Mr. Kohno, the authors of the paper, "Vanish: Increasing Data Privacy with Self-Destructing Data," include Roxana Geambasu, Amit A. Levy and Henry M. Levy.

In a posting on Dave Farber's Interesting Persons list, Ed Garek observes:

Congratulations on the NYT article. However, the significant point of using a trust model that does not depend on the integrity of third parties is not new, while relying on a peer-to-peer network for "key hiding" is by itself an unsolved problem today (both technically and commercially). The free "Zmail Basic" listed in "Ten Free Services To Send Self-Destructing Emails Which Expire/Disappear Automatically After Specified Time Interval" ... also uses a trust model that does not depend on the integrity of third parties but the novelty there is that keys are not stored anywhere (each dialogue party holds a part of it), and uses a system of "minority control" to allow independent destruction of the capability to reassemble the entire key.

Dennis McDonald: Will Hard Times Lead To More DRM?

A few days ago, Dennis McDonald wrote:

An important question is whether competition exists (or is allowed to exist). DRM can be viewed as an artificial restriction on competition. Sometimes it works, sometimes it doesn’t. As we’ve seen in the U.S. it also helps if you manipulate the legal system to obstruct competition.

Even though I’m not a big fan of DRM, as the Chen article [on the demise / evolution of Web 2.0] suggests bad economic times will force changes. I think that we may see increasing emphasis on hardware and software lock-ins coupled with increased pressures from content industries for stronger “anti-copying” enforcement mechanisms.

WSJ: RIAA Drops MediaSentry, Picks Up DtecNet

The Wall Street Journal reports that the RIAA has dropped MediaSentry (Safenet), an application that finds and documents copyrighted music on consumer and student PCs. The information is then used as evidence in the RIAA-instigated lawsuits against individuals. Instead, the RIAA will use software or servies from Danish software provider DtecNet.

The RIAA announced last month that it planned to curtail its practice of filing mass lawsuits for copyright infringement. However, it still plans to closely monitor people it believes are illegally uploading copyrighted music, and continue with the legal action it already has in progress. It says it will still file lawsuits for exceptional cases.

In place of MediaSentry, the RIAA says it will use Copenhagen-based DtecNet Software ApS. The music industry had worked with DtecNet previously both in the U.S. and overseas, and liked its technology, said RIAA spokesman Jonathan Lamy.

Obviously, this apparent change in strategy and technology doesn't do anything to fix the record industry's broken business model.

Backdooring Skype

[tip o' the hat to Dave Farber's IP list] Speculation abounds that Skype has incorporated backdoors so that national security agencies can listen in on Skype calls. So much for privacy.

An article posted by Daniel AJ Sokolov on the heise security site says in part:

At a meeting with representatives of ISPs and the Austrian regulator on lawful interception of IP based services held on 25th June, high-ranking officials at the Austrian interior ministry revealed that it is not a problem for them to listen in on Skype conversations.

Viacom Agrees To Anonymous YouTube User Information

Reuters and the New York Times report that Viacom and Google/YouTube have agreed to anonymize user information as part of discovery in the lawsuit between them over copyright infringement in user generated or uploaded content.

Earlier in July, a federal judge in Manhattan ordered Google to turn over YouTube user data to Viacom and other plaintiffs to help them to prepare a confidential study of what they argue are vast piracy violations on the video-sharing site.

Google said it had now agreed to provide lawyers for Viacom and a class-action group led by the Football Association of England, a large viewership database that blanks out YouTube username and Internet address data that could be used to identify individual video watchers.

ISP Targeted Advertising

One example of the current discussion regarding ISP efforts to participate in revenue streams based on advertising is this overview article that appeared in MediaPost. Charter and others are looking into ad insertion based on capturing information about the web browsing behavior of their customers.

In the U.S., ad company Charter Communications has said it intends to share information about its broadband subscribers' Web surfing with ad company NebuAd. Bob Dykes, CEO of NebuAd, has said that the platform is anonymous, and that users will be able to opt-out.

Annals of Privacy Protection: The NGS Genographic Project

A friend mentioned contributing DNA to the National Geographic Society's Genographic Project "which is seeking to chart new knowledge about the migratory history of the human species by using sophisticated laboratory and computer analysis of DNA contributed by hundreds of thousands of people from around the world."

I got curious about the privacy implications of providing genetic materials to the project, whose goals are certainly laudable. Having reviewed the project's privacy page, it was unclear to me whether the DNA would have to be made available in response to a lawful subpoena related to civil or criminal proceedings for personally identifiable genetic information. So I asked them via email. They were kind enough to respond as follows (which I have their permission to publish):

Switzerland Warns File Trackers

InfoWorld reports that the Swiss government has warned Logistep, a company that tracks file sharers, that its tactics may be illegal under Swiss law. Identifying file sharers is part of global antipriracy efforts that in the view of some compromises the privacy of individuals.

Logistep, which supplies information on suspected file sharers to law firms around the world for use in copyright violation cases, has until Feb. 9 to respond to the Federal Data Protection and Information Commissioner (FDPIC), said Marc Schaefer, the agency's legal advisor.

Under Swiss law, the identity of a subscriber to an ISP can only be revealed during the course of a criminal case, not a civil one, Schaefer said. The IP address of a computer controlled by the subscriber is considered "personal" information.

Snooping on Skype

[tip o' the hat to Digital Freedom Campaign] Jeremy Reimer writes on ArsTechnica that the Bavarian government sought assistance from software vendor Digitask in snooping on Skype conversations. So much for privacy.

The method outlined involved the installation of malware referred to as the "Skype Capture Unit" that would be delivered in an executable file that "can for instance be attached to an e-mail or directly be installed on the target machine." This software would then transfer unencrypted conversations to a remote Skype Recording Server that can record and replay 10 Skype interceptions in parallel. The Recording Server then sends the conversations through to Skype and their intended destination, a classic "man in the middle" attack that is difficult for the compromised user to detect.

Canadian Privacy Minister Cautions Against DRM

Privacy is a touchy subject. For nearly 20 years, I have advocated that consumers be informed in advance and "opt in" to any collection of usage information by DRM technologies. The reason is that this information has value. In some business models, it's perfectly reasonable to provide compensation to consumers for access to their usage information. Compensation might be in the form of discounts or free digital goods.

These and related issues are now being discussed in Canada. Jennifer Stoddart, Privacy Commissioner of Canada, has sent a letter to Jim Prentice, Minister of Industry, and Josée Verner, Minister of Canadian Heritage, regarding the privacy implications of proposed changes to Canadian copyright law. Ms. Stoddart is most concerned about the use of DRM implementations that collect user related information without their consent:

If DRM technologies only controlled copying and use of content, our Office would have few concerns. However, DRM technologies can also collect detailed personal information from users, who often do no more than access the content on a computer. This information is transmitted back to the copyright owner or content provider, without the consent or knowledge of the user. Although the means exist to circumvent these technologies and thus prevent the collection of this information, previous proposals to amend the Copyright Act contained anti-circumvention provisions.

DRM 3.0 - Privacy

Dennis McDonald posted a comment on my DRM 3.0 blogicle asking, "Did any of the industry folks you talked with say anything about possible privacy implications for "DRM 3.0" applications?" The direct answer is "yes and no."

Privacy issues turn, in my view, on what is done with information relating to user behavior. However, privacy is not the only issue raised by DRM 3.0 models.

Some ISPs are threatening to interdict and prevent the transfer of copyrighted media content (especially if that content belongs to large companies). If ISPs provide user specific information to the RIAA, MPAA, or other stakeholders that then becomes the basis for civil litigation or criminal prosecution, then privacy is obviously a major concern to all.

Privatunes Doesn't Privatize iTunes Music Files - EFF

Privatunes announced software that removes the identifying information that Apple includes in each music file, including those sold without FairPlay DRM. However, the Electronic Frontier Foundation says the removal is not complete:

The iTunes User Mark - Risks and Hacks

Chris Maxcer has written an informative article on iTunes embedding buyer information in each file and on the possible consequences of sharing such files with others.

It's been recently discovered, though, that each song sold through iTunes Plus --the section of iTunes that sells the higher-quality, DRM-free music -- is marked with the name and e-mail address of the user who bought it....

What Apple Embeds

The EFF has taken a closer look at iTunes music files that lack Apple's FairPlay DRM. As part of what appears to be their ongoing investigation, they concluded:

We've found that there isn't a watermark in the compressed audio signal itself, but there are surprisingly huge differences in the encoded files. Much bigger differences than just different tags, or even different signed/encrypted tags.

Reigning In The RIAA and MPAA

The LA Times [registration required] is reporting that the Motion Picture Association of America and the Recording Industry Association of America are lobbying the California legislature for an exemption to proposed laws that would outlaw pretexting, the practice of misrepresenting one's identity in order to gain access to confidential or private information. Pretexting was at the core of the recent Hewlett Packard board brouhaha.

The trade groups are arguing that they need to use pretexting to pursue pirates of physical and digital goods and that the proposed legislation would deprive them of an import tool in combating piracy.

Intel's Legrande Security Coming to Home PCs - Not?

Writing in TG Daily, Wolfgang Gruener notes in a very informative article that Intel's Legrande security platform is unlikely to come to home PCs any time soon largely out of Intel's concerns around privacy implications. Snippets:

Further on the Halderman Felton Paper

Yesterday I noted the terrific paper by Alexander Halderman and Ed Felton that provides an in-depth look at the technologies underlying the Sony-BMG rootkit fiasco. As with the fiasco itself, this paper is certain to gather substantial attention in the blogosphere.  Here is a quasi- random selection of commentary that may be of interest.

Proposed Settlement in Sony Suit

According to a blog posting by Alex Eckelberry on the Sunbelt Software blogsite, a preliminary settlement in a lawsuit against Sony has been filed in court. The proposed settlement is outlined in the blogicle. The 42 page court document is also available on the Sunbelt site here.

As of the 23rd, at least some stores still had Sony CDs with DRM on them, this according to the Consumerist and other sites.

The Boycott Sony Blog

Tim Jarrett has established the boycott Sony blog, apparently to provide a forum for comment and discussion. Among the more recent observations is that the provider of the DRM technology that is the root cause of the Rootkit problem, first4internet, has apparently taken down their web site.

As of yesterday afternoon, most of the content was gone as observed by Jarrett and others.

Sony Turning Off Buyers In Canada

According to an article in Ecommerce Times, the Sony Rootkit chickens have come home to roost in the form of lower CD sales, at least in Canada. Snippets:

It's becoming a regular occurrence in CD shops across the country [Canada]: an irate customer comes in complaining the CD they bought won't play on their computer, and worse yet, they can't transfer the tunes to their iPod.

The culprit is copy-protected or copy-controlled CDs -- something many Canadian music retailers say they would like to see pulled from store shelves.

"This is just another really, really ridiculous way of telling our customers, 'We don't want your business,'" said Tim Baker of Sunrise Records, which has 31 shops in southern Ontario. "It's so stupid."

Is Sony Really Melting Down?

A number review articles have covered the evolving Sony BMG rootkit rumpus, including Bill Rosenblatt's piece, Dennis McDonald's blogicle, and Jefferson Graham's story on the possible roots of Sony's troubles in their merger with BMG. Well written, Graham might be correct.

Still, it's often hard for senior executives to understand the implications of, and to ask the right questions concerning complex technologies that may be out of their competence zones.  That said, Sony management is clearly culpable for poor public relations, a point also made in the Graham story.

The odds are pretty good, in my view, that over the next year  Sony BMG will recover and sales will not be greatly affected. By Xmas time 06, only the DRMigerati and lawyers will care.

Personal Data

Dennis McDonald has started a blog on personal data here [ok, he mentions this blog favorably, but reciprocity drives the blogosphere].

His thinking seems aligned with the notion expressed in my writings that consumer choice and market forces should play an important role in how personal information is used.

In the context of DRM, maybe I'm willing to share information regarding my music or video use and preferences in exchange for free music. Or not.

Microsoft Spying? Probably Not

Marketing Shift has an article and comments regarding a data structure relating to Microsoft's DRM. One of the fields is "law_association_area". Applying Occam's Razor--that the simplest explanation is best--this field probably reflects the fact that many, if not most, rights are territorial.  One example is the DVD region code.

Another is that different companies may have the rights for the same  book or CD for different countries. One well-known example is that Scholastic has the US rights for Harry Potter while Bloomsbury has the United Kingdom Rights.

In this instance, at least, paranoia seems unwarranted.