There have been a couple of interesting articles and statements regarding Digital Restrictions Management (DRM) that I would like to share with you and comment on. One was a blog entry by Shane, titled "DRM is not evil. People are evil" and another one was a statement by Nick Ashton-Hart on behalf of (quote from the statement):

FIA, The International Federation of Actors, represents more than a
hundred associations of performers around the world, working in film,
television, radio, commercials, new media, live performance, variety
and circus;

IMPALA, the international representative of 2500 independent record
companies in Europe, who are collectively responsible for 20 percent
of all sales of phonograms;

The International Music Managers Forum, who represent the professional
associations of managers in countries worldwide; managers are the
legal representatives their featured artist clients for all aspects of
their professional lives.  

I found Nicks statement an extremely interesting read, as it gives some numbers to describe the current state of the recording industry:

For example, the major phonogram producers are currently paying even
the largest UK artists 4-5 pence per iTunes download sale -- a royalty
of 5% of retail sale price -- and there are all kinds of ways in their
standard contracts to withhold payment of all or part of even of that.

[...]

Why is this important? Because at present approximately 90% of all the
sound recordings owned by the major phonogram producers are locked in
vaults and not available commercially on any terms anywhere, to
anyone. The creators of these recordings are powerless to do anything
about it.

[...]

You must understand: more than 95% of all musicians never -- let me
repeat -- never -- make a living from their craft. Of those who do,
most only make a basic living -- even those who have had quite
successful records generally live modestly. How are people living
modestly supposed to take people in faraway lands to court?

As Nick pointed out, the vast majority of artists could never afford tracking down violations of their rights, and indeed are themselves often victims of the recording companies who will not allow them to publish songs even if those companies themselves do nothing with them.

Stronger Copyright laws and harsher punishments do nothing to rectify that situation, they only tend to make the recording companies stronger, further worsening the state of the individual artist trying to negotiate deals with them:

We are individual creators and small companies. Legal action is
frequently too complicated and expensive (especially when you are in a
David and Goliath battle with a large corporation) for most artists
and many small record companies to undertake.

All layers of rhethorics stripped away, copyright is a limited monopoly granted by society for the sake of society: Its fundamental task is to allow authors and artists to make a living of their craft so all of society has access to more cultural diversity in return. It is not a one-way street.

People also tend to forget thqt it is in particular one group of society -- the authors and artists themselves -- who require a large cultural diversity to draw from in order to train themselves and gain inspiration.

Balancing the monopoly with an obligation to publish sounds like a useful addition to copyright law: If the large rights-holding industries fail to publish, copyright could automatically go back to the author, or -- if the author is dead or has no further interest in seeing the work copyrighted further -- works enter the public domain.

But what about DRM? Could it really do anything to redress the problems at hand?

Digital Restriction Management - Solution or Problem?

Both Shane and Nick make the point that Digital Restrictions are a tool, much like a hammer that could be used to build a house or hit someone over the head. While that may be true from a certain perspective, I think the picture is incomplete. DRM is more like a hammer that, in order to allow a few people to build a house, requires to hit everyone on the head.

Thinking before acting is good

Probably starting from ecology, the word sustainability has become rather hyped over the years. Abstractly, it means nothing else than considering the cost of your actions and weighing them against the potential benefits: If a medicine cures cancer, that is a good thing, but if it has the side-effect of killing the patient, it will not be very popular.

While this principle may sound simple and obvious, it is in fact not always applied. Individual areas needed individual moments to decide following this principle. Environmental planning has only begun adopting this principle in the past 20-30 years. Medicine has been following it for longer. Most ideas for digital technology do not apply this principle, at all.

With the exception of individuals such as Prof Weizenbaum, few people outside the Free Software movement seem to think about what could be called "Digital Ecology". In the security world, Bruce Schneier is one of the few people who apply this principle consistently. Both are recommended authors for reading.

When applying such a systemic view on Digital Restrictions Management (DRM), what is the benefit/cost ratio?

Financial cost

Many people advocate DRM on the basis of individual artists being able to market their own music, books, films in a "DRM World" because of digital and diversified infrastructures, which are supposedly cheaper than physical distribution channels, such as DVDs. This is probably a wrong expectation.

Nicholas Cravotta wrote an interesting article titled "The war on copying. Digital-Rights-Management Technology is the next Step in Providing Real Protection, But at What Cost and to Whom?" in EDN, Reed Electronics Group, 10/16/2003 (PDF) in which he already outlined many financial cost factors to any system implementing Digital Restriction Management.

Indeed, several security analysts I spoke to estimated the overhead cost of a half-efficient DRM infrastructure to be roughly similar to that of physical distribution models today.

Unlike physical distribution models, where the cost is basically limited to the production and distribution cycle, so before the DVD is sold, DRM infrastructures will require substantial maintenance also after the initial transaction. Fees to listen to music that people feel they already paid for are likely to upset and alienate music lovers and unlikely to cover the maintenance cost for the system.

Effectiveness

Building an absolutely "bulletproof DRM" is impossible. What is called the "analog hole" can never be plugged -- people will always be able to record music or films off their screens, and they will always be able to pass those recordings to others. Both because of improved technologies and because of digitally perfect copies of the first recording, degradation of quality by this step is usually neglegible.

In other words: the "analog hole" is not only impossible to close, it is also becoming much more attractive. In addition there is also a "digital hole" caused by two simple facts: all software always contain bugs and in order to become acceptable to people, certain "holes" will have to remain open.

The most successful DRM example quoted is usually Apple iTunes. As Richard Stallman pointed out in an interesting interview to LinuxP2P, iTunes is better referred to as "Digital Inconvenience Management" (DIM), because it allows people to record their tracks to a genuine audio CD. Naturally, everyone would be capable of burning such a CD and recode the data into a truly free format like OGG Vorbis.

So in order to get the system accepted, the "analog hole" has become a "digital hole" in this case. It also means Apple iTunes is not really a genuine DRM example case, after all: Its infrastructure costs are lower than we have to expect of a "hard" DRM.

Nick rightly criticised that for major UK artists at best only 5% of the money collected by DIM-based iTunes ever reaches the artist. For "hard" DRM systems, that number will most likely be lower.

Interoperability

It is not very hard to identify interoperability as one of the major issues we are facing today in many areas; and digital media are no exception. Nick indeed rather clearly points out the failure of companies in this area:

Clearly, the use and development of DRM and TPM technologies cannot be
left completely to the market -- there must be some oversight to
remedy and prevent current and future abuses. Lack of interoperability
between systems continues to make life difficult for everyone, and
hardware and software vendors, as well as sectoral forces such as the
major entertainment producers and telecom companies are simply not
managing the development and deployment of these technologies
properly.  

Unfortunately, interoperability is much harder to achieve than most people realise or would like to believe: the open standard debate has been going on for decades and is not likely to disappear anytime soon. David A. Wheeler recently wrote an interesting article about this in relation to the "Open Document Format" (ODF) which has been published on GROKLAW.

The underlying problem of standardisation is always that large companies often do not consider it in their interest to fully adhere to the standard: they do not want their customers to be free to choose the implementation of another company. "Value-added" standards that create "vendor lock-in" are the natural consequence.

The most effective practical safeguard against this appears to be a Free Software reference implementation of a standard. Those who wish to be as safe as possible from ever experiencing such lock-in effects should always go with the Free Software implementation. So while Free Software and Open Standards are different issues, they are related in a subtle way.

But DRM and Free Software are fundamentally opposed principles: One seeks to enforce restrictions someone else determines on the user of a computer, the other seeks to give the user control over their computer. This gives rise to scepticism whether true interoperability will ever be achieved in this area and what happens to the people who have fallen victim to the non-interoperable formats in the 15 years or so that it will probably take to come to some form of limited interoperability.

Sustainability

How many artists are going to run their own DRM infrastructure? My guess is very few. And who is going to maintain all these infrastructures for the years to come? How motivated will rights-holding companies -- or their technical equivalent maintaining DRM infrastructures -- be to maintain costly infrastructure for "obsoleted" technologies and artists that do not sell large amounts of records anymore? What will happen to all the recordings in such formats?

The answer to this seems obvious. Nick criticises that today, in what is still essentially a non-DRM world, only 10% of all existing recordings are actually available today. Wide introduction of DRM will make that situation worse, not better.

Instead of simply becoming unavailable in stores or on the internet, the recordings will decay in the hands of listeners, who will find themselves unable to play their old recordings on their recent devices; and depending on the implementation possibly even their old devices.

Socio-political cost

Although we have not even begun the social and political cost of taking away control over technological infrastructure from users, non-media companies and governments, DRM already seems to come at quite a high cost for very little potential benefit.

When taking social and political effects into consideration, the situation becomes ridiculously clear. As the United Nations Working Group on Internet Governance (WGIG) rightly stated in its "Intellectual Property Rights" working paper: Introduction of DRM and accompanying legislation puts fundamental Human Rights at risk, in particular privacy and freedom.

DRM may be a poor tool for artists and authors, but it is an excellent tool for censorship, political control and surveillance.

What now?

Ultimately, DRM is a dead end for society: its cost is outrageously high and borne by all of society collectively, while its potential benefits only affect major recording companies, some police states, and about 0.5% of all musicians.

It is my great hope that by the time the GNU General Public License will be reworked for version 4 some time in the future, the FSF can simply drop the DRM clause because it has become irrelevant.

Meanwhile the old systems like copying levies still continue to function, and even though they are far from perfect, they are much preferrable to DRM-based approaches. Discussions about "cultural flatrates" are in the end nothing but the continuation of these levies.

The popularity of Bittorrent and other P2P software shows there is a large demand for conveniently accessible culture. If people do not choose to follow the wishes of the rights-holding industry anymore, that is because they are too inconvenient, too expensive, or not considered "worth it" for whatever other reason.

So instead of wasting billions of EUR on DRM technologies and political lobbying, they might be far better off to consider how they can improve the quality and convenience of their service. In the end, convenience is a very strong argument, most people prefer to be lazy. You lost them by ignoring their wishes, but you could win them back.

In other words, my dear major-label rights-holding industry: It's the convenience, stupid!

As German media company Heise.de reports, the "Gesellschaft zur Verfolgung von Urheberrechtsverletzungen" ("Association for the Prosecution of Copyright violations") (GVU) was paid a visit by the German police.

This tuesday morning around 10:00, police searched more than 200 locations in Germany, Austria, The Netherlands, Poland and Czechia. Overall 20 servers were confiscated, apparently they were used to distribute illegal copies of movies via FTP/FXP. No comments from the GVU so far, but you can see their stash on the picture.

This in many ways seems like poetic justice -- an association that is pushing for the criminalisation of copyright violations hoping to strip- and cavity-search every man, woman, child and toddler for potentially hidden unauthorised copies, has apparently hoped to lure potential victims into their fangs by offering downloads and are now caught in their own web.

I certainly hope they themselves appreciate the experience that they seek to bring upon the rest of society.

[update]

According to a followup article on Heise.de it seems that the GVU indeed did pay the admin of a "warez" site to get IP addresses and other logged information, they also appear to have donated hardware and illegal copies themselves.

The website of the GVU is now offline, and the GVU appears to be under investigation for abetment.

Don't ask me why, but it does remind me of the campaign in which they tried to deter kids from illegal copying by threatening them with rape in jail. Hm.