Facebook Security Breach Exposes Accounts of 50 Million Users

SAN FRANCISCO — Facebook, already facing scrutiny over how it handles the private information of its users, said on Friday that an attack on its computer network had exposed the personal information of nearly 50 million users.

The breach, which was discovered this week, was the largest in the company’s 14-year history. The attackers exploited a feature in Facebook’s code to gain access to user accounts and potentially take control of them.

The news could not have come at a worse time for Facebook. It has been buffeted over the last year by scandal, from revelations that a British analytics firm got access to the private information of up to 87 million users to worries that disinformation on Facebook has affected elections and even led to deaths in several countries.

Senior executives have testified several times this year in congressional hearings where some lawmakers suggested that the government will need to step in if the social network is unable to get tighter control of its service. On Friday, regulators and lawmakers quickly seized on the breach to renew calls for more oversight.

“This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users,” Senator Mark Warner, a Democrat from Virginia and one of Facebook’s most vocal critics in Congress, said in a statement. “A full investigation should be swiftly conducted and made public so that we can understand more about what happened.”

In the conference call on Friday, Guy Rosen, a vice president of product management at Facebook, declined to say whether the attack could have been coordinated by hackers supported by a nation-state.

Three software flaws in Facebook’s systems allowed hackers to break into user accounts, including those of the top executives Mark Zuckerberg and Sheryl Sandberg, according to two people familiar with the investigation but not allowed to discuss it publicly. Once in, the attackers could have gained access to apps like Spotify, Instagram and hundreds of others that give users a way to log into their systems through Facebook.

[Read more about what you can do to secure your Facebook account.]

The software bugs were particularly awkward for a company that takes pride in its engineering: The first two were introduced by an online tool meant to improve the privacy of users. The third was introduced in July 2017 by a tool meant to easily upload birthday videos.

Facebook said it had fixed the vulnerabilities and notified law enforcement officials. Company officials do not know the identity or the origin of the attackers, nor have they fully assessed the scope of the attack or if particular users were targeted. The investigation is still in its beginning stages.

“We’re taking it really seriously,” Mr. Zuckerberg, the chief executive, said in a conference call with reporters. “I’m glad we found this, but it definitely is an issue that this happened in the first place.”

Critics say the attack is the latest sign that Facebook has yet to come to terms with its problems.

“Breaches don’t just violate our privacy. They create enormous risks for our economy and national security,” Rohit Chopra, a commissioner of the Federal Trade Commission, said in a statement. “The cost of inaction is growing, and we need answers.”

Facebook has been roundly criticized for being slow to acknowledge a vast disinformation campaign run by Russian operatives on its platform and other social media outlets before the 2016 presidential election.

Ms. Sandberg, Facebook’s chief operating officer, testified in a Senate hearing that month about what the company was trying to do to prevent the same thing from happening in midterm elections in November.

In April, Mr. Zuckerberg testified about revelations that Cambridge Analytica, the British analytics firm that worked with the Trump presidential campaign, siphoned personal information of millions of Facebook users.

Outside the United States, the impact of disinformation appearing on Facebook and the popular messaging service it owns, WhatsApp, has been severe. In countries such as Myanmar and India, false rumors spread on social media are believed to have led to widespread killing.

Facebook said the attackers had exploited two bugs in the site’s “View As” feature, which allows users to check on what information other people can see about them. The feature was built to give users move control over their privacy.

The company said those flaws were compounded by a bug in Facebook’s video-uploading program for birthday celebrations, a software feature that was introduced in July 2017. The flaw allowed the attackers to steal so-called access tokens — digital keys that allow access to an account.

It is not clear when the attack happened, but it appears to have occurred after the video-uploading program was introduced, Facebook said. The company forced more than 90 million users to log out early Friday, a common safety measure taken when accounts have been compromised.

The hackers also tried to harvest people’s private information, including name, sex and hometown, from Facebook’s systems, Mr. Rosen said. The company could not determine the extent of the attackers’ access to third-party accounts, he said.

Facebook has been reshuffling its security teams since Alex Stamos, its chief security officer, left in August for a teaching position at Stanford University. Instead of acting as a stand-alone group, security team members now work more closely with product teams across the company. The move, the company said, is an effort to embed security across every step of Facebook product development.

Part of that effort has been to gird Facebook against attacks on its network in preparation for the midterm elections. Facebook has spent months setting up new systems to pre-empt such attacks, and has already dealt with a number of incidents believed to be connected to elections in Mexico, Brazil and other countries.

Still, the recently discovered breach was a reminder that it is exceptionally difficult to entirely secure a system that has more than 2.2 billion users all over the world and that connects with thousands of third-party services.

“This has really shown us that because today’s digital environment is so complex, a compromise on a single platform — especially one as popular and widely reaching as Facebook — can have consequences that are much more far-reaching than what we can tell in early days of the investigation,” said April Doss, chairwoman of cybersecurity at the law firm Saul Ewing.

As the news of Facebook’s data breach spread quickly across Twitter, Google searches and other online sites, there was one place where it remained difficult to find some detailed reports: Facebook.

Users who posted breaking stories about the breach from The Guardian, The Associated Press and other outlets were prompted with a notice that their posts had been taken down. So many people were posting the stories, they looked like suspicious activity to the systems that Facebook uses to block abuse of its network.

“We removed this post because it looked like spam to us,” the notice said.

Encryption

"Encrypt" redirects here. For the film, see Encrypt (film).

This article is about algorithms for encryption and decryption. For an overview of cryptographic technology in general, see Cryptography. For the album by Pro-jekt, see Encryption (album).

In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot. Encryption does not itself prevent interference, but denies the intelligible content to a would-be interceptor. In an encryption scheme, the intended information or message, referred to as plaintext, is encrypted using an encryption algorithm – a cipher – generating ciphertext that can be read only if decrypted. For technical reasons, an encryption scheme usually uses a pseudo-random encryption key generated by an algorithm. It is in principle possible to decrypt the message without possessing the key, but, for a well-designed encryption scheme, considerable computational resources and skills are required. An authorized recipient can easily decrypt the message with the key provided by the originator to recipients but not to unauthorized users.

Types[edit]

Symmetric key / Private key[edit]

In symmetric-key schemes,^[1] the encryption and decryption keys are the same. Communicating parties must have the same key in order to achieve secure communication.

Public key[edit]

Illustration of how encryption is used within servers Public key encryption.

In public-key encryption schemes, the encryption key is published for anyone to use and encrypt messages. However, only the receiving party has access to the decryption key that enables messages to be read.^[2] Public-key encryption was first described in a secret document in 1973;^[3] before then all encryption schemes were symmetric-key (also called private-key).^[4]:478. Although published subsequently, the work of Diffie and Hellman, was published in a journal with a large readership, and the value of the methodology was explicitly described ^[5]and the method became known as the Diffie Hellman key exchange.

A publicly available public key encryption application called Pretty Good Privacy (PGP) was written in 1991 by Phil Zimmermann, and distributed free of charge with source code; it was purchased by Symantec in 2010 and is regularly updated.^[6]

Uses[edit]

Encryption has long been used by militaries and governments to facilitate secret communication. It is now commonly used in protecting information within many kinds of civilian systems. For example, the Computer Security Institute reported that in 2007, 71% of companies surveyed utilized encryption for some of their data in transit, and 53% utilized encryption for some of their data in storage.^[7] Encryption can be used to protect data "at rest", such as information stored on computers and storage devices (e.g. USB flash drives). In recent years, there have been numerous reports of confidential data, such as customers' personal records, being exposed through loss or theft of laptops or backup drives; encrypting such files at rest helps protect them if physical security measures fail.^[8][9][10] Digital rights management systems, which prevent unauthorized use or reproduction of copyrighted material and protect software against reverse engineering (see also copy protection), is another somewhat different example of using encryption on data at rest.^[11]

In response to encryption of data at rest, cyber-adversaries have developed new types of attacks. These more recent threats to encryption of data at rest include cryptographic attacks,^[12] stolen ciphertext attacks,^[13] attacks on encryption keys,^[14] insider attacks, data corruption or integrity attacks,^[15] data destruction attacks, and ransomware attacks. Data fragmentation^[16] and active defense^[17] data protection technologies attempt to counter some of these attacks, by distributing, moving, or mutating ciphertext so it is more difficult to identify, steal, corrupt, or destroy.^[18]

Encryption is also used to protect data in transit, for example data being transferred via networks (e.g. the Internet, e-commerce), mobile telephones, wireless microphones, wireless intercom systems, Bluetooth devices and bank automatic teller machines. There have been numerous reports of data in transit being intercepted in recent years.^[19] Data should also be encrypted when transmitted across networks in order to protect against eavesdropping of network traffic by unauthorized users.^[20]

Message verification[edit]

Encryption, by itself, can protect the confidentiality of messages, but other techniques are still needed to protect the integrity and authenticity of a message; for example, verification of a message authentication code (MAC) or a digital signature. Standards for cryptographic software and hardware to perform encryption are widely available, but successfully using encryption to ensure security may be a challenging problem. A single error in system design or execution can allow successful attacks. Sometimes an adversary can obtain unencrypted information without directly undoing the encryption. See, e.g., traffic analysis, TEMPEST, or Trojan horse.^[21]

Digital signature and encryption must be applied to the ciphertext when it is created (typically on the same device used to compose the message) to avoid tampering; otherwise any node between the sender and the encryption agent could potentially tamper with it. Encrypting at the time of creation is only secure if the encryption device itself has not been tampered with.

Data erasure[edit]

Conventional methods for deleting data permanently from a storage device involve overwriting its whole content with zeros, ones or other patterns – a process which can take a significant amount of time, depending on the capacity and the type of the medium. Cryptography offers a way of making the erasure almost instantaneous. This method is called crypto-shredding. An example implementation of this method can be found on iOS devices, where the cryptographic key is kept in a dedicated 'Effaceable Storage'.^[22] Because the key is stored on the same device, this setup on its own does not offer full confidentiality protection in case an unauthorised person gains physical access to the device.

Computer Security Institute

The Computer Security Institute (CSI) was a professional membership organization serving practitioners of information, network, and computer-enabled physical security, from the level of system administrator to the chief information security officer. It was founded in 1974.^[1]

CSI used to conduct two conferences per year — the Annual Computer Security Conference and Exhibition and CSI SX. Internet entrepreneur Jimmy Wales was a keynote speaker at CSI’s Annual Conference, held November 6–8, 2006, in Orlando, Florida.^[2]

CSI is perhaps best known for the annual CSI/FBI Computer Crime and Security Survey that it began to conduct in 1996 in collaboration with the San Francisco Federal Bureau of Investigation's Computer Intrusion Squad and researchers from the Robert H. Smith School of Business at the University of Maryland.^[3][4][5]The FBI disappeared from the title of the study between the 2006 and 2007 reports. The 15th annual survey, which turned out to be the last, was released in 2011, and is available to the general public at Information Week.

CSI staff, including Richard Power, testified as expert witnesses before United States Senate committee hearings.^[6]

In 2011, CSI was absorbed by UBM ^[7] although no mention of this appears on the UBM Wikipedia page. As of September 2014, the original CSI website returns a 404 File Not Found error. Snapshots of the website can be found on the WayBack Time Machine.^[8]

Digital rights management

Digital rights management (DRM) is a set of access control technologies for restricting the use of proprietary hardware and copyrighted works.^[1] DRM technologies try to control the use, modification, and distribution of copyrighted works (such as software and multimedia content), as well as systems within devices that enforce these policies.^[2]

The use of digital rights management is not universally accepted. Proponents of DRM argue that it is necessary to prevent intellectual property from being copied freely, just as physical locks are needed to prevent personal property from being stolen,^[3] that it can help the copyright holder maintain artistic control,^[4] and that it can ensure continued revenue streams.^[5] Those opposed to DRM contend there is no evidence that DRM helps prevent copyright infringement, arguing instead that it serves only to inconvenience legitimate customers, and that DRM helps big business stifle innovation and competition.^[6] Furthermore, works can become permanently inaccessible if the DRM scheme changes or if the service is discontinued.^[7] DRM can also restrict users from exercising their legal rights under the copyright law, such as backing up copies of CDs or DVDs (instead having to buy another copy, if it can still be purchased), lending materials out through a library, accessing works in the public domain, or using copyrighted materials for research and education under the fair use doctrine.^[3] The Electronic Frontier Foundation (EFF) and the Free Software Foundation (FSF) consider the use of DRM systems to be an anti-competitive practice.^[8][9]

Worldwide, many laws have been created which criminalize the circumvention of DRM, communication about such circumvention, and the creation and distribution of tools used for such circumvention. Such laws are part of the United States' Digital Millennium Copyright Act,^[10] and the European Union's Copyright Directive,^[11] (the French DADVSI is an example of a member state of the European Union ("EU") implementing the directive).^[12]

Introduction[edit]

The rise of digital media and analog-to-digital conversion technologies has vastly increased the concerns of copyright-owning individuals and organizations, particularly within the music and movie industries. While analog media inevitably lost quality with each copy generation, and in some cases even during normal use, digital media files may be duplicated an unlimited number of times with no degradation in the quality.

The rise of personal computers as household appliances has made it convenient for consumers to convert media (which may or may not be copyrighted) originally in a physical, analog or broadcast form into a universal, digital form (this process is called ripping) for portability or viewing later. This, combined with the Internet and popular file-sharing tools, has made unauthorized distribution of copies of copyrighted digital media (also called digital piracy) much easier.

In 1983, a very early implementation of Digital Rights Management (DRM) was the Software Service System (SSS) devised by the Japanese engineer Ryuichi Moriya. ^[13] and subsequently refined under the name superdistribution. The SSS was based on encryption, with specialized hardware that controlled decryption and also enabled payments to be sent to the copyright holder. The underlying principle of the SSS and subsequently of superdistribution was that the distribution of encrypted digital products should be completely unrestricted and that users of those products would not just be permitted to redistribute them but would actually be encouraged to do so.

Common DRM techniques include restrictive licensing agreements: The access to digital materials, copyright and public domain is restricted to consumers as a condition of entering a website or when downloading software.^[14] Encryption, scrambling of expressive material and embedding of a tag, which is designed to control access and reproduction of information, including backup copies for personal use.^[15]

DRM technologies enable content publishers to enforce their own access policies on content, such as restrictions on copying or viewing. These technologies have been criticized for restricting individuals from copying or using the content legally, such as by fair use. DRM is in common use by the entertainment industry (e.g., audio and video publishers).^[16] Many online music stores, such as Apple's iTunes Store, and e-book publishers and vendors, such as OverDrive, also use DRM, as do cable and satellite service operators, to prevent unauthorized use of content or services. However, Apple dropped DRM from all iTunes music files around 2009.^[17]

Industry has expanded the usage of DRM to more traditional hardware products, such as Keurig's coffeemakers,^[18][19] Philips' light bulbs,^[20][21] mobile device power chargers,^[22][23][24] and John Deere's tractors.^[25] For instance, tractor companies try to prevent farmers from making DIY repairs under usage of DRM-laws as DMCA.^[26]

Technologies[edit]

Computer games[edit]

Limited install activations[edit]

Computer games sometimes use DRM technologies to limit the number of systems the game can be installed on by requiring authentication with an online server. Most games with this restriction allow three or five installs, although some allow an installation to be 'recovered' when the game is uninstalled. This not only limits users who have more than three or five computers in their homes (seeing as the rights of the software developers allow them to limit the number of installations), but can also prove to be a problem if the user has to unexpectedly perform certain tasks like upgrading operating systems or reformatting the computer's hard drive, tasks which, depending on how the DRM is implemented, count a game's subsequent reinstall as a new installation, making the game potentially unusable after a certain period even if it is only used on a single computer.

In mid-2008, the publication of Mass Effect marked the start of a wave of titles primarily making use of SecuROM for DRM and requiring authentication with a server. The use of the DRM scheme in 2008's Spore backfired and there were protests, resulting in a considerable number of users seeking an unlicensed version instead. This backlash against the three-activation limit was a significant factor in Spore becoming the most pirated game in 2008, with TorrentFreak compiling a "top 10" list with Spore topping the list.^[27][28] However, Tweakguides concluded that the presence of intrusive DRM does not appear to increase the cracking of a game, noting that other games on the list such as Call of Duty 4 and Assassin's Creed use SafeDisc DRM, which has no install limits and no online activation. Additionally, other video games that use intrusive DRM such as BioShock, Crysis Warhead, and Mass Effect, do not appear on the list.^[29]

Persistent online authentication[edit]

Main article: Always-on DRM

Many mainstream publishers continued to rely on online DRM throughout the later half of 2008 and early 2009, including Electronic Arts, Ubisoft, Valve, and Atari, The Sims 3 being a notable exception in the case of Electronic Arts.^[30] Ubisoft broke with the tendency to use online DRM in late 2008, with the release of Prince of Persia as an experiment to "see how truthful people really are" regarding the claim that DRM was inciting people to use illegal copies.^[31] Although Ubisoft has not commented on the results of the "experiment", Tweakguides noted that two torrents on Mininova had over 23,000 people downloading the game within 24 hours of its release.^[32]

Ubisoft formally announced a return to online authentication on 9 February 2010, through its Uplay online gaming platform, starting with Silent Hunter 5, The Settlers 7, and Assassin's Creed II.^[33] Silent Hunter 5 was first reported to have been compromised within 24 hours of release,^[34] but users of the cracked version soon found out that only early parts of the game were playable.^[35] The Uplay system works by having the installed game on the local PCs incomplete and then continuously downloading parts of the game-code from Ubisoft's servers as the game progresses.^[36] It was more than a month after the PC release in the first week of April that software was released that could bypass Ubisoft's DRM in Assassin's Creed II. The software did this by emulating a Ubisoft server for the game. Later that month, a real crack was released that was able to remove the connection requirement altogether.^[37][38]

In early March 2010, the Uplay servers suffered a period of inaccessibility due to a large-scale DDoS attack, causing around 5% of game owners to become locked out of playing their game.^[39] The company later credited owners of the affected games with a free download, and there has been no further downtime.^[40]

Other developers, such as Blizzard Entertainment are also shifting to a strategy where most of the game logic is on the "side" or taken care of by the servers of the game maker. Blizzard uses this strategy for its game Diablo III and Electronic Arts used this same strategy with their reboot of SimCity, the necessity of which has been questioned.^[41]

Software tampering[edit]

Bohemia Interactive have used a form of technology since Operation Flashpoint: Cold War Crisis, wherein if the game copy is suspected of being unauthorized, annoyances like guns losing their accuracy or the players being turned into a bird are introduced.^[42]

Croteam, the company that released Serious Sam 3: BFE in November 2011, implemented a different form of DRM wherein, instead of displaying error messages that stop the illicit version of the game from running, it causes a special invincible foe in the game to appear and constantly attack the player until he or she is killed.^[43][44]

Product keys[edit]

One of the oldest and least complicated DRM protection methods for computer and Nintendo Entertainment System games was when the game would pause and prompt the player to look up a certain page in a booklet or manual that came with the game; if the player lacked access to such material, they would not be able to continue the game. A product key, a typically alphanumerical serial number used to represent a license to a particular piece of software, serve a similar function. During the installation process or launch for the software, the user is asked to input the key; if the key correctly corresponds to a valid license (typically via internal algorithms), the key is accepted, then the user who bought the game can continue. In modern practice, product keys are typically combined with other DRM practices (such as online "activation"), as the software could be cracked to run without a product key, or "keygen" programs could be developed to generate keys that would be accepted.

Documents[edit]

Enterprise digital rights management (E-DRM or ERM) is the application of DRM technology to the control of access to corporate documents such as Microsoft Word, PDF, and AutoCAD files, emails, and intranet web pages rather than to the control of consumer media.^[45] E-DRM, now more commonly termed IRM (Information Rights Management), is generally intended to prevent the unauthorized use (such as industrial or corporate espionage or inadvertent release) of proprietary documents. IRM typically integrates with content management system software but corporations such as Samsung Electronics also develop their own custom DRM systems.^[46]

DRM has been used by organizations such as the British Library in its secure electronic delivery service to permit worldwide access to substantial numbers of rare (and in many cases unique) documents which, for legal reasons, were previously only available to authorized individuals actually visiting the Library's document centre at Boston Spa in England.^[47][48][49]

E-books[edit]

Electronic books read on a personal computer, or an e-book reader or e-reader app typically use DRM technology to limit copying, printing, and sharing of e-books. E-books are usually limited to be used on a limited number of reading devices, and some e-publishers prevent any copying or printing. Some commentors believe DRM makes e-book publishing complex.^[50]

As of August 2012, there were five main e-book formats: EPUB, KF8, Mobipocket, PDF, and Topaz.^[51] The Amazon Kindle uses KF8, Mobipocket, and Topaz; it also supports native PDF format e-books and native PDF files. Other e-book readers mostly use EPUB format e-books, but with differing DRM schemes.^{[citation needed]}

There are four main e-book DRM schemes in common use today, one each from Adobe, Amazon, Apple, and the Marlin Trust Management Organization (MTMO).

• Adobe's ADEPT DRM is applied to EPUBs and PDFs, and can be read by several third-party e-book readers, as well as Adobe Digital Editions (ADE) software. Barnes & Nobleuses a DRM technology provided by Adobe, applied to EPUBs and the older PDB (Palm OS) format e-books. In October 2014, Adobe released version 4.0.1 of the software, which sends data to Adobe in a secure transmission (using HTTPS).^[52]
• Amazon's DRM is an adaption of the original Mobipocket encryption and is applied to Amazon's .azw4, KF8, and Mobipocket format e-books. Topaz format e-books have their own encryption system.^[53]
• Apple's FairPlay DRM is applied to EPUBs and can currently only be read by Apple's iBooks app on iOS devices and Mac OS computers.^{[citation needed]}
• The Marlin DRM was developed and is maintained in an open industry group known as the Marlin Developer Community (MDC) and is licensed by MTMO. (Marlin was founded by five companies, Intertrust, Panasonic, Philips, Samsung, and Sony.) The Kno online textbook publisher uses Marlin to protect e-books it sells in the EPUB format. These books can be read on the Kno App for iOS and Android.

In one instance of DRM that caused a rift with consumers, Amazon.com in July 2009, remotely deleted purchased copies of George Orwell's Animal Farm (1945) and Nineteen Eighty-Four (1949) from customers' Amazon Kindles after providing them a refund for the purchased products.^[54] Commentors have described these actions as Orwellian and have compared Amazon to Big Brother from Orwell's Nineteen Eighty-Four.^{[55][56][57][58]} After Amazon CEO Jeff Bezos issued a public apology, the Free Software Foundation wrote that this was just one more example of the excessive power Amazon has to remotely censor what people read through its software, and called upon Amazon to free its e-book reader and drop DRM.^[59] Amazon then revealed the reason behind its deletion: the e-books in question were unauthorized reproductions of Orwell's works, which were not within the public domain and to which the company that published and sold them on Amazon's service had no rights.^[60]

Websites – such as library.nu (shut down by court order on 15 February 2012), BookFi, BookFinder, Library Genesis, and Science Hub – have emerged which allow downloading e-books by violating copyright.^{[61][62][63][64]}

Film[edit]

An early example of a DRM system is the Content Scrambling System (CSS) employed by the DVD Forum on film DVDs circa 1996. CSS uses an encryption algorithm to encrypt content on the DVD disc. Manufacturers of DVD players must license this technology and implement it in their devices so that they can decrypt the encrypted content to play it. The CSS license agreement includes restrictions on how the DVD content is played, including what outputs are permitted and how such permitted outputs are made available. This keeps the encryption intact as the video material is played out to a TV.

In 1999, Jon Lech Johansen released an application called DeCSS, which allowed a CSS-encrypted DVD to play on a computer running the Linux operating system, at a time when no licensed DVD player application for Linux had yet been created. The legality of DeCSS is questionable: one of the authors has been the subject of a lawsuit, and reproduction of the keys themselves is subject to restrictions as illegal numbers.^[65]

Also in 1999, Microsoft released Windows Media DRM, which read instructions from media files in a rights management language that stated what the user may do with the media.^[66] The language can define how many times the media file can be played, and whether or not it can be burned to a CD, forwarded, printed, or saved to the local disk.^[67] Later versions of Windows Media DRM also allow producers to declare whether or not the user may transfer the media file to other devices,^[68] to implement music subscription services that make downloaded files unplayable after subscriptions are cancelled, and to implement regional lockout.^[69]

The Microsoft operating system, Windows Vista, contains a DRM system called the Protected Media Path, which contains the Protected Video Path (PVP). PVP tries to stop DRM-restricted content from playing while unsigned software is running, in order to prevent the unsigned software from accessing the content. Additionally, PVP can encrypt information during transmission to the monitor or the graphics card, which makes it more difficult to make unauthorized recordings.

Advanced Access Content System (AACS) is a DRM system for HD DVD and Blu-ray Discs developed by the AACS Licensing Administrator, LLC (AACS LA), a consortium that includes Disney, IBM, Intel, Microsoft, Matsushita (Panasonic), Sony, Toshiba, and Warner Brothers. In December 2006, hackers published a process key online, which enabled unrestricted access to AACS-protected HD DVD content.^[70] After the cracked keys were revoked, further cracked keys were released.^[71]

Marlin (DRM) is a technology that is developed and maintained in an open industry group known as the Marlin Developer Community (MDC) and licensed by the Marlin Trust Management Organization (MTMO). Founded in 2005, by five companies: Intertrust, Panasonic, Philips, Samsung, and Sony, Marlin DRM has been deployed in multiple places around the world. In Europe, Philips NetTVs implement Marlin DRM. Also in Europe, Marlin DRM is required in such industry groups as the Open IPTV Forum and national initiatives such as HDForum in France, Tivu in Italy, and YouView in the UK, and which are starting to see broad deployments. In Japan, the acTVila IPTV service uses Marlin to encrypt video streams, which are permitted to be recorded on a DVR in the home.

OMA DRM is a system invented by the Open Mobile Alliance, whose members represent information technology companies (e.g., IBM and Microsoft), mobile phone network operators (e.g., Cingular, Deutsche Telekom, Orange, O2, and Vodafone), mobile phone manufacturers (e.g., LG, Motorola, Samsung, and Sony), mobile system manufacturers (e.g., Ericsson and Openwave).

Music[edit]

Audio CDs[edit]

Discs with DRM schemes are not standards-compliant Compact Discs (CDs) but are rather CD-ROM media. Therefore, they all lack the CD logotype found on discs which follow the standard (known as Red Book). These CDs cannot be played on all CD players or personal computers. Personal computers running Microsoft Windows sometimes even crash when attempting to play the CDs.^[72]

In 2005, Sony BMG introduced new DRM technology which installed DRM software on users' computers without clearly notifying the user or requiring confirmation. Among other things, the installed software included a rootkit, which created a severe security vulnerability others could exploit. When the nature of the DRM involved was made public much later, Sony BMG initially minimized the significance of the vulnerabilities its software had created, but was eventually compelled to recall millions of CDs, and released several attempts to patch the surreptitiously included software to at least remove the rootkit. Several class action lawsuits were filed, which were ultimately settled by agreements to provide affected consumers with a cash payout or album downloads free of DRM.^[73]

Sony BMG's DRM software actually had only a limited ability to prevent copying, as it affected only playback on Windows computers, not on other equipment. Even on the Windows platform, users regularly bypassed the restrictions. And, while the Sony BMG DRM technology created fundamental vulnerabilities in customers' computers, parts of it could be trivially bypassed by holding down the "shift" key while inserting the CD, or by disabling the autorun feature. In addition, audio tracks could simply be played and re-recorded, thus completely bypassing all the DRM (this is known as the analog hole). Sony BMG's first two attempts at releasing a patch which would remove the DRM software from users' computers failed.

In January 2007, EMI stopped publishing audio CDs with DRM, stating that "the costs of DRM do not measure up to the results."^[74] Following EMI, Sony BMG was the last publisher to abolish DRM completely, and audio CDs containing DRM are no longer released by the four largest commercial record label companies.^[75]

Internet music[edit]

Many internet music stores employ DRM to restrict usage of music purchased and downloaded.

• Prior to 2009, Apple's iTunes Store utilized the FairPlay DRM system for music. Apple did not license its DRM to other companies, so only Apple devices and Apple's QuickTimemedia player could play iTunes music.^[7][69] In May 2007, EMI tracks became available in iTunes Plus format at a higher price. These tracks were higher quality (256 kbit/s) and DRM free. In October 2007, the cost of iTunes Plus tracks was lowered to US$0.99.^[76] In April 2009, all iTunes music became available completely DRM-free. (Videos sold and rented through iTunes, as well as iOS Apps, however, were to continue using Apple's FairPlay DRM.)
• Napster music store offers a subscription-based approach to DRM alongside permanent purchases. Users of the subscription service can download and stream an unlimited amount of music transcoded to Windows Media Audio (WMA) while subscribed to the service. But when the subscription period lapses, all the downloaded music is unplayable until the user renews his or her subscription. Napster also charges users who wish to use the music on their portable device an additional $5 per month. In addition, Napster gives users the option of paying an additional $0.99 per track to burn it to CD or for the song to never expire. Music bought through Napster can be played on players carrying the Microsoft PlaysForSure logo (which, notably, do not include iPods or even Microsoft's own Zune). As of June 2009, Napster is offering DRM free MP3 music, which can be played on iPhones and iPods.
• Wal-Mart Music Downloads, another music download store, charges $0.94 per track for all non-sale downloads. All Wal-Mart downloads are able to be played on any Windows PlaysForSure marked product. The music does play on the SanDisk's Sansa mp3 player, for example, but must be copied to the player's internal memory. It cannot be played through the player's microSD card slot, which is a problem that many users of the mp3 player experience.
• Sony operated a music download service called "Connect" which used Sony's proprietary OpenMG DRM technology. Music downloaded from this store (usually via Sony's SonicStage software) was only playable on computers running Microsoft Windows and Sony hardware (including the PSP and some Sony Ericsson phones).
• Kazaa is one of a few services offering a subscription-based pricing model. However, music downloads from the Kazaa website are DRM-protected and can only be played on computers or portable devices running Windows Media Player, and only as long as the customer remains subscribed to Kazaa.

The various services are currently not interoperable, though those that use the same DRM system (for instance the several Windows Media DRM format stores, including Napster, Kazaa and Yahoo Music) all provide songs that can be played side-by-side through the same player program. Almost all stores require client software of some sort to be downloaded, and some also need plug-ins. Several colleges and universities, such as Rensselaer Polytechnic Institute, have made arrangements with assorted Internet music suppliers to provide access (typically DRM-restricted) to music files for their students, to less than universal popularity, sometimes making payments from student activity fee funds.^[77] One of the problems is that the music becomes unplayable after leaving school unless the student continues to pay individually. Another is that few of these vendors are compatible with the most common portable music player, the Apple iPod. The Gowers Review of Intellectual Property (to HMG in the UK; 141 pages, 40+ specific recommendations) has taken note of the incompatibilities, and suggests (Recommendations 8—12) that there be explicit fair dealing exceptions to copyright allowing libraries to copy and format-shift between DRM schemes, and further allowing end users to do the same privately. If adopted, some acrimony may decrease.

Although DRM is prevalent for Internet music, some online music stores such as eMusic, Dogmazic, Amazon, and Beatport, do not use DRM despite encouraging users to avoid sharing music. Major labels have begun releasing more music without DRM. Eric Bangeman suggests in Ars Technica that this is because the record labels are "slowly beginning to realize that they can't have DRMed music and complete control over the online music market at the same time... One way to break the cycle is to sell music that is playable on any digital audio player. eMusic does exactly that, and their surprisingly extensive catalog of non-DRMed music has vaulted it into the number two online music store position behind the iTunes Store."^[78] Apple's Steve Jobs called on the music industry to eliminate DRM in an open letter titled Thoughts on Music.^[79] Apple's iTunes Store will start to sell DRM-free 256 kbit/s (up from 128 kbit/s) AAC encoded music from EMI for a premium price (this has since reverted to the standard price).

In March 2007, Musicload.de, one of Europe's largest internet music retailers, announced their position strongly against DRM. In an open letter, Musicload stated that three out of every four calls to their customer support phone service are as a result of consumer frustration with DRM.^[80]

Mobile ring tones[edit]

The Open Mobile Alliance created a standard for interoperable DRM on mobile devices. The first version of OMA DRM consisted of a simple rights management language and was widely used to protect mobile phone ringtones from being copied from the phone to other devices. Later versions expanded the rights management language to similar expressiveness as Fairplay, but did not become widely used.^[69]

Television[edit]

The CableCard standard is used by cable television providers in the United States to restrict content to services to which the customer has subscribed.

The broadcast flag concept was developed by Fox Broadcasting in 2001, and was supported by the MPAA and the U.S. Federal Communications Commission (FCC). A ruling in May 2005, by a United States courts of appeals held that the FCC lacked authority to impose it on the TV industry in the US. It required that all HDTVs obey a stream specification determining whether a stream can be recorded. This could block instances of fair use, such as time-shifting. It achieved more success elsewhere when it was adopted by the Digital Video Broadcasting Project (DVB), a consortium of about 250 broadcasters, manufacturers, network operators, software developers, and regulatory bodies from about 35 countries involved in attempting to develop new digital TV standards.

An updated variant of the broadcast flag has been developed in the Content Protection and Copy Management group under DVB (DVB-CPCM). Upon publication by DVB, the technical specification was submitted to European governments in March 2007. As with much DRM, the CPCM system is intended to control use of copyrighted material by the end-user, at the direction of the copyright holder. According to Ren Bucholz of the EFF, which paid to be a member of the consortium, "You won't even know ahead of time whether and how you will be able to record and make use of particular programs or devices".^[81] The normative sections have now all been approved for publication by the DVB Steering Board, and will be published by ETSI as a formal European Standard as ETSI TS 102 825-X where X refers to the Part number of specification. Nobody has yet stepped forward to provide a Compliance and Robustness regime for the standard (though several are rumoured to be in development), so it is not presently possible to fully implement a system, as there is nowhere to obtain the necessary device certificates.

Metadata[edit]

Sometimes, metadata is included in purchased media which records information such as the purchaser's name, account information, or email address. Also included may be the file's publisher, author, creation date, download date, and various notes. This information is not embedded in the played content, like a watermark, but is kept separate, but within the file or stream.

As an example, metadata is used in media purchased from Apple's iTunes Store for DRM-free as well as DRM-restricted versions of their music or videos. This information is included as MPEG standard metadata.^[82][83]

Watermarks[edit]

Digital watermarks exist since 1992. They are steganographically embedded within audio or video data during production or distribution. They can be used for recording the copyright owner, the distributor, the distribution chain or identifying the purchaser of the music.^{[citation needed]}

Watermarks are not complete DRM mechanisms in their own right, but are used as part of a system for copyright enforcement, such as helping provide prosecution evidence for legal purposes, rather than direct technological restriction. Some programs used to edit video and/or audio may distort, delete, or otherwise interfere with watermarks. Signal/modulator-carrier chromatography may also separate watermarks from original audio or detect them as glitches. Additionally, comparison of two separately obtained copies of audio using simple, home-grown algorithms can often reveal watermarks.^{[citation needed]}

Streaming media services[edit]

Since the late-2000s the trend in media consumption has been towards renting content using online streaming services, for example Spotify for music and Netflix for video content. Copyright holders often require that these services protect the content they licence using DRM mechanisms.

Laws[edit]

This section needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. (May 2014) (Learn how and when to remove this template message)

The examples and perspective in this section may not represent a worldwide view of the subject. You may improve this article, discuss the issue on the talk page, or create a new article, as appropriate. (November 2012) (Learn how and when to remove this template message)

The 1996 World Intellectual Property Organization Copyright Treaty (WCT) requires nations to enact laws against DRM circumvention, and has been implemented in most member states of the World Intellectual Property Organization.

The United States implementation is the Digital Millennium Copyright Act (DMCA), while in Europe the treaty has been implemented by the 2001 European directive on copyright, which requires member states of the European Union to implement legal protections for technological prevention measures. In 2006, the lower house of the French parliament adopted such legislation as part of the controversial DADVSI law, but added that protected DRM techniques should be made interoperable, a move which caused widespread controversy in the United States. The Tribunal de grande instance de Paris concluded in 2006, that the complete blocking of any possibilities of making private copies was an impermissible behaviour under French copyright law.^[84]

China[edit]

In 1998 "Interim Regulations" were founded in China, referring to the DMCA.^[85] China also has Intellectual Property Rights, which to the World Trade Organization, was "not in compliance with the Berne Convention".^[85] The WTO panel "determined that China's copyright laws do not provide the same efficacy to non- Chinese nationals as they do to Chinese citizens, as required by the Berne Convention". and that "China's copyright laws do not provide enforcement procedures so as to permit effective action against any act of infringement of intellectual property rights".^[85] Because China has a form of DMCA and or copyright laws, it is assumed they are using some kind of technology to enforce those laws, however there is no mention of specific DRM technology.^{[citation needed]}

European Union[edit]

On 22 May 2001, the European Union passed the EU Copyright Directive, an implementation of the 1996 WIPO Copyright Treaty, that addressed many of the same issues as the DMCA.

On 25 April 2007, the European Parliament supported the first directive of EU, which aims to harmonize criminal law in the member states. It adopted a first reading report on harmonizing the national measures for fighting copyright abuse. If the European Parliament and the Council approve the legislation, the submitted directive will oblige the member states to consider a crime a violation of international copyright committed with commercial purposes. The text suggests numerous measures: from fines to imprisonment, depending on the gravity of the offense. The EP members supported the Commission motion, changing some of the texts. They excluded patent rights from the range of the directive and decided that the sanctions should apply only to offenses with commercial purposes. Copying for personal, non-commercial purposes was also excluded from the range of the directive.

In 2012, the Court of Justice of the European Union ruled in favor of reselling copyrighted games, prohibiting any preventative action that would prevent such transaction.^[86] The court said that "The first sale in the EU of a copy of a computer program by the copyright holder or with his consent exhausts the right of distribution of that copy in the EU. A rightholder who has marketed a copy in the territory of a Member State of the EU thus loses the right to rely on his monopoly of exploitation in order to oppose the resale of that copy."^[87]

In 2014, the Court of Justice of the European Union ruled that circumventing DRM on game devices may be legal under some circumstances, limiting the legal protection to only cover technological measures intended to prevent or eliminate unauthorised acts of reproduction, communication, public offer or distribution.^[88][89]

India[edit]

India is not a signatory to WIPO Copyright Treaty nor the WIPO Performances and Phonograms Treaty^[90]. However, as a part of its 2012 amendment of copyright laws, it implemented digital rights management protection^[91]. Section 65A of Copyright Act, 1957 imposed criminal sanctions on circumvention of "effective technological protection measures"^[92]. Section 65B criminalized interference with digital rights management information. Any distribution of copies whose rights management information was modified was also criminalized by Section 65B^[92]. The terms used in the provisions were not specifically defined, with the concerned Parliamentary Standing Committee indicating the same to have been deliberate. The Standing Committee noted that similar terms in developed terms were used to considerable complexity and therefore in light of the same, it was preferable to keep it open-ended^[92].

A prison sentence is mandatory under both provisions, with a maximum term of 2 years in addition to fine, which is discretionary. While the statute doesn't include exceptions to copyright infringement, including fair use directly, Section 65A allows measures "unless they are expressly prohibited", which may implicitly include such exceptions^[91]. Section 65B however, lacks any exceptions^[93]. Further. Section 65B (digital rights management information) allows resort to other civil provisions, unlike Section 65A^[93][92].

It is important to note that the WIPO Internet Treaties themselves do not mandate criminal sanctions, merely requiring "effective legal remedies"^[94]. Thus, India's adoption of criminal sanctions ensures compliance with the highest standards of the WIPO internet treaties. Given the 2012 amendment, India's entry to the WIPO Internet Treaties appears facilitated^[95], especially since ratification of the WIPO Internet Treaties is mandatory under agreements like the RCEP^[91].

Israel[edit]

As of 2014 Israel had not ratified the WIPO Copyright Treaty. Israeli law does not currently expressly prohibit the circumvention of technological measures used to implement digital rights management. In June 2012 The Israeli Ministry of Justice proposed a bill to prohibit such activities, but the Knesset did not pass it. In September 2013, the Supreme Court ruled that the current copyright law could not be interpreted to prohibit the circumvention of digital rights management, though the Court left open the possibility that such activities could result in liability under the law of unjust enrichment.^[96]

United States[edit]

Main article: Digital Millennium Copyright Act

In May 1998, the Digital Millennium Copyright Act (DMCA) passed as an amendment to US copyright law, which criminalizes the production and dissemination of technology that lets users circumvent technical copy-restriction methods.(For a more detailed analysis of the statute, see WIPO Copyright and Performances and Phonograms Treaties Implementation Act.)

Reverse engineering of existing systems is expressly permitted under the Act under the specific condition of a safe harbor, where circumvention is necessary to achieve interoperability with other software . See 17 U.S.C. Sec. 1201(f). Open-source software to decrypt content scrambled with the Content Scrambling System and other encryption techniques presents an intractable problem with the application of the Act. Much depends on the intent of the actor. If the decryption is done for the purpose of achieving interoperability of open source operating systems with proprietary operating systems, it would be protected by Section 1201(f) the Act. Cf., Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001) at notes 5 and 16. However, dissemination of such software for the purpose of violating or encouraging others to violate copyrights has been held illegal. See Universal City Studios, Inc. v. Reimerdes, 111 F. Supp. 2d 346 (S.D.N.Y. 2000).

The DMCA has been largely ineffective in protecting DRM systems,^[97] as software allowing users to circumvent DRM remains widely available. However, those who wish to preserve the DRM systems have attempted to use the Act to restrict the distribution and development of such software, as in the case of DeCSS.

Although the Act contains an exception for research, the exception is subject to vague qualifiers that do little to reassure researchers. Cf., 17 U.S.C. Sec. 1201(g). The DMCA has affected cryptography, because many^[who?] fear that cryptanalytic research may violate the DMCA. In 2001, the arrest of Russian programmer Dmitry Sklyarov for alleged infringement of the DMCA was a highly publicized example of the law's use to prevent or penalize development of anti-DRM measures. He was arrested in the US after a presentation at DEF CON, and spent several months in jail. The DMCA has also been cited as chilling to non-criminal inclined users, such as students of cryptanalysis including, Professor Felten and students at Princeton University;^[98] security consultants, such as Netherlands based Niels Ferguson, who declined to publish vulnerabilities he discovered in Intel's secure-computing scheme due to fear of being arrested under the DMCA when he travels to the US; and blind or visually impaired users of screen readers or other assistive technologies.^[99]

International issues[edit]

In Europe, there have been several ongoing dialog activities that are characterized by their consensus-building intention:

• January 2001 Workshop on Digital Rights Management of the World Wide Web Consortium .^[100]
• 2003 Participative preparation of the European Committee for Standardization/Information Society Standardization System (CEN/ISSS) DRM Report.^[101]
• 2005 DRM Workshops of Directorate-General for Information Society and Media (European Commission), and the work of the High Level Group on DRM.^[102]
• 2005 Gowers Review of Intellectual Property by the British Government from Andrew Gowers published in 2006 with recommendations regarding copyright terms, exceptions, orphaned works, and copyright enforcement.
• 2004 Consultation process of the European Commission, DG Internal Market, on the Communication COM(2004)261 by the European Commission on "Management of Copyright and Related Rights" (closed).^[103]
• The AXMEDIS project, a European Commission Integrated Project of the FP6, has as its main goal automating content production, copy protection, and distribution, to reduce the related costs, and to support DRM at both B2B and B2C areas, harmonizing them.
• The INDICARE project is an ongoing dialogue on consumer acceptability of DRM solutions in Europe. It is an open and neutral platform for exchange of facts and opinions, mainly based on articles by authors from science and practice.

Opposition[edit]

Many organizations, prominent individuals, and computer scientists are opposed to DRM. Two notable DRM critics are John Walker, as expressed for instance, in his article "The Digital Imprimatur: How Big brother and big media can put the Internet genie back in the bottle",^[104] and Richard Stallman in his article The Right to Read^[105] and in other public statements: "DRM is an example of a malicious feature – a feature designed to hurt the user of the software, and therefore, it's something for which there can never be toleration".^[106] Stallman also believes that using the word "rights" is misleading and suggests that the word "restrictions", as in "Digital Restrictions Management", be used instead.^[107] This terminology has since been adopted by many other writers and critics unconnected with Stallman.^{[108][109][110]}

Other prominent critics of DRM include Professor Ross Anderson of Cambridge University, who heads a British organization which opposes DRM and similar efforts in the UK and elsewhere, and Cory Doctorow, a writer and technology blogger.^[111]

There have been numerous others who see DRM at a more fundamental level. This is similar to some of the ideas in Michael H. Goldhaber's presentation about "The Attention Economy and the Net" at a 1997 conference on the "Economics of Digital Information".^[112] (sample quote from the "Advice for the Transition" section of that presentation:^[112] "If you can't figure out how to afford it without charging, you may be doing something wrong.")

The EFF and similar organizations such as FreeCulture.org also hold positions which are characterized as opposed to DRM.^[113]

The Foundation for a Free Information Infrastructure has criticized DRM's effect as a trade barrier from a free market perspective.^[114]

The final version of the GNU General Public License version 3, as released by the Free Software Foundation, has a provision that "strips" DRM of its legal value, so people can break the DRM on GPL software without breaking laws like the DMCA. Also, in May 2006, the FSF launched a "Defective by Design" campaign against DRM.^[115][116]

Creative Commons provides licensing options encouraging the expansion of and building upon creative work without the use of DRM.^[117] In addition, Creative Commons licenses have anti-DRM clauses, therefore the use of DRM by a licensee to restrict the freedoms granted by a Creative Commons license is a breach of the Baseline Rights asserted by the licenses.^[118]

Bill Gates spoke about DRM at CES in 2006. According to him, DRM is not where it should be, and causes problems for legitimate consumers while trying to distinguish between legitimate and illegitimate users.^[119]

According to Steve Jobs, Apple opposes DRM music after a public letter calling its music labels to stop requiring DRM on its iTunes Store. As of 6 January 2009, the iTunes Store is DRM-free for songs.^[120]

Defective by Design member protesting DRM on 25 May 2007.

The Norwegian consumer rights organization "Forbrukerrådet" complained to Apple Inc. in 2007, about the company's use of DRM in, and in conjunction with, its iPod and iTunes products. Apple was accused of restricting users' access to their music and videos in an unlawful way, and of using EULAs which conflict with Norwegian consumer legislation. The complaint was supported by consumers' ombudsmen in Sweden and Denmark, and is currently being reviewed in the EU. Similarly, the United States Federal Trade Commission held hearings in March 2009, to review disclosure of DRM limitations to customers' use of media products.^[121]

DRM opponents argue that the presence of DRM violates existing private property rights and restricts a range of heretofore normal and legal user activities. A DRM component would control a device a user owns (such as a digital audio player) by restricting how it may act with regard to certain content, overriding some of the user's wishes (for example, preventing the user from burning a copyrighted song to CD as part of a compilation or a review). Doctorow has described this possibility as "the right to make up your own copyright laws".^[122]

An example of this restriction to legal user activities may be seen in Microsoft's Windows Vista operating system in which content using a Protected Media Path is disabled or degraded depending on the DRM scheme's evaluation of whether the hardware and its use are 'secure'.^[123] All forms of DRM depend on the DRM-enabled device (e.g., computer, DVD player, TV) imposing restrictions that (at least by intent) cannot be disabled or modified by the user. Key issues around DRM such as the right to make personal copies, provisions for persons to lend copies to friends, provisions for service discontinuance, hardware agnosticism, software and operating system agnosticism,^[124] contracts for public libraries, and customers' protection against one-side amendments of the contract by the publisher have not been fully addressed.(see references 80–89) It has also been pointed out that it is entirely unclear whether owners of content with DRM are legally permitted to pass on their property as inheritance to another person.^[125]

Tools like FairUse4WM have been created to strip Windows Media of DRM restrictions.^[126]

Valve Corporation president Gabe Newell also stated "most DRM strategies are just dumb" because they only decrease the value of a game in the consumer's eyes. Newell suggests that the goal should instead be "[creating] greater value for customers through service value". Valve operates Steam, a service which serves as an online store for PC games, as well as a social networking service and a DRM platform.^[127]

At the 2012 Game Developers Conference, the CEO of CD Projekt Red, Marcin Iwinski, announced that the company will not use DRM in any of its future releases. Iwinski stated of DRM, "it's just over-complicating things. We release the game. It's cracked in two hours, it was no time for Witcher 2. What really surprised me is that the pirates didn't use the GOGversion, which was not protected. They took the SecuROM retail version, cracked it and said 'we cracked it' – meanwhile there's a non-secure version with a simultaneous release. You'd think the GOG version would be the one floating around." Iwinski added after the presentation, "DRM does not protect your game. If there are examples that it does, then people maybe should consider it, but then there are complications with legit users."^[128]

Bruce Schneier argues that digital copy prevention is futile: "What the entertainment industry is trying to do is to use technology to contradict that natural law. They want a practical way to make copying hard enough to save their existing business. But they are doomed to fail."^[129] He has also described trying to make digital files uncopyable as being like "trying to make water not wet".^[130] The creators of StarForce also take this stance, stating that "The purpose of copy protection is not making the game uncrackable – it is impossible."^[131]

The Association for Computing Machinery and the Institute of Electrical and Electronics Engineers have historically opposed DRM, even going so far as to name AACS as a technology "most likely to fail" in an issue of IEEE Spectrum.^[132]

DRM-free works[edit]

Label proposed by the Free Software Foundation for DRM-free works

In reaction to opposition to DRM, many publishers and artists label their works as "DRM-free". Major companies that have done so include the following:

• Apple Inc. sold DRM content on their iTunes Store when it started 2003, but made music DRM-free after April 2007^[133] and has been labeling all music as "DRM-Free" since January 2009.^[134] The music still carries a digital watermark to identify the purchaser. Other works sold on iTunes such as apps, audiobooks, movies, and TV shows continue to be protected by DRM.^[135]
• Since 2014, Comixology, which distributes digital comics, has allowed rights holders to provide the option of a DRM-free download of purchased comics. Publishers which allow this include Dynamite Entertainment, Image Comics, Thrillbent, Top Shelf Productions, and Zenescope Entertainment.^[136]
• GOG.com (formerly Good Old Games), a digital distributor started in 2008, specializes in the distribution of PC video games. While most other digital distribution services allow various forms of DRM (or have them embedded), gog.com has a strict non-DRM policy.^[137]
• All music sold on Google Play is DRM free.
• Tor Books, a major publisher of science fiction and fantasy books, started selling DRM-free e-books in July 2012.^[138] Smaller e-book publishers, such as Baen Books and O'Reilly Media, had already forgone DRM previously.
• Vimeo on Demand is one of the publishers included in the Free Software Foundation's DRM-free guide.^[139]

Shortcomings[edit]

DRM server and Internet outages[edit]

Many DRM systems require authentication with an online server. Whenever the server goes down, or a region or country experiences an Internet outage, it effectively locks out people from registering or using the material. This is especially true for a product that requires a persistent online authentication, where, for example, a successful DDoS attack on the server would essentially make all copies of the material unusable.

DRM bypass methods for audio and video content[edit]

One simple method to bypass DRM on audio files is to burn the content to an audio CD and then rip it into DRM-free files. Some software products simplify and automate this burn-rip process by allowing the user to burn music to a CD-RW disc or to a Virtual CD-R drive, then automatically rip and encode the music, and automatically repeat this process until all selected music has been converted, rather than forcing the user to do this one CD (72–80 minutes worth of music) at a time.

Many software programs have been developed that intercept the data stream as it is decrypted out of the DRM-restricted file, and then use this data to construct a DRM-free file. These programs require a decryption key. Programs that do this for Blu-ray Discs, DVDs, and HD DVDs include universal decryption keys in the software itself. Programs that do this for iTunes audio, PlaysForSure songs, and TiVo ToGo recordings, however, rely on the user's own key – that is, they can only process content the user has legally acquired under his or her own account.

Another method is to use software to record the signals being sent through the audio or video cards or plug analog recording devices into the analog outputs of the media player. These techniques utilize the "analog hole".

To bypass DRM technologies embedded in video-streaming services, hackers employ a variety of methods. Besides rerecording and redistributing video streams, they place links to video-streaming services in web pages owned by the hackers, sell legitimate users' data on the black market for other people's use, and legitimate users sharing their account with family or friends who intend not to pay for the service.^[140]

Analog recording[edit]

Main article: Analog recording

All forms of DRM for audio and visual material (excluding interactive materials, e.g., videogames) are subject to the analog hole, namely that in order for a viewer to play the material, the digital signal must be turned into an analog signal containing light and/or sound for the viewer, and so available to be copied as no DRM is capable of controlling content in this form. In other words, a user could play a purchased audio file while using a separate program to record the sound back into the computer into a DRM-free file format.

All DRM to date can therefore be bypassed by recording this signal and digitally storing and distributing it in a non DRM limited form, by anyone who has the technical means of recording the analog stream. Furthermore, the analog hole cannot be overcome without the additional protection of externally imposed restrictions, such as legal regulations, because the vulnerability is inherent to all analog means of transmission.^[141] However, the conversion from digital to analog and back is likely to force a loss of quality, particularly when using lossy digital formats. HDCP is an attempt to plug the analog hole, although as of 2009, it was largely ineffective.^[142][143]

Asus released a soundcard which features a function called "Analog Loopback Transformation" to bypass the restrictions of DRM. This feature allows the user to record DRM-restricted audio via the soundcard's built-in analog I/O connection.^[144][145]

In order to prevent this exploit, there has been some discussions between copyright holders and manufacturers of electronics capable of playing such content to no longer include analog connectivity in their devices.^{[citation needed]} The movement, dubbed as "Analog Sunset", has seen a steady decline in analog output options on most Blu-ray devices manufactured after 2010.^{[citation needed]}

General computing platforms[edit]

Many of the DRM systems in use are designed to work on general purpose computing hardware, such as desktop PCs, apparently because this equipment is felt to be a major contributor to revenue loss from disallowed copying.^{[citation needed]} Large commercial copyright infringers avoid consumer equipment,^{[citation needed]} so losses from such infringers will not be covered by such provisions.

Such schemes, especially software based ones, can never be wholly secure since the software must include all the information necessary to decrypt the content, such as the decryption keys. An attacker will be able to extract this information, directly decrypt and copy the content, which bypasses the restrictions imposed by a DRM system.^[111]

Purpose-built hardware[edit]

Many DRM schemes use encrypted media which requires purpose-built hardware to hear or see the content. This appears to ensure that only licensed users (those with the hardware) can access the content. It additionally tries to protect a secret decryption key from the users of the system.

While this in principle can work, it is extremely difficult to build the hardware to protect the secret key against a sufficiently determined adversary. Many such systems have failed in the field. Once the secret key is known, building a version of the hardware that performs no checks is often relatively straightforward. In addition user verification provisions are frequently subject to attack, pirate decryption being among the most frequented ones.

A common real-world example can be found in commercial direct broadcast satellite television systems such as DirecTV and Malaysia's Astro. The company uses tamper-resistant smart cards to store decryption keys so that they are hidden from the user and the satellite receiver.

Watermarks[edit]

Watermarks can often be removed, although degradation of video or audio can occur.

Undecrypted copying failure[edit]

Mass redistribution of hard copies does not necessarily need DRM to be decrypted or removed, as it can be achieved by bit-perfect copying of a legally obtained medium without accessing the decrypted content. Additionally, still-encrypted disk images can be distributed over the Internet and played on legitimately licensed players.

Obsolescence[edit]

When standards and formats change, it may be difficult to transfer DRM-restricted content to new media, for instance Microsoft's new media player Zune did not support content that uses Microsoft's own PlaysForSure DRM scheme they had previously been selling.^[146]

Additionally, any system that requires contact with an authentication server is vulnerable to that server's becoming unavailable, as happened in 2007, when videos purchased from Major League Baseball (mlb.com) prior to 2006, became unplayable due to a change to the servers that validate the licenses.^[147]

Furthermore, when a company undergoes business adjustment or even bankrupt, its legacy service may become unavailable. Examples include MSN Music^[148], Yahoo! Music Store^[149], Adobe Content Server 3 for Adobe PDF^[150], Acetrax Video on Demand^[151], etc.

Environmental issues[edit]

DRM can accelerate hardware obsolescence, turning it into electronic waste sooner:

• DRM-related restrictions on capabilities of hardware can artificially reduce the range of potential uses of the device (to the point of making a device consisting of general-purpose components usable only for a purpose approved, or with “content” provided, by the vendor), limit upgradeability and repairability.^[152][153] Cf. proprietary abandonware, orphan works, planned obsolescence. Examples:
  • DVD region code (applies to discs as well as DVD players and drives);
  • the removal of the OtherOS feature from Sony PlayStation 3 game consoles;
  • Tivoization, UEFI Secure Boot and similar.
• Users may be forced to buy new devices for compatibility with DRM (i.e., through having to upgrade an operating system to one with different hardware requirements).^[154]

Moral and legitimacy implications[edit]

According to the EFF, "in an effort to attract customers, these music services try to obscure the restrictions they impose on you with clever marketing."^[155]

DRM laws are widely flouted: according to Australia Official Music Chart Survey, copyright infringements from all causes are practised by millions of people.^[156]

Relaxing some forms of DRM can be beneficial[edit]

Jeff Raikes, ex-president of the Microsoft Business Division, stated: "If they're going to pirate somebody, we want it to be us rather than somebody else".^[157] An analogous argument was made in an early paper by Kathleen Conner and Richard Rummelt.^[158] A subsequent study of digital rights management for e-books by Gal Oestreicher-Singer and Arun Sundararajan showed that relaxing some forms of DRM can be beneficial to digital rights holders because the losses from piracy are outweighed by the increases in value to legal buyers.^[159]

Also, free distribution, even if unauthorized, can be beneficial to small or new content providers by spreading and popularizing content and therefore generating a larger consumer base by sharing and word of mouth. Several musicians have grown to popularity by posting their music videos on sites like YouTube where the content is free to listen to. This method of putting the product out in the world free of DRM not only generates a greater following but also fuels greater revenue through other merchandise (hats, T-shirts), concert tickets, and of course, more sales of the content to paying consumers.

Can increase infringement[edit]

While the main intent of DRM is to prevent unauthorized copies of a product, there are mathematical models that suggest that DRM schemes can fail to do their job on multiple levels.^[160] The biggest failure that can result from DRM is that they have a potential to increase the infringement rate of a product. This goes against the held belief that DRM can always reduce unauthorized distribution. There also seems to be evidence that DRM will reduce profits.

The driving factor behind this is related to how many restrictions DRM imposes on a legal buyer. An ideal DRM would be one which imposes zero restrictions on legal buyers but makes imposing restrictions on infringers. Even if an ideal DRM can be created and used, in certain cases, it can be shown that removing the DRM will result in less unauthorized copying. For the ideal DRM, the reason why profits can increase is because of the demand is elastic. When there are more people legally buying and few people sharing the product, more profits are going to be made.

The mathematical models are strictly applied to the music industry (music CDs, downloadable music). These models could be extended to the other industries such as the gaming industry which show similarities to the music industry model. There are real instances when DRM restrain consumers in the gaming industry. Some DRM games are required to connect to the Internet in order to play them.^[161] Good Old Games' head of public relations and marketing, Trevor Longino, in agreement with this, believes that using DRM is less effective than improving a game's value in reducing video game infringement.^[162] However, TorrentFreak published a "Top 10 pirated games of 2008" list which shows that intrusive DRM is not the main reason why some games are copied more heavily than others. Popular games such as BioShock, Crysis Warhead, and Mass Effect which use intrusive DRM are strangely absent from the list.^[29]

Alternatives[edit]

Several business models have been proposed that offer an alternative to the use of DRM by content providers and rights holders.^[163]

"Easy and cheap"[edit]

The first business model that dissuades illegal file sharing is to make downloading digital media easy and cheap. The use of noncommercial sites makes downloading digital media complex. For example, misspelling an artist's name in a search query will often fail to return a result, and some sites limit internet traffic, which can make downloading media a long and frustrating process. Furthermore, illegal file sharing websites are often host to viruses and malware which attach themselves to the files (see torrent poisoning).^[164] If digital media (for example, songs) are all provided on accessible, legitimate sites, and are reasonably priced, consumers will purchase media legally to overcome these frustrations.^[163]

Comedian Louis C.K. made headlines in 2011, with the release of his concert film Live at the Beacon Theater as an inexpensive (US$5), DRM-free download. The only attempt to deter unlicensed copies was a letter emphasizing the lack of corporate involvement and direct relationship between artist and viewer. The film was a commercial success, turning a profit within 12 hours of its release. Some, including the artist himself, have suggested that file sharing rates were lower than normal as a result, making the release an important case study for the digital marketplace.^{[165][166][167]}

Webcomic Diesel Sweeties released a DRM-free PDF e-book on author R Stevens's 35th birthday,^{[168][169][170]} leading to more than 140,000 downloads in the first month, according to Stevens.^[171] He followed this with a DRM-free iBook specifically for the iPad, using Apple's new software,^[172] which generated more than 10,000 downloads in three days.^[173]That led Stevens to launch a Kickstarter project – "ebook stravaganza 3000" – to fund the conversion of 3,000 comics, written over 12 years, into a single "humongous" e-book to be released both for free and through the iBookstore; launched 8 February 2012, with the goal of raising $3,000 in 30 days, the project met its goal in 45 minutes, and went on to be funded at more than 10 times its original goal.^[174] The "payment optional" DRM-free model in this case was adopted on Stevens' view that "there is a class of webcomics reader who would prefer to read in large chunks and, even better, would be willing to spend a little money on it."^[173]

Crowdfunding or pre-order model[edit]

In February 2012, Double Fine asked for an upcoming video game, Double Fine Adventure, for crowdfunding on kickstarter.com and offered the game DRM-free for backers. This project exceeded its original goal of $400,000 in 45 days, raising in excess of $2 million.^[175][176] In this case DRM freedom was offered to backers as an incentive for supporting the project before release, with the consumer and community support and media attention from the highly successful Kickstarter drive counterbalancing any loss through file sharing.^{[citation needed]} Also, crowdfunding with the product itself as benefit for the supporters can be seen as pre-order or subscription business model in which one motivation for DRM, the uncertainty if a product will have enough paying customers to outweigh the development costs, is eliminated. After the success of Double Fine Adventure, many games were crowd-funded and many of them offered a DRM-free game version for the backers.^{[177][178][179]}

Digital content as promotion for traditional products[edit]

Many artists are using the Internet to give away music to create awareness and liking to a new upcoming album. The artists release a new song on the internet for free download, which consumers can download. The hope is to have the listeners buy the new album because of the free download.^[163] A common practice used today is releasing a song or two on the internet for consumers to indulge. In 2007, Radiohead released an album named in Rainbows, in which fans could pay any amount they want, or download it for free.^[180]

Artistic Freedom Voucher[edit]

The Artistic Freedom Voucher (AFV) introduced by Dean Baker is a way for consumers to support “creative and artistic work.” In this system, each consumer would have a refundable tax credit of $100 to give to any artist of creative work. To restrict fraud, the artists must register with the government. The voucher prohibits any artist that receives the benefits from copyrighting their material for a certain length of time. Consumers can obtain music for a certain amount of time easily and the consumer decides which artists receive the $100. The money can either be given to one artist or to many, the distribution is up to the consumer.^[181]