15. Protecting Digital Rights

The volume of digital content coursing through corporate and consumer networks is on upward spiral at least as steep as Moore’s law. The result is that the total amount of content available online has exploded—and so have the number, variety, and creativity of the exploits designed to circumvent protection mechanisms for digital content. It’s a perpetual arms race between black-hat hackers and white-hat engineers—and neither side is ever ahead for long.

What can a Citizen Engineer do about it? Plenty. Here are a few insights, ideas, and considerations that might help you protect consumers—and yourself—from unauthorized access to data and content.

Digital Rights Management

One reason innovation has been able to flourish is because Internet technologies enable the rapid, widespread, and often anonymous flow of information. Combine that free flow with advances in digital media—photography, video, music—and you have an amazing opportunity for wide-scale experimentation and creative expression.

Two decades ago, home computers brought us a revolution called desktop publishing. Now home users have the tools to create professional-quality movies and music—and a way to share them with others.

More recently, though, the Internet has become a place of conflict and contention when it comes to digital media. The questions are difficult: Since the network makes it easy for people to copy and transmit protected material, how can we make sure artists are compensated for their creative work? And just as important, how can we do so without quashing experimentation and innovation?

Artists should be compensated. There’s no question about that. But in our rush to defend their rights, let’s not overlook the need to encourage experimentation. As Citizen Engineers, we believe public policy should encourage innovation and free speech. It should, as always, seek to balance the rights of individuals with the greatest public good.

In the words of Lawrence Lessig, “The Internet has created a great fear among the content industry that they’re going to lose their whole industry if they don’t learn how to, and get more power to, exercise perfect control over content. And so, what they’re doing is building both technology and a legal infrastructure to give them much more control than they’ve ever had in the past.”

But one of the great values of the Internet is that it has become a forum for borrowing, mixing, developing, and tinkering. After all, in both science and art, innovators build on each other’s work.

So, as we look at the developing discipline of digital rights management, or DRM, we need to respect the experimental, standing-on-the-shoulders-of-giants aspects of the Internet. It’s up to all of us who see ourselves as Citizen Engineers to advocate policies and design technologies that respect the legitimate needs and current rights of honest users.

While the Internet certainly makes managing the rights for movies and music more complex, we believe that it is a more sound economic and social policy to foster the architectural, business, political, and public freedoms that have enabled the Internet to be a place of innovation than it is to overly restrict the flow of digital information in an effort to meticulously account for every instance of the use of content.

We think the rights of content creators can be balanced with the common public interest to foster vibrant innovation. To that end, we’d like to suggest that the following principles be applied to digital rights management.

• Innovation flourishes through openness.

• All creators are users and many users are creators.

• Content creators and copyright holders should be compensated fairly.

• Respect for users’ privacy is essential.

• Code (both laws and technology) should encourage innovation.

Some content owners are pressing for DRM systems that would fully control the users’ access to content, systems with user tracking that would limit access to copyrighted material. We instead prefer an “optimistic” model whose fundamental credo is trust the customer. Excessive limitation restricts not only the rights of consumers but also their potential, because such solutions strongly interfere with the creation of derivative works and fair use of copyrighted content.

In an ideal world, solutions should encourage information flow, including the capability for creating derivative works. While we recognize that there will always be “leakage” and illegal behavior, we think it’s better to provide auditing and accounting paths that respect the privacy of honest users and permit copying, manipulation, and playback.

As Lessig puts it: “The counterintuitive part about intellectual property is that there can be too much of a good thing; that if you exercise too much control, or if a law grants creators or innovators too much control, that can actually stifle new innovation. So, the really hard problem for policymakers, and also for companies dealing in this context, is to strike the right balance between the control that’s necessary to produce the profits that will support new innovation and the access or freedom of others in that space, so they can build on top of that innovation and make it worth much more.”

Systems that encourage the user to play with digital material, to experiment, to build and create, will be a win not only for consumers but also for content producers.

Is “Open DRM” an Oxymoron?

Digital rights management is all about control, restrictions, and authorizations, seemingly at odds with the spirit of community and openness that is the hallmark of the Citizen Engineer.

So, why have Sun and other organizations invested so much time and talent in developing a standards-based, royalty-free architecture for building interoperable DRM implementations?

Because an open, interoperable DRM architecture can help to solve problems that proprietary DRM technology created. And because it can open up new opportunities for companies that want to expand their digital content offerings without compromising control and protection of their content.

You don’t have to look very hard to see the limitations of proprietary DRM technologies. What do you do when you want to watch a movie you’ve downloaded legally, but at a friend’s house instead of at your house? Your friend has a different movie player than you do. The DRM system isn’t smart enough to recognize that this would be legitimate access. Today’s DRM model is like the old AOL model: As long as you buy into the AOL world and stay in the AOL world, you’re fine. But if you venture outside, trouble is lurking.

A better approach is to create an open, standards-based DRM architecture and to share it—royalty free—with the development community so that they can innovate and add value without technological encumbrances or prohibitive licensing costs.

“In a world where DRM has become ubiquitous, we need to ensure that the ecology for creativity is bolstered, not stifled, by technology,” says Lessig.¹ “We applaud efforts to rally the community around the development of open source, royalty-free DRM standards that support ‘fair use’ and that don’t block the development of Creative Commons ideals.”

The concept of interoperability is at the heart of the matter. For there to be a diverse and robust economy supporting the sale and use of creative content, DRM systems must be interoperable, and this interoperability must encompass all necessary functionalities. It is critical that not just fair use rights but also user rights and rights on contract termination be present in all DRM instances, and that user interests be considered and fully included.

We believe that DRM should be a solution only when necessary. DRM should never restrict the user’s ability to utilize the content in legally permissible ways. Without full interoperability, users find it difficult and even impossible to listen to and view content they have legitimately purchased. Instead, users are locked in; and we believe such limitations on the use of legitimately owned creative content represent an unacceptable abridgment of consumer rights. As important as the issues of control and appropriate compensation for content owners are, interoperability is even more critical for all concerned.

Sun has a lot of experience in this arena; it is, after all, the company that believes “the network is the computer.” Sun’s work in this area is fundamentally based on open standards, and increasingly on open source. Sun has already launched an open source project in DRM interoperability, Project DReaM, whose source code has been released as part of Sun’s Open Media Commons initiative.²

Project DReaM³ provides the infrastructure to develop an open DRM solution for consumers, content owners, network operators, and device manufacturers that strives to chart a royalty-free approach. This is one solution to the interoperable DRM problem; there are undoubtedly others.

Fair Use and Other Concepts for Reducing Restrictions

It is also important to recognize that Internet users are active content creators, not just passive consumers of content. User-created content—blogs, videos, music, and mash-ups—is one of the most vibrant areas of creation on the Internet, and embracing this key shift should help to keep DRM interoperability in its rightful and constructive place in the online world.

A vital aspect of enabling creative content is “fair use,” the American legal concept that in certain instances creative content can be used without the content owner’s permission. Some members of the European Union share some similar ideas under “fair dealing.” But while the law may protect fair dealing, DRM technology does not necessarily do so. Placing restrictions on the use of creative content is not good public policy, and any policy on DRM should include support for legally permitted uses of content.

An important component of support for user-created content is Creative Commons, which, as noted throughout this part of the book, provides licenses enforcing some restrictions on the use of content (e.g., Attribution Required, No Commercial Reuse) while encouraging the sharing of content. These licenses have seen wide international adoption, with licenses available in 53 nations. We consider Creative Commons methodologies a useful best practice foundation.

Another important aspect is the handling of the rights to the content on termination of the contract that the DRM system may be attempting to implement. DRM inherently “quantizes” rights, removing the nuanced ability to interpret rights that has traditionally been available. For the market to be able to work with the base of cultural material being generated today, it is important that DRM systems include the ability to handle “end of life” for services and systems without either removing the rights granted under the contract with the supplier or blocking the ability to exercise statutory freedoms.

We recommend a forward-moving strategy based on four basic foundations.

• User-centered principles: This entails recognizing and further enabling a user-centered right to use content on multiple clients, archives, and devices; a user-centered right to assert license and ownership as expressed in techniques such as Creative Commons; and a user-centered right to know license and usage restrictions (and associated costs) on both content and the media technologies needed to use the content.

• Adequate stakeholder scope: Implementing meaningful DRM interoperability requires consideration of not only multiple devices, services, and archives, but also multiple networks and associated business models. We believe it is important to consider both the technical and business model similarities between DRM and conditional access, and to consider that similar obstacles have limited interoperability in both domains.

• Acceptably inclusive methodology: We believe that royalty-free (while reserving defensive rights), open source, and ex ante standardization processes for DRM interoperability are the best, fairest, fastest, most inclusive, and most certain route to meaningful DRM interoperability.

• Recognition of cultural priorities: We believe that the longer-term needs for access to cultural artifacts require prioritization alongside commercial issues. This would mean, for example, ensuring that “locks” on rights can be removed at contract termination, or when a service provider leaves the market, so that interoperability can still be achieved even in the absence of the original provider.

DRM systems without full interoperability will likely lead to markets for devices and content being severely hampered, which, in turn, could easily lead to a monopoly situation and greater restrictions in consumers’ ability to use content they own. Neither of these situations will serve culture, business, or democracy particularly well.

The raucous debates about DRM continue among computer industry executives, Hollywood moguls, intellectual property lawyers, members of standards organizations, and content owners of all types. Ultimately, all of those issues are for the marketplace to decide. But as long as DRM remains part of the equation, as long as DRM technology is instrumental in the management of content distribution, we need an open, interoperable DRM solution, not a proprietary product.

Part III Summary, and What’s Next

This part of the book gave you but a small taste of the opportunity—and the complexity—presented by intellectual property law. While we have only scratched the surface of this topic, we hope it’s enough to get you to start seeing IP mechanisms as a powerful lever, not just as a potential minefield for your project or your career. Learn to turn IP law to your advantage and you’ll find that it will enable your ideas to thrive, to evolve, to spark new innovations within your teams and communities, and ultimately to succeed in the marketplace. If you want your stuff to win, you’ve got to know your stuff when it comes to IP.

The next part of the book takes us beyond the realm of practical information and addresses a fundamental question: How does the “ideal” of the Citizen Engineer become a reality in practice? We’ll provide advice and examples from around the world.