Possession is nine tenths of the law? Part 2

Part Two “It’s Mine I Can Prove It.” 

Why PKI should be used to address the digital rights management question 

The second half of this essay looks at how various media providers use DRM and the limitations of the current solutions.  PKI is presented as an alternative.  I hope you enjoy the paper and encourage you to comment.

Digital Rights Management

Accepting the fact that you are really not buying anything tangible, a digital content provider like Apple® is not necessarily out to get you.  The “Terms and Conditions [for] ITunes store, Mac App Store, App Store and iBookstore” allow for content sharing on up to ten devices five of which may be a I Tunes authorized computers.  It allows burning to CD your full playlist up to seven times.  For a fee you can get additional cloud services that make accessing your purchased content even easier.  On the flip side Apple® reserves the right to change the usage rules at any time.  The Apple® business model is not about making money with the content it is about making money on the hardware.  This is not the typical hardware /software paradigm.  With the majority of companies that deal in both hardware and software the real profit is in the software and ultimately the accompanying service and support plans.  Apples approach is not unique but is atypical in the software community though it seems to be part of a consensus in the digital content management community.  "The iPod makes money. The iTunes Music Store doesn't," said Apple Senior Vice President Phil Schiller.   "It's maybe a feature your platform should offer, but it's not like you're going to make some (big) markup," Microsoft Chairman Bill Gates said at the company's July [2003] analysts' meeting in response to questions about a proposed online music store.(Fried, 2003)

You have a certain amount of freedom in using and managing the content you purchase/lease from Apple ® although you are limited to using Apple® hardware, or apple software on non Apple® hardware like PC’s and Laptops.  The Apple® formats are proprietary as is the security mechanism they use to ensure compliance with their policies. This is the difference between the underperforming subscription models like Napster, Rhapsody, and Pressplay, and the Apple a la carte model which has been copied by most of the major players in the industry today.  Security is enforced using Digital Rights Management (DRM) Digital rights management.

 “DRM is a class of access control technologies that are used by hardware manufacturers, publishers, copyright holders and individuals with the intent to limit the use of digital content and devices after sale. DRM is any technology that inhibits uses of digital content that are not desired or intended by the content provider. DRM also includes specific instances of digital works or devices. Companies such as Amazon, AT&T, AOL, Apple Inc., BBC, Microsoft, Electronic Arts and Sony use digital rights management.” (Wikipedia, 2012)  

DRM has its detractors who often predict gloom and doom scenarios.  These scenarios often focus on a complete loss of your digital media should the DRM standard change in the future or the original service provider go out of business.  Although it does not seem likely that the world will be without the I Store™, Kindle™ store, or any of the other megalithic providers anytime soon the point is valid. Additional charges are that DRM stifles innovation and competition but perhaps the most disconcerting charge it that DRM goes beyond the constraints required by current copyright law which could be a slippery slope indeed.   

Apple has its own proprietary version of DRM known as FairPlay which is in turn only supported by Apple ® products.  This is no surprise if the afore mentioned quote by Apple Senior Vice President Phil Schiller is representative of Apples long term business model.  Apple, like other digital content providers, does have a loyal following but the question needs to be asked; are we heading for a single source world in which you must pick your provider and be satisfied with the available offerings.   What happens when your favorite author’s publisher or recording artist’s studio will not sign a contract with your provider?  Do you buy a new device every time you seek to increase the variety of your library?  To be fair to Apple® although they continue to use DRM in other media they removed FairPlay and any sort of DRM from the music tracks bought in the iTunes music library in 2009. (Apple Inc, 2012)   Apple does continue to digitally watermark its music tracks offering an excellent segue into DRM alternatives.

The pivotal issue of the digital media conundrum is the establishment of ownership and the ability to trace that ownership.  There are those who do not believe that any sort of identifier that would allow for tracing of ownership is in any way necessary or justified.  Perhaps there are merits to specific arguments in that regard however a system without ownership principles will simply result in the eventual extinction of the art form.  Individuals cannot be allowed unfettered access to works without compensation to the originator or allowed the ability to, without limitation, reproduce and distribute said material.  It is obvious that DRM is not the solution of the future.  Apple uses digital watermarking, the process by which code is buried in an underlying carrier signal allowing for the verification of the signals ownership or authenticity.  This technology has been used to track down the source of pirated movies.  Unlike the Metadata like that placed in websites to improve visibility to search engines, Digital watermarking does not change the size of the file.  One would think that this is an effective solution until the realization that digital watermarking is proprietary, and not standards driven, comes to light. A digital watermark also cannot be easily altered or added to without sacrificing some of the quality of the original file.  With this limitation it becomes problematic at best to transfer ownership of the media.

 DRM Alternatives

Other methods for establishing ownership of digital media are in use.  For example, Palm Digital Media, now known as E-reader, links the credit card information of the purchaser to the e-book copy in order to discourage distribution of the books. (Noring, 2004)  The big disadvantage is the risk to Personally Identifiable Information (PII).  The thought of using credit card information to indicate ownership of a piece of digital media is scary at best.   So what is the solution?  One proposition is that establishing ownership of digital media, securing a multibillion dollar industry and preventing hundreds of millions of dollars in fraud in the US alone, is a great argument for furthering individual digital identities in the US; enter PKI and Digital Certificates. 

Public key infrastructure (PKI) enables users of a basically unsecure public network such as the Internet to securely and privately exchange data and money through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority. The public key infrastructure provides for a digital certificate that can identify an individual or an organization and directory services that can store and, when necessary, revoke the certificates. 

In cryptography, a public key “certificate” (or identity certificate) is an electronic document which incorporates a digital signature to bind together a public key with an identity - information such as the name of a person or an organization, their address, and so forth. The certificate can be used to provide very strong verification that a public key belongs to an individual.

In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority. In a web of trust scheme, the signature is of either the user (a self-signed certificate) or other users (”endorsements”). In either case, the signatures on a certificate are attestations by the certificate signer that the identity information and the public key belong together. (Operational Research Consultants Inc., 2011)

 

This would appear to be an excellent solution for both the producers and consumers of digital media. For example if I were to buy an e-book and sign both the purchase and the resulting digital file with a public key certificate it would be the digital equivalent of signing each and every page of a hardcover novel with my name.  It does raise some rather childish euphemistic comparisons but effectively marks that digital media as mine.  More importantly unlike a five year old scribbling this book belongs to “Tommy” across the pages a digital signature can be edited, exchanged, or added to without harming the underlying file. This allows for the establishment of a chain of ownership and subsequently for the smooth and traceable exchange of ownership, even one that is temporary.  

Detractors point out that the establishment of a PKI infrastructure is overly burdensome in cost and complexity.  But this argument does not stand up to the counter which is economy of scale.  The federal government has been using PKI for years for logical access security but efforts to increase the use of this proven technology outside the federal government have been hampered by lack of broad scale adoption.  Consider that Apple has more than two hundred million devices sold worldwide and Amazon can claim more than six hundred million users.  It is not too much of an exaggeration to state that using those numbers as a starting point would drive the cost of PKI digital identities into the cost range of the Venti Café Mocha from Starbucks I purchased on the way to work this morning.  It was by the way, demonstrably not ostensibly mine. Possession is nine tenths of the law, just ask my daughter.

Works Cited

Apple Inc. (2012, January 6). Chanegs Coming to iTunes Store. Retrieved June 20, 2012, from Apple Press Information: http://www.apple.com/pr/library/2009/01/06Changes-Coming-to-the-iTunes-Store.html

Apple Inc. (2012). LICENSED APPLICATION END USER LICENSE AGREEMENT . Retrieved June 18, 2012, from www.apple.com: http://www.apple.com/legal/itunes/appstore/dev/stdeula/

http://www.apple.com/legal/itunes/appstore/dev/stdeula/

Fried, I. (2003, Oct 16). Will Itunes make Apple Shine. Retrieved June 19, 2012, from CNET: http://news.cnet.com/2100-1041-5092559.html?tag=nl

Hyde, B. (2001). THE FIRST SALE DOCTRINE AND DIGITAL. Retrieved june 20, 2012, from Duke Law Scholorship Repository: http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=1017&context=dltr

Kunkel, J. R. (2002). Recent Developments in Shrinkwrap, Clickwrap and Browsewrap Licenses in the United States. Murdoch University Electronic Journal of Law , 9 (3).

Noring, J. (2004). The Perils of DRM Overkill For Large Publishers. Retrieved June 20, 2012, from Teleread.org: http://web.archive.org/web/20080403175200/  http://www.teleread.org/publishersdrm.htm

Operational Research Consultants Inc. (2011). Certificates and Credentials. Retrieved June 20, 2012, from ORC.Com: http://www.orc.com/certificates/

Wikipedia. (2012, June 15). Digital rights management. Retrieved June 19, 2012, from Wikipedia, The Free Encyclopedia : http://en.wikipedia.org/wiki/Digital_rights_management#cite_note-0

Possession is nine tenths of the law? Part 1

Posting the Mobile Device Remote Identity Proofing paper in parts seemed to work pretty well.   The paper as a whole received many more views than its two predecessors.  “Possession” is not as long as “Mobile” but lends itself to being divided in half.  The first half will focus on the problem, how to best handle Digital Rights Management (DRM), along with the associated legal principles.  Part Two will focus on the current methods of securing Digital Rights Management and PKI as an alternative.  I hope you enjoy the paper and encourage you to comment.

The Digital Rights Management Conundrum 

 

Background on digital media ownership

Every so often I run across a word that I have not heard before or had the occasion to use.  The latest entry in that category is Ostensible.  Ostensible is an adjective defined by Merriam Webster as:

1.       1: intended for display : open to view

2.       2: being such in appearance: plausible rather than demonstrably true or real.

I came across this word while conducting the research for this post.  It was used in the Wall Street Journal’s Law Blog while paraphrasing a 2010 decision by the Ninth Circuit Court in San Francesco.  The focus of the plaintiffs and the defendant’s dispute was money, no surprise.  The argument was based on the difference in royalties paid to recording artists.  A song that is licensed typically garners a hefty fifty percent share in revenue for the artist, conversely a song that is sold brings in far lower royalty.  The catalyst for the complaint, Apple I-tunes.  Time for a reality check; did you really believe the tens of millions of dollars spent on music, movies, books, and other publications in the I-Tune store actually resulted in ownership?  You may be thinking to yourself that darn fine print well in fact the opening statement to the iTunes licensing agreement tells it all.  

“The Products transacted through the Service are licensed, not sold, to You for use only under the terms of this license, unless a Product is accompanied by a separate license agreement, in which case the terms of that separate license agreement will govern, subject to Your prior acceptance of that separate license agreement. The licensor (“Application Provider”) reserves all rights not expressly granted to You. The Product that is subject to this license is referred to in this license as the “Licensed Application.” (Apple Inc., 2012)

The fact that the songs were licensed not sold precipitated the suit against Universal Music Group by producers affiliated with rapper Eminem.  Although the decision was not favorable for Universal Music Group it is also, at least according to them, not precedent setting as it is specific to one particular contract with a single artist.   They are obviously appealing the verdict.

In order to begin to grasp the issues it is necessary to have a general understanding of the three legal principles that have become ubiquitous in the digital media debate.

Copyright

Merriam Webster defines copyright as the exclusive legal rights to reproduce, publish, sell, or distribute the matter and form of something (as a literary, musical, or artistic work).  A copyright is granted to the creator of an original expression of work; for example an author or composer.  There is more than one type of copyright, those that are registered and those that are implied. Without getting into too much detail suffice it to say that an implied copyright is granted on initial publication of the work and a registered copyright is granted by the US copyright office after the work is deposited along with application and fee.  The deposited work [sample] becomes the property of the U.S. Library of Congress.

First Sale Doctrine

First sale doctrine as applied to Copyrights allows the purchaser to sell or give away a particular lawfully made copy of the copyrighted work without permission once it has been obtained. This does not infringe the copyright owner's exclusive rights. Section 106 of the 1976 Copyright Act grants the owner of a Copyright six exclusive rights: reproduction, preparation of derivative works, distribution, public performance, public display, and digital transmission performance.  However, a Copyright owner’s right of distribution is limited by the First Sale Doctrine, as codified in Section 109 of the Act. Section 109(a) (Hyde, 2001)  First sale doctrine is an exception to the copy right.  This exception allows you to give a book to a friend or even sell it.  First Sale Doctrine enables libraries to lend books and video stores, before they started going the way of the dinosaur, to rent video’s.  First sale doctrine is not without conditions. In order to receive the afore mentioned privileges ownership must be established.  Keep in mind that ownership is not defined by mere possession which is why you cannot legally copy a rented video or DVD. 

Contract

Back in the pre-computer dark ages access to music, literature, video etc was controlled by copyright law.  During the personal computer enlightenment we were introduced to contract law as we accepted license agreements during software installation or even through the act of breaking the security seal.  The internet introduced the information revolution and really stood things on end with the Click Through License also known as a Click Wrap Agreement

Clickwrap agreements came into use when software vendors began distributing software by means other than disks, such as when the software is pre-installed on a computer for the user, or when the software is downloaded over the Internet. Upon downloading, installation or first use of the application, a window containing the terms of the license opens for the user to read. The user is asked to click either "I agree" or "I do not agree". If the user does not agree, the process is terminated. The clickwrap agreements often remove many factual questions whether the user had adequate notice of the license terms and manifested assent to them. With respect to software downloads, the clickwrap terms often are displayed at the very start of the contract formation process, although often the terms are contained in a scrollable window that requires the user to scroll down to read all of the terms. This positioning often eliminates U.C.C. Section 2-207 issues regarding agreement to additional or different terms. (Kunkel, 2002)

Statistics and Sigma Six expert Jeff Sauro confirmed a true lack of end user concern with end user license agreements (EULA).   Mr. Sauro examined a couple of thousand log records over e few different consumer software products.  He found;

 “The median time users spent on the license page was only 6 seconds! Generating a confidence interval around this sample tells us that we can be 95% sure at least 70% of users spend less than 12 seconds on the license page.

Assuming it takes a minimum of two minutes to read the License Agreement (which itself is fast) we can be 95% confident no more than 8% of users read the License Agreement in full.”

It could be argued that the sheer volume of these agreements in our everyday lives provided a disincentive in getting the end user to read them.  As digital content providers race to catch up with advances in technology the agreements compound often resulting in multiple EULA’s and Terms of use agreements for individual products.  Consider that the order of a Kindle Fire™ requires that you consent to ten different agreements with a combined forty eight pages of text (11point font, standard margins).  Disincentive or not click wrap agreements are likely here to stay and current case law is overwhelmingly in their favor.

Getting back to ostensible, you are in fact the ostensible “buyer” when it comes to electronic media.  The major providers are very aware of the propensity of people to actually read the license agreement before clicking the check box indicating “I agree”.   The media providers think of you as a buyer of a service whereas you may think of yourself as the buyer of a product.  You have no right to resell what you have purchased, in fact is difficult to lend or share what you have purchased outside of your family group in your own home and then only when using software designed to regulate that behavior.  Even if the majority of people were to read the license agreements chances are most would complete the purchase regardless of what the license agreement outlines.  This is in keeping with today’s instant gratification society.