"You can only play with our toys if you follow our rules", Re: Intel to include DRM in new Pentium 4 series processors

[Brian Gladman]

From: "Matthew Astley" <lists-ukcrypto@fruitcake.demon.co.uk>
To: <ukcrypto@chiark.greenend.org.uk>
Sent: Friday, September 13, 2002 8:35 AM
Subject: "You can only play with our toys if you follow our rules", Re:
Intel to include DRM in new Pentium 4 series processors


> On Thu, Sep 12, 2002 at 07:14:14PM +0100, Ben Laurie wrote:
> > Nicholas Bohm wrote:
>
> > >This seems to imply that the owner of a TCPA machine can use it to
> > >verify any signatures he wants (i.e. import into TCPA any public
> > >keys he trusts) and will not be dependent on having keys signed by
> > >parties approved by the TCPA consortium or anyone else.
> > >
> > >Is this in fact a feature of TCPA?
> >
> > [...]
> > So, yes, you get to install your own keys, and run whatever you
> > want. But funnily enough, unless it is what www.disney.com wants you
> > to run, www.disney.com won't be sending you a copy of Snow White.
> > Similarly, Word may decline to run unless the right OS is running,
> > and that OS may refuse to allow access to files that have been
> > revoked. I think you can see where this is going.
>
> I would summarise it as "you can only play with our toys if you follow
> our rules".

Actually its slightly different: "you can only play with our toys if you
follow the rules we agreed with you at the time you purchased them".

The problem, as Ross points out, is that this might lead to market
distortion because many purcasers may simply accept what are draconian terms
without realising what they are doing.

> If there was a way to ensure that the rules are fair, then this aspect
> would appear to be acceptable - the commonly stated analogy of having
> a robotic policeman there. There is no discretion in what he enforces,
> but the you know the law (!) and it is just (!!).
>
> I think the policeman analogy is misleading. Would it fit better to
> suggest that it's an unaccountable robotic security guard, programmed
> in secret and 0wned by Disney?
>
> What if the guard makes a "mistake"? You presumably have the option of
> phoning its owner (assuming you still have a separate phone) and
> politely asking for a pardon. Or you could not bother.
>
> Standard marketing techniques (feedback loop) will quickly discover
> what rules the market will bear, and how many mistakes in Disney's
> favour the average customer will tolerate.
>
> In fact, if you've complained about something before then they can
> mark your primary key, and be more polite for the next few months.
> Just to keep you sweet. This sort of control appears to go beyond even
> what is explained on http://whitedot.org/
>
> Have I made a mistake here, or is it true that when the system does
> what Microsoft say it will, it is a sinister device for controlling
> its user?

If you don't like what it does don't turn it on.  But the issue then is
whether or not turning it off will really be an option because suppliers
won't supply software or content to those who don't allow TCPA features to
be used on their PC's. And this will depend on what proportion of users are
determined to keep the DRM features switched off.

I don't know the answer here but when I get one of these beasts my reaction
will be to turn on the trusted reporting for me, the machine owner, but to
switch it off for _everyone_ else.  I suspect that the DRM features will not
go down well in the PC market and I don't think I will be alone in not
allowing their use.

But some of the more 'interesting' cases are the embedded
PCs/microcontrollers in entertainment devices.  Although the firm TCPA
recommendation is that TCPA ships switched off, I am not convinced that it
will ship in this state when the device is designed for dedicated content
display (DVD's players etc.).


There is also the more difficult issue of TCPA derivatives where the
supplier steps outside the TCPA specification, for example, by delivering
DRM features permanently enabled and not user controllable as TCPA itself
requires. It will hence be important when the TCPA specification is
finalised that buyers only purchase products that are _fully_ compliant with
the TCPA specification if they want to be sure of having the protections
that have been built into this specification.

> Also, exactly how many toys will get thrown out of the pram if you run
> some software they don't like? The spin I've received suggests that if
> the program is in your own "box" then that's fine, and it can't/won't
> interfere with Word or Snow White.

In principle, and if you switch it on, this depends on what you agreed to
when you purchased TCPA dependent rights to some software or content. In
practice I think the authorisation tokens linked to machine metrics will
have to be fairly crude if they are to have any chance of success.  Very
sophisticated metrics would very likely mean that the software would fall
over pretty well every time it was used and here experience with copy
protection shows that users won't tolerate this.

But having said all of this, my aim is not to promote or defend TCPA but to
ensure that there is an _informed_ debate about what it does and does not
do.

    Brian