A Year Ago: Intel PIII: Is Big Brother Inside?

Intel has revealed that each Pentium III chip will carry a unique serial number that can be read by the computer's software. Intel claims that the serial number will facilitate e-commerce, promote "digital content protection," prevent counterfeiting of Intel processors, and help to track stolen ones. We know users have questions about this controversial feature, so we assembled this FAQ.

Q: Why are privacy experts concerned?

A: Privacy experts are concerned because the CPU's electronic serial number could be used for purposes that may not be in users' best interests.

Q: Such as tracking where I go on the Internet?

A: Yes. The serial number can, potentially, be used to track your identity as you move about the Internet. But it's already possible to follow users via "cookies" and IP addresses, so this isn't the biggest concern. A more serious worry is that Internet merchants could rely on the ID as proof that you're you. And this is dangerous, because it would be easy for a malicious third party to impersonate you -- potentially draining your bank accounts and credit cards.

Q: Impersonate me? How?

A: As cryptography expert Bruce Schneier explains, it's easy; all the thief must do is rig his or her computer to transmit a different number than the one found in the Intel microprocessor. This sort of deception would be far, far, easier than "cloning" a cell phone, because you don't have to alter or reprogram the Pentium chip itself. All you need to do is change the machine's Internet software so that it transmits the bogus serial number of your choice. (Source code is available for a wide range of Internet software, including Netscape Navigator. But even without source code, any competent programmer could do it in a few hours.) It's also possible that the ID could be switched as it passed through the network.

If Intel's Pentium III ships with a serial number built in, I expect dozens of "impersonation" programs to be circulated on the Net within hours of its release. Besides letting a user masquerade as someone else, such programs would destroy the serial number's usefulness as a way of finding stolen computers, or computers with stolen chips, when they logged onto the Net.

Q: But didn't you say it'd help to prevent counterfeiting of chips? Isn't this a good thing?

A: Protection against counterfeits and identification of stolen chips are, quite possibly, the real benefits of the processor serial number.

Let me tell you a story: I recently bought, via an online shopping site, a processor module that was supposed to be a 450-MHz Pentium II. But after noticing some odd scratches and marks on the case, I opened it and discovered a 350-MHz processor (which costs $200 less) that had been marked up and rewired to appear like the faster model. Had I used the chip in the new Web server I was building, it would have produced incorrect results. It also would have burned out quickly, because the heat sink was not making contact with critical chips.

I was lucky. I work with computer hardware every day, so the signs of tampering were obvious to me. And I was brave enough to crack open the processor's case. But had there been a built-in model number of some kind, even a novice user would have noticed the scam when the computer reported that the processor was not really a 450-MHz model.

Alas, Intel's serial numbering scheme is overkill for this purpose. All you need to know to detect fake chips are the model number and rated speed of the part. A unique serial number for every processor isn't necessary but opens many other cans of worms.

Q: Intel says that the serial number feature will be turned off "by default." Doesn't this solve the problems it might cause?

A: Contrary to what you might have heard or read, Intel's design for the Pentium III does not -- at least, as of this writing -- turn the serial number off by default. According to Intel, the serial number feature is active when the computer is powered up and must be turned off by software.(Once it's been turned off, it will not turn on again until power is removed and reapplied.)

What Intel is proposing is to provide a software utility that runs when the PC starts up -- say, from your CONFIG.SYS file if you're running Microsoft Windows -- that turns the serial number off unless you elect to leave it on. But there are problems with this scheme. If you aren't running the latest software, but instead upgrade your motherboard or move your hard disk to a new machine, the Intel utility won't be present on your system; the serial number feature will then stay on. If you're running an alternative operating system, such as Linux or NetWare, there might not be any built-in utility for it that disables the serial number.

A software application with copy protection might remove or disable the Intel utility -- perhaps even without your knowledge. Software you purchase for the machine (or even the operating system itself) may insist that you keep the serial number turned on and refuse to run otherwise. Finally, computer vendors may decline to install Intel's utility, to avoid support calls from users whose software refused to run without a serial number.

Q: Could a processor serial number be used to create "pay per view" software or force me to register or upgrade my software?

A: Imagine the following all-too-plausible scenario: You buy a new piece of computer software, open the box, insert the CD-ROM. A message flashes across your screen: "This program is encrypted. To unlock it, you must first register your software and your computer via our toll-free number or the Internet."

You call the 800 number and are asked to punch in your processor's ID number and the serial number of the software. An attendant takes your name, address, telephone number, and other personal information. At the end of the process, you receive an encryption "key" that lets your computer decrypt and install the software. The software is uniquely tied to your CPU and to you. If you register via the Web, the process is nearly the same except that your processor's ID is sent to the software vendor automatically. If you decline to register, because you do not want to give out your personal information or want to avoid junk mail or telephone solicitations, you can't run the software.

You also might run into problems if you sold your computer, if it was destroyed by lightning, fire, or a flood, or if you upgraded to a new one. Worse still, the software might "expire" at some future date.

Q: I've never heard of software "expiring." How is that possible?

A: Today, after you've bought a software product, you can use it for as long as you like. But built-in IDs make it possible for manufacturers to license a product to you to use on only one machine -- and for a limited amount of time rather than indefinitely. This sort of scheme is already used in the controversial "Divx" system for rental movies (see Dvorak's Silicon Spin discussion, "Is Divx Evil?"). A product is "locked" to your computer, and your purchase only entitles you to use the product a certain number of times -- or for a certain length of time. After that, you must pay more money and/or buy an upgrade to continue using the product. A software product could even "seek permission" from the vendor -- via the Internet or your modem -- each time it ran, so that the vendor would know whenever you started the program. (Divx already incorporates such a scheme.)

Sound far-fetched? It's not. A memo penned by Microsoft Vice President Joachim Kempin, revealed during the Department of Justice's recent case against Microsoft, proposes that the company license Windows to computer buyers only for a limited time, requiring them to pay an "annuity" to keep using it thereafter. (See Microsoft Considered 'renting' Windows.) Unique chip serial numbers would help implement these schemes.

Intel spokesman Chuck Mulloy noted that some content creators "have expressed the view that the Internet is not secure enough for them to risk their intellectual property" by putting it online unless there are schemes to limit its use. Mulloy said that the idea of "pay-per-view" schemes for software programs and/or for other content -- such as music -- has been "discussed widely." He pointed out, however, that the serial number would be "one piece" of such a system, rather than a complete security scheme.

Q: What about selling my computer? Why would that cause problems?

A: If the software you owned were "locked" to your computer's CPU, you could not sell the machine and keep your software. You'd have to sell the computer software as well and buy fresh copies of all the applications you use or somehow re-register your programs. And because the buyer would now have your serial number, he or she could be mistaken for you on the Net -- with potentially disastrous results.

Q: You mentioned that there'd be a problem if my computer was destroyed or if I upgraded the CPU. Why?

A: Even if you were smart enough to have backed up all of your data so that you could restore it to a new machine, your software -- which was "locked" to the old one -- wouldn't work. In fact, if these programs had anti-piracy provisions built in, your new computer might attempt to "turn you in" as a software pirate. The same could happen if you upgraded to a newer, faster CPU with an unfamiliar ID.

Q: C'mon, Brett, you must have an opinion on this. What do you recommend that Intel do to resolve these issues?

A: I would recommend that Intel burn the model number and speed rating, rather than a unique serial number, into each CPU. This would solve counterfeiting problems while avoiding potential privacy and copy protection issues. If Intel does proceed with its plan, competitors should promote the lack of IDs in their chips as a selling point. Myself, I'd gladly pay a premium price to avoid the potential negative consequences of a burned-in serial number.

What do you think of Pentium III's ID tag? Contact us at Mail Room

Take me to the Pentium III Special.