Why DRM won't ever work

[The opinions expressed here are mine alone, and not those of Google, Inc. my employer.]

Commentary-- Scotty the Engineer was always my favorite character in the original "Star Trek". Sure, Captain Kirk was the hero, he was at the heart of all the action, and got to romance all the green-skinned women, but if he wanted that amazing ship to actually do anything, he had to ask Scotty. He had to ask him nicely. If you think about it, Scotty had all the real power in that show. If he told Kirk the dilithium crystals were drained, there was never any real argument, the captain would cry like a whining child, but in the end he had to face reality and wait for Scotty to fix it.

I always thought Scotty should have said "no" to the captain more often, especially when Kirk would ask for something completely outrageous that, more often than not, violated the laws of physics. But engineers don't like saying no to management, and poor Scotty would end up having to make the magic happen week after week, until even as a child I began to suspect that his skills had more to do with the scriptwriters than his deep understanding of the laws of the universe. Still, he did end up with a reputation as a miracle worker, which can't be so bad.

Trying to make Digital Rights Management (DRM) work in the real world is like asking engineers to do "Star Trek" style magic, rather than real engineering. DRM simply cannot work. For less technical readers who might be wondering what I'm going on about, DRM is the attempt to control copying on a digital file, or sometimes even to add a restriction on how many times such a file can be copied. It's usually applied to online music or movies, but it's never sold to the consumer for what it actually is, an added restriction on what can be done with something they've paid for. DRM is always explained as the "wonderful new technology that will help protect your medical records from thieves." The truth is, it can't even do that.

DRM is often spoken about in conjunction with encryption, which actually is a massively useful technology that can protect your medical records from thieves. DRM uses encryption, but encryption isn't the same thing as DRM. Encryption is based on secrets, usually known only to two communicating parties. People snooping encrypted traffic end up with what appears to be random noise, only the people who have the secret key can make sense of it. Decades of real scientific research goes into creating sophisticated encryption algorithms and methods such as public-key cryptography, on which almost all Internet commerce is based, which allows a secret key to be derived from publicly available information. But the point of all encryption is that the key is a secret. It has to be a secret, as it's the basis of the privacy between the two parties.

Now let's consider DRM. DRM is applied to digital data by one party, usually the vendor of a music or movie, and encrypts the data to be protected using an encryption algorithm and a key. The other party in the transaction, the consumer of the music or movie, is then given the encrypted data, knowledge of what algorithm is used to encrypt the data, and a copy of the encryption key used to encrypt the data. All of these things must be supplied to the consumer in order for them to be able to use the data; without them, there's no way the consumer can listen to or watch the data they've just bought. Yet DRM is supposed to be able to restrict what the customer can do with the data. How can this be done given the fundamental reality of the situation described above? The magic of dilithium crystals?

Sure, there's gobs and gobs of extra software in the process which is usually run at the consumer end of the deal, trying to obfuscate and hide the fact that the consumer possesses all the information needed to decrypt the file they've just been given. They have to have been given this, else they can't listen to the song or watch the movie. Claiming that this process can ever be made secure from the people you've just given all this information to is like believing you can create a secure bank vault by drawing chalk lines on the pavement, piling the money inside and asking customers to "respect these boundaries". The media industries are trying to sell what they consider to be valuable data without any means of prohibiting access to it. This is not a business model that is ever going to work.

The recent case of the release of the hidden encryption keys for high-definition format DVD's is the perfect illustration of this fantasy engineering approach to the realities of the Internet age. This new "super-secure" DRM system has now been broken twice. Ironically, the breaking of the DRM might be the push that causes the popular adoption of these new HD-DVD formats. Data formats that can't easily be copied to other devices tend to end up being unpopular, as the physical devices that store digital media are subject to wear and tear. One curious child with sharp fingernails could accidentally ruin an entire HD-DVD movie collection. The only DRM systems that don't end up ultimately being broken are the ones that don't have any content published in them that people want to watch. It really doesn't matter how clever the layers of software being added to the system are, it only takes one smart person with a debugger, or logic analyzer, to dig through them and discover the underlying truth that any version of DRM just doesn't have any secrets.

Engineers know that DRM doesn't work, that it can't possibly work. Yet just like Scotty when Captain Kirk calls from the bridge asking for the impossible, they can't seem to help producing ever more complicated versions of the same broken system. Companies keep trying to create and sell DRM systems to the content industry. Having lots of money thrown at them to do this probably helps, just like Scotty liked to be thought of as a miracle worker.

In a recent talk at Google, Cory Doctorow. the Electronic Freedom activist, science fiction author, and creator of the popular geek news aggregation site Boing Boing said that engineers should simply refuse to create DRM systems for customers. A request for a DRM system is a sign that the customer is in denial, and isn't dealing rationally with reality. They still believe in the businesses model of the "Underpants Gnomes" from the "South Park" TV show.

• Step 1: Create a DRM system.
• Step 2: ???
• Step 3: Profit!

Unfortunately, he also pointed out that the US government also seems to be living in this fantasy world -- and, to a lesser extent, the UK government. One of the most misguided things going on in the world at the moment is the attempt by the US government to force other countries to adopt what they call US-style "Intellectual Property Rights". The underlying economic theory for this appears to be that the US and UK can lose their industrial manufacturing base, outsourcing it to India or China, and still maintain their primary positions in the world by controlling the information used to design the products manufactured by this cheap labor, or by selling digital content to the newly affluent consumers in these countries. This comes down to a bet that in the future digital bits will be easier to control, and become harder to copy. In the age of the Internet, this is a bet against reality, as the whole history of digital computing is that bits always become easier to copy, and harder to control.

Believing in a DRM business model is like joining Star Fleet security, putting on your red shirt, and volunteering to beam down to the new unexplored plant with Kirk, Spock and McCoy. Someone will be coming back from that mission, it's just not likely to be the security guard. Always a true engineer, Scotty had the good sense to stay safely on board the ship.