"Peter D. Junger" wrote:

: > There is not even social opprobrium; look at how eager : > everyone was to look the other way on the question of whether the DeCSS : > reverse engineering violated the click-through agreement. : : Perhaps it did, but the licence agreement was unenforceable. It's : clearly reverse engineering for interoperability (between Linux and DVD : players) so the legal exemption applies. You can't escape the exemption : by contract.

I certainly agree that that /should/ be the case. However, you assert that it /is/ the case. Under what country's laws? Can you cite test cases?

: Now, you might say that morally he should obey the agreement he made.

I'd claim that he made no agreement; a click-through license is not a valid contract. If I recall correctly, a Louisiana court did rule that way in a well-publicised case, and I've heard several Canadians assert that at least some are invalid under our law.

... The important point is not, however, that click-through agreements are probably unenforceable; the important point is that people---at least those people who think that they own their own computers and the software copies that they have purchased---generally believe that they should be unenforceable.

However, what people generally believe has little bearing in law. The question is whether courts -- which courts in which countries and on what grounds -- will deem them enforcable and therefore will enforce them when asked to do so. It does not matter much what you believe if a court can be convinced you're violating a law. They have quite effective ways of enforcing such judgements. Of course, there are some good legal arguments that click-through agreements should not be enforcable, and that contracts should not be allowed to restrict reverse engineering. For that matter, there's a good argument that the DVD CCA is an illegal conspiracy to restrict competition and manipulate the markets, and should be prosecuted as such. e.g. the Australian Competition Board has demanded an explanation of region codes: http://www.accc.gov.au//fs-search.htm To quote two speeches from that site: Difficulties between the pro-competitive community and Intellectual Property Mr Ross Jones, Commissioner Australian Competition & Consumer Commission | Australian consumers are currently suffering from an international cartel that | restricts their access to digital versatile discs (DVDs). The cartel, headed | by major film studios in agreement with the manufacturers of DVD players, has | divided the world into regions. This ensures that DVDs on sale in Australia | will only function on a DVD player licensed for region 4 that includes Australia. | The stated aim is to protect cinema ticket sales by preventing people viewing | movies on DVDs in their homes before distribution to cinemas. The Australian | subsidiaries of US film companies have been requested by the Commission to | explain their actions. It will then decide what action can be taken. Globalisation and Competition Policy Professor Allan Fels, Chairman Australian Competition & Consumer Commission | The Commission has requested the Australian subsidiaries of United States film | companies to explain why their regional restrictions on DVDs should not be deemed | a breach of the Trade Practices Act 1974. ... | | The Commission believes RPC is anti-competitive with Australian consumers lacking | a choice of DVD videos and possibly paying higher prices. The quoted documents are a couple of years old. Does anyone have an update? A few of us have been trying, without much success, to convince the Canadian Competition Bureau to prosecute these conspirators. It might be worth a shot in other countries.

(And in the actual case involving Linux and DVD players there was no agreement not to circumvent the technological control measures in DVD's; the case was based on the theory that the circumvention violated the Digital Millenium Copyright Act.)

Correct, for the case brought on the East Coast (NY? NJ?) by the MPAA. However, the first case, brought in California by DVD CCA, did not use the DMCA. It alleged theft of trade secrets, and violation of the license agreement.

Peter D. Junger wrote:

That isn't the reason why a click-through agreement isn't enforceable---the agreement could, were it enforceable, validlly forbid reverse engineering for any reason and that clause would in most cases be upheld.

Not in Europe though. EU directive 91/250/EEC "on the legal protection of computer programs" makes provision for reverse engineering for interoperability. In Britain this was incorporated into domestic law by the Copyright (Computer Programs) Regulations 1992: http://www.hmso.gov.uk/si/si1992/Uksi_19923233_en_1.htm See in particular s.50B(4) which the regulations added to the Copyright Designs and Patents Act 1988.

(And in the actual case involving Linux and DVD players there was no agreement not to circumvent the technological control measures in DVD's; the case was based on the theory that the circumvention violated the Digital Millenium Copyright Act.)

The American cases were, but the European case of course wasn't. The DMCA doesn't apply over here, though we have something similar in the works.

...

I think lawyers will hate this.

I don't see why we should. We don't hate the law of gravity or the law of large numbers.

You should hate it. :-) It is appropriate for the legislature to decide which acts are restricted by copyright and which are not. The DMCA and similar legislation hands that right to private organisations. To some extent anti-trust law guards against the worst abuses, but it is more appropriate for the boundaries of copyright to be set by our "elected representatives". BTW, I have been thinking for a while about putting together a UK competition complaint about DVD region coding. No promises that anything will happen quickly. On the other hand, if people offer help (or just tell me that they think it is a worthwhile thing to do) it will probably move faster. -- Pete

I'm slightly confused about this. My understanding of contract law is that five things are required to form a valid contract: offer and acceptance, mutual intent, consideration, capacity, and lawful intent. It seems to me that a click-through agreement is likely to fail on at least one, and possibly two of these requirements. First, it is doubtful that there is mutual intent. The average user doesn't even read the agreement, so there is hardly mutual intent. However, even if I accept mutual intent, it would be easy to argue that there is no capacity. I have four children under the age of seven. None of them have the legal capacity to form a contract. Three of them have the physical capacity to click a button. A corporation would therefore have to demonstrate that I and not they clicked on the agreement for the contract to be valid. As a side note, it seems that a corporation would actually have to demonstrate that I had seen and agreed to the thing and clicked acceptance. Prior to that point, I could reverse engineer, since there is no statement that I cannot reverse engineer agreed to. So what would happen if I reverse engineered the installation so that the agreement that was display stated that I could do what I liked with the software? Ok, so there would be no mutual intent, but on the other hand, there would also be no agreement on the click-through agreement either. Paul Peter D. Junger writes:

Pete Chown writes:

: Anonymous wrote: : : > Furthermore, inherent to the TCPA concept is that the chip can in : > effect be turned off. No one proposes to forbid you from booting a : > non-compliant OS or including non-compliant drivers. : : Good point. At least I hope they don't. :-) : : > There is not even social opprobrium; look at how eager : > everyone was to look the other way on the question of whether the DeCSS : > reverse engineering violated the click-through agreement. : : Perhaps it did, but the licence agreement was unenforceable. It's : clearly reverse engineering for interoperability (between Linux and DVD : players) so the legal exemption applies. You can't escape the exemption : by contract. Now, you might say that morally he should obey the : agreement he made. My view is that there is a reason why this type of : contract is unenforceable; you might as well take advantage of the : exemption.

That isn't the reason why a click-through agreement isn't enforceable---the agreement could, were it enforceable, validlly forbid reverse engineering for any reason and that clause would in most cases be upheld. But, unless you buy your software from the copyright owner, you own your copy of the software and clicking on a so called agreement with the copyright owner that you won't do certain things with your software is---or, at least should be---as unenforceable as promise to your doctor that you won't smoke another cigarette. The important point is not, however, that click-through agreements are probably unenforceable; the important point is that people---at least those people who think that they own their own computers and the software copies that they have purchased---generally believe that they should be unenforceable. (And in the actual case involving Linux and DVD players there was no agreement not to circumvent the technological control measures in DVD's; the case was based on the theory that the circumvention violated the Digital Millenium Copyright Act.)

: The prosecution was on some nonsense charge that amounted to him : burgling his own house. A statute that was meant to penalise computer : break-ins was used against someone who owned the computer that he broke : into. : : > The TCPA allows you to do something that you can't do today: run your : > system in a way which convinces the other guy that you will honor your : > promises, that you will guard his content as he requires in exchange for : > his providing it to you. : : Right, but it has an odd effect too. No legal system gives people : complete freedom to contract. Suppose you really, really want to exempt : a shop from liability if your new toaster explodes. You can't do it; : the legal system does not give you the freedom to contract in that way. : : DRM, however, gives people complete freedom to make contracts about how : they will deal with digital content. Under EU single market rules, a : contract term to the effect that you could pass on your content to : someone in the UK but not the rest of the EU is unenforceable. No : problem for DRM though...

I don't think that one should confuse contract limitations, or limitations on enforceable contract limitations, with technological limitations. There is nothing, for example, in any legal system that forbids one from violating the law of gravity.

One of the many problems with the use of the Digital Millenium Copyright Act to enforce the technological control measures in DVD's was that it was based on the rather weird theory that it should be illegal to do something that someone else tried, but failed, to make technologically impossible to do.

(Thus I am rather doubtful that Lessig's idea the everything is code is useful for analytical, rather than rhetorical, purposes.)

: I think lawyers will hate this.

I don't see why we should. We don't hate the law of gravity or the law of large numbers.

-- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH EMAIL: junger@samsara.law.cwru.edu URL: http://samsara.law.cwru.edu NOTE: junger@pdj2-ra.f-remote.cwru.edu no longer exists

--------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo@wasabisystems.com

-- ---------------------------------------------------------------------------- Paul A.S. Ward, Assistant Professor Email: pasward@shoshin.uwaterloo.ca University of Waterloo pasward@computer.org Department of Computer Engineering Tel: +1 (519) 888-4567 ext.3127 Waterloo, Ontario Fax: +1 (519) 746-3077 Canada N2L 3G1 URL: http://shoshin.uwaterloo.ca/~pasward --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo@wasabisystems.com

On 27 Jun 2002, David Wagner wrote:

No, it's not. Read Ross Anderson's article again. Your analysis misses part of the point. Here's an example of a more problematic vision: you can buy Microsoft Office for $500 and be able to view MS Office documents; or you can refrain from buying it and you won't be able to view MS Office documents. Do you see why this is problematic? It lets one vendor lock the world into a monopoly; noone else will be able to develop compatible MS Word viewers without the consent of Microsoft. (StarOffice on Linux won't work, because to get the session key to decrypt the Word document your viewer has to go online to microsoft.com and ask for it, but microsoft.com won't give you the key unless you've bought a "secure" "trusted" OS and purchased Microsoft Office for $500.) Now notice that the same idea can be used to inhibit competition in just about any computer market, and I hope you appreciate Ross's point. TCPA/DRM has the potential for anti-competitive effects, and the result may well be worse off than we are today.

As long as MS Office isn't mandated by law, who cares? So what: somebody sends me a file. I tell them I can't read it. Now, they have a choice, they can give me MS Office or they can send me ascii. The market will determine if "secure" OS's are useful. DRM isn't the problem. Legislating DRM is the problem. You can go buy IBM portables with secure key chips built in right now to help protect your box and your business data. That's TCPA. Nothing wrong with it, it's a good idea. It doesn't become wrong until it becomes forced down our throats. That's where S.2048 becomes something to worry about, it forces us to use hardware we don't need (or may not need for our purposes). TCPA and DRM are not the problem here, and privacy and copyright are side issues too. There is no need for the law to intervene, the market will decide how all this stuff can be used efficiently and effectively. And that's what the entertainment industry needs to figure out and fast too. The law is slow. Technology is fast. Patience, persistence, truth, Dr. mike

David wrote:

It's not clear that enabling anti-competitive behavior is good for society. After all, there's a reason we have anti-trust law. Ross Anderson's point -- and it seems to me it's one worth considering -- is that, if there are potentially harmful effects that come with the beneficial effects, maybe we should think about them in advance.

I fully agree that the TCPA's efforts offer potentially beneficial effects. Assuming the TPM has not been compromised, the TPM should enable to detect if interested parties have replaced you NIC with the rarer, but not unheard of, variant that ships out the contents of your operating RAM via DMA and IP padding outside the abilities of your OS to detect. However, enabling platform security, as much as might be stressed otherwise by the stakeholders, has never been the motive behind the TCPA. The motive has been DRM. Does this mean that one should ignore the benefits that TCPA might bring? Of course not. But it does mean that one should carefully weigh the benefits against the risks. --Lucky Green

On Wed, Jul 03, 2002 at 10:54:43PM -0700, Bill Stewart wrote:

At 12:59 AM 06/27/2002 -0700, Lucky Green wrote:

...

I fully agree that the TCPA's efforts offer potentially beneficial effects. Assuming the TPM has not been compromised, the TPM should enable to detect if interested parties have replaced you NIC with the rarer, but not unheard of, variant that ships out the contents of your operating RAM via DMA and IP padding outside the abilities of your OS to detect.

It can? I thought that DMA was there to let you avoid bothering the CPU. The Alternate NIC card would need to have a CPU of its own to do a good job of this, but that's not hard.

I don't think so. As far as I understood, the bus system (PCI,...) will be encrypted as well. You'll have to use a NIC which is certified and can decrypt the information on the bus. Obviously, you won't get a certification for such an network card. But this implies other problems: You won't be able to enter a simple shell script through the keyboard. If so, you could simple print protected files as a hexdump or use the screen (or maybe the sound device or any LED) as a serial interface. Since you could use the keyboard to enter a non-certified program, the keyboard is to be considered as a nontrusted device. This means that you either * have to use a certified keyboard which doesn't let you enter bad programs * don't have a keyboard at all * or are not able to use shell scripts (at least not in trusted context). This means a strict separation between certified software and data. If Microsoft was able to do so, we wouldn't have worms. Hadmut

On Thu, Jul 04, 2002 at 10:54:34PM -0700, Lucky Green wrote:

Sure you can use shell scripts. Though I don't understand how a shell script will help you in obtaining a dump of the protected data since your script has insufficient privileges to read the data. Nor can you give the shell script those privileges since you don't have supervisor mode access to the CPU. How does your shell script plan to get past the memory protection?

That's why I was talking about a shell script (or take any other program to be interpreted). What does need to be certified: The shell or the shell script? The CPU doesn't recognize the shell script as a program, this is just some plain data entered through the keyboard like writing a letter. A shell script is not a program, it is data entered at a program's runtime. This moves one step forward: The hardware (palladium chip, memory management, etc.) can check the binary program to be loaded. So you won'te be able to run a compiled program and to access protected information. But once a certified software is running, it takes input (reading mouse, keyboard, files, asking DNS, connecting servers,...). This input might cause (by interpretation, by bug or however) the certified software to do certain things which do not comply with DRM requirements. At this stage, the running binary software itself is the instance to provide the DRM security, not the palladium memory management anymore. I agree that this is not yet an "open sesame", but it shows that the game does not play on the binary/memory management layer only. But who controls runtime input? History shows, that M$ software is anything but able to deal with malicious input. That's why the world is using virus filters. That's nothing else than an external filter to keep malicious input from an attacker away from the running software. By analogy, Palladium might require the same: an input filter between attacker and running software. Since the "attacker" is sitting in front of the computer this time, this filter has to be applied to the user interface, keyboard and mouse. Maybe they'll install a filter between the keyboard and the software, thus building a certified keyboard, which filters out any malicious key sequences. And maybe you can use your keyboard only, if you have downloaded the latest patterns (like your daily virus filter update). I agree that this depends on the assumption that the certified software is not perfect and can't deal with arbitrary input. But that's reality. Hadmut

On Fri, Jul 05, 2002 at 03:52:52AM -0700, Seth David Schoen wrote:

memory protection and monitor or control an arbitrary process. In Palladium, if a system is started in a trusted mode, not even the OS kernel will have access to all system resources.

That *might* be a contradiction in terms. If I understand this correctly, the TCPA or Palladium hardware will include some kind of memory management device, very similar to the ones we have in hardware of the last years, but which stores some kind of de-/encryption information for each page segment and which de-/encrypts every memory access. Doesn't seem to be much of a problem, except for speed. But how does this device know which segments belong to the software and which don't? Or how does it know whether an allowed or foreign task is accessing the protected areas (which is the same question again, = is the PC in a program segment which also belongs to the protected area). If this is done the simple way, like a normal OS configures the memory management when loading some executable software, the OS might at any time give wrong information to the device. In this case, the security depends on the integrity and bug-freeness of the OS, because the OS _could_ do it, but it is not supposed to do it. A more advanced way would be to have the program loaded by the operating system as before, but to have the Palladium device check some kind of signature to verify the correctness of the OS loading operation. This might lead to an uncontrollable problems, if programs start to load DLLs. Is the TCPA/Palladium trust transitive? If library A is trusted, and so is B, is then (A+B) trusted? A third way would be to keep the OS completely out of the job of loading software/programs into memory, and to have it done by the Palladium device. This isn't actually a third way, but a redefinition of terms and a migration. The OS isn't the OS anymore, because basic tasks of the OS have been migrated to the Palladium device, which is now to be considered as a piece of OS in silicon. I didn't find the time yet to read the TCPA description in detail. But from my current point of view I doubt that this will really work, provide the claimed security, and will still be a useful computer at the same time. I especially doubt that the same company, which completely fails to make Outlook or Internet Explorer resistent against content attacks (viruses, worms, ...) will be able to provide software which such a strict separation between trusted and untrusted data, as it is required for such a project to work. regards Hadmut

On Fri, 28 Jun 2002, Thomas Tydal wrote:

...

Realize that the "trusted" mode of the TCPA will always be only an option,

Bottom line; not if you want to work with protected content. (Which, from what I can understand, will include all future songs, movies and probably word documents and loads of other data as well.) Or am I missing something?

All future songs of *some* companies. As long as it's an option, there will be people out there selling CD's to get their music out. You're not missing anything. The question is: will it always be an option? I hope so. A bunch of huge companies that need encrypted set top boxes tied directly to an HDTV and hard to physically hack means lots of jobs. And they will compete with the markets already in place. So that's more jobs for more engineers. If it's not an option, economics is the least of our problems. Patience, persistence, truth, Dr. mike