eff.org/deeplinks/2017/07/amid-unprecedented-controversy-w3c-greenlights-drm-web Amid Unprecedented Controversy, W3C Greenlights DRM for the Web By Cory Doctorow July 6, 2017 Early today, the World Wide Web Consortium (W3C) standards body publicly announced its intention to publish Encrypted Media Extensions (EME)—a DRM standard for web video—with no safeguards whatsoever for accessibility, security research or competition, despite an unprecedented internal controversy among its staff and members over this issue. EME is a standardized way for web video platforms to control users' browsers, so that we can only watch the videos under rules they set. This kind of technology, commonly called Digital Rights Management (DRM), is backed up by laws like the United States DMCA Section 1201 (most other countries also have laws like this). Today, the W3C announced that it would publish its DRM standard with no protections and no compromises at all. Under these laws, people who bypass DRM to do legal things (like investigate code defects that create dangerous security vulnerabilities) can face civil and criminal penalties. Practically speaking, bypassing DRM isn't hard (Google's version of DRM was broken for six years before anyone noticed), but that doesn't matter. Even low-quality DRM gets the copyright owner the extremely profitable right to stop their customers and competitors from using their products except in the ways that the rightsholder specifies. EFF objects to DRM: it's a bad idea to make technology that treats the owner of a computer as an adversary to be controlled, and DRM wrecks the fairness of the copyright bargain by preventing you from exercising the rights the law gives you when you lawfully acquire a copyrighted work (like the rights to make fair uses like remix or repair, or to resell or lend your copy). But EFF understood that the W3C had members who wanted to make DRM, so we suggested a compromise: a covenant, modeled on the existing W3C member-agreement, that would require members to make a binding promise only to use the law to attack people who infringed copyright, and to leave people alone if they bypassed DRM for legal reasons, like making W3C-standardized video more accessible for people with disabilities. This was a very popular idea. It was endorsed by Unesco, by the Internet Archive, by the creator of the W3C's existing membership agreement, by hundreds of top security researchers, by the competition expert who coined the term "Net Neutrality", and by hundreds of human rights organizations and activists from the global south. The Open Source Initiative amended its definition of "open standard" so that DRM standards could only qualify as a "open" if they protected legitimate activity. Now, it's fair to say that the W3C's DRM advocates didn't like the idea. After a perfunctory discussion process (during which some progress was made), they walked away from the negotiations, and the W3C decided to allow the standardization work to continue despite their unwillingness to compromise. But other W3C members did like the idea. On March 12, the final vote for publishing EME closed, and members ranging from the German National Library to the UK Royal National Institute for Blind People to the cryptocurrency startup Ethereum, to Brave, a new entrant to the browser market -- along with dozens more—rejected the idea of publishing EME without some protections for these equities (the numbers in the vote are confidential by W3C's own membership requirements, but all the members mentioned here have given permission to have their votes revealed.) It was the most controversial vote in W3C history. As weeks and then months stretched out without a decision, another W3C member, the Center for Democracy and Technology, proposed a very, very narrow version of the covenant, one that would only protect security researchers who revealed accidental or deliberate leaks of data marked as private and sensitive by EME. Netflix's representative dismissed the idea out of hand, and then the W3C's CEO effectively killed the proposal. Today, the W3C announced that it would publish its DRM standard with no protections and no compromises at all, stating that W3C Director Tim Berners-Lee had concluded that the objections raised "had already been addressed" or that they were "overruled." In its statement, the W3C said that publishing a DRM standard without protections for core open web activities was better than not doing so, because its DRM had better support for privacy, accessibility, and competition than a non-W3C version of DRM would have. We disagree. Even by the W3C's own measures, EME represents no improvement upon a non-standards approach, and in some important ways, the W3C's DRM is worse than an ad-hoc, industry approach. At root is the way that DRM interacts with the law. Take security: the W3C's specification says that users' computers should be protected from privacy-invading activities by DRM vendors, but without a covenant, it's impossible to check whether this is happening. Recall that Netflix, one of the principal advocates for DRM at W3C, categorically rejected the narrowest of covenants, one that would protect solely the activity of revealing DRM flaws that compromised user privacy. On the question of accessibility, the W3C has simply ignored the substantial formal and informal objections raised by its members, including members with deep expertise in accessibility, such as Vision Australia, Media Access Australia, Benetech, and the RNIB. These organizations pointed out that having a place for assistive data was nice, but to make video accessible, it was necessary to use computers to generate that data. It's great to say that if you know where all the strobe effects are in 10,000,000 hours of videos, you could add warnings to the timelines of those videos to help people with photosensitive epilepsy. But unless you have an unimaginable army of people who can watch all that video, the practical way to find all those strobes is to feed the video to a computer, after bypassing the DRM. Otherwise, most video will never, ever be made safe for people with photosensitive epilepsy. Multiply that by the unimaginable armies of people needed to write subtitles, translate audio, and generate descriptive audio tracks, and you've exceeded the entire human race's video-annotating capacity several times over—but barely scratched the surface of what computers can (and will be able to) do. On the question of competition, the W3C's response is even more frustrating and non-responsive. EME only solves part of the video-transmission standard: for a browser to support EME, it must also license a "Content Decryption Module" (CDM). Without a CDM, video just doesn't work. All the big incumbents advocating for DRM have licenses for CDMs, but new entrants to the market will struggle to get these CDMs, and in order to get them, they have to make promises to restrict otherwise legal activities (for example, CDM licensing terms prevent users in some parts of Europe from seeing videos made available in other parts of the EU). The W3C says that none of this makes DRM any worse than what was there before the standards effort, but they're dead wrong. DRM is covered by a mess of criss-crossing patents that make any kind of interoperable DRM transcendentally hard to create -- unless there's some way of cutting through the patent thicket. That's where the W3C comes in: its patent policy requires members to swear not to enforce their patents against people who implement W3C standards. Since the W3C's membership includes key DRM patent owners, it's the one forum where such a standard can be set. At EFF, we've spent decades defending people engaged in legitimate activities that companies or governments disliked: researchers who go public with defects in products whose users are blithely unaware of them; new entrants to monopolized markets who offer better products with features the cozy old guard don't like; public spirited archivists and accessibility workers who want to preserve digital culture and make sure everyone gets to use it. We're dismayed to see the W3C literally overrule the concerns of its public interest members, security experts, accessibility members and innovative startup members, putting the institution's thumb on the scales for the large incumbents that dominate the web, ensuring that dominance lasts forever. This will break people, companies, and projects, and it will be technologists and their lawyers, including the EFF, who will be the ones who'll have to pick up the pieces. We've seen what happens when people and small startups face the wrath of giant corporations whose ire they've aroused. We've seen those people bankrupted, jailed, and personally destroyed. That's why we fought so hard at the W3C, and it's why we're fighting so hard to fix laws like Section 1201 of the DMCA. We've been suing the US government over the constitutionality of DMCA 1201; in the coming months, we'll be back at the US Copyright Office, arguing to maintain and extend the exemptions to 1201 we won in 2015. As for the W3C... we're working on it. There is an appeals process for Tim Berners-Lee's decisions at the W3C, which has never been successfully triggered. The entire project of designing technology to control web users, rather than empowering them, has taken the W3C into uncharted waters, and this is the most unfamiliar of them all. We're looking into this, counting noses, and assessing our options. We'll keep you informed.