Thread by @doctorow

Two visions competed at the dawn of the modern digital era: computers could be a way to empower people to push back against corporate and state control; or computers could transfer power from the public to corporations or governments. 1/

If you'd like an essay-formatted version of this thread to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

pluralistic.net/2022/12/03/pai… 2/

I've always been baffled by the technologists who pursued control over liberation: surely their own formative experiences were of the liberatory power of technology. 3/

After experiencing that power, how could these Vichy nerds lend their skills to the project of forging digital shackles?

pluralistic.net/2020/10/12/red… 4/

And yet, there they were, from the earliest days. Back in 2017, Redditor /u/vadermeer was browsing a Seattle thrift-shop and unearthed a trove of early internal documents from #Apple's #SSAFE project, an early, doomed DRM project from 1979:

reddit.com/r/VintageApple… 5/

The files (now hosted at the @InternetArchive) are a chronicle of the battle between technologists pursuing user liberation and technologists who want to use computers to control their users. There are some great cameos from @stevewoz:

archive.org/details/AppleS… 6/

SSAFE bombed, but the fight raged on for decades and rages on still. I've been in the thick of it for more than 20 years - literally. 7/

My first day on the job for @EFF, back in 2002, was spent attending the inaugural meeting of the #BroadcastProtectionDiscussionGroup (#BPDG), an inter-industry conspiracy to put all computers in chains, forever:

onezero.medium.com/the-internet-h… 8/

The BPDG's mission was to create a standard for a #BroadcastFlag a single bit that would be included in the headers for video files. 9/

If the flag was present, any device that encountered the video would have to restrict its playback, checking to see whether and under what circumstances that playback could occur. 10/

To make this work, the group - giants of consumer electronics, IT, broadcast/cable/satellite and movies - would get a friendly lawmaker (Billy Tauzin, a lavishly corrupt Congressman) to pass a law that required anyone building video-capable devices to respond to the flag. 11/

As part of this proposal, all video-capable devices would also need to be "resistant to end-user modification" - that is, they'd have to have enough #DigitalRightsManagement (#DRM) technology to trigger #Section1201 of the #DigitalMilleniumCopyrightAct (#DMCA). 12/

This bans removing copyright locks on penalty of a 5-year prison sentence and a $500k fine. 13/

Strip away all the acronyms and obfuscation and here's what it meant: if they got their way, every computer would only run proprietary code (no #FreeSoftware/#OpenSource allowed) and if you reverse-engineerd it to change it to do your bidding *in any way*, you faced prison. 14/

Under this system, whatever restrictions the manufacturer imposed on the use of their computer-enabled products would be the final word. 15/

It would be a felony for a rival to make a tool that plugged into their system and let you do stuff the manufacturers blocked, even if that stuff was perfectly legal.

For example, under this system, distributing ad-blockers would be a felony. 16/

If the manufacturer designed a computer - any computer, whether or not it was used to watch video, because the standard was video-*capable* not video-*intended* - so that the browser used the operating-system's DRM to prevent ad-blocking, bypassing it would be a crime. 17/

At the time, we warned that giving manufacturers the power to restrict how you configured your own digital products would lead them to abuse that power - not to prevent copyright infringement, but to shift value from you to them. 18/

The temptation would be too great to resist, especially if the companies knew they could use the law to destroy any company that fixed the anti-features in their products. 19/

Sometimes, this was dismissed as fearmongering, with company insiders insisting that they knew their colleagues to be good and honorable people who wouldn't ever abuse this power. 20/

I expected that: no one is the villain of their own story, and we are all prone to inflated assessments of our power to resist #MoralHazard. 21/

But there was another response to our activism, one that was far more telling: "Yes, we are going to take away all the features you get with your digital media and sell them back to you one click at a time. So what?" 22/

These people were in thrall to a specific ideology: the neoliberal doctrine that markets are the most efficient way to allocate resources, and anything that isn't a market can be improved by turning it into one. 23/

That's the brain-worms that leads "entrepreneurs" to flood the entire IRS switchboard with thousands of auto-dialers and then auction off the right to be bridged into a call when someone picks up:

pluralistic.net/2021/10/07/mar… 24/

It's the same species of brain-worms that causes "entrepreneurs" to make apps that let people vacating a public parking spot to sell off the right to park there next:

theverge.com/2014/6/23/5836… 25/

It's the same species of brain-worms that causes "entrepreneurs" to make fake bookings for every hot table at every restaurant in town and then auction off the right to dine:

brianmayer.com/2014/07/how-i-… 26/

In the case of digital media, these brain-worms manifested as the certainty that we get *too many rights* when we buy or subscribe to digital media. The argument goes: 27/

* When you buy a book or movie or song or game, you may not want the right to sell it on the used market, or give it away, or re-read or re-watch or re-listen to it; 28/

* Because the only way to get media is to buy it outright, you might be paying more than you need to for that media;

* Perhaps the seller would offer you a discount on a book you could only read once, or Christmas movie you could only watch in July; 29/

* The blunt instrument of sale means that there are lots of discount offers that never get made, so there are lots of people with less money to spend who are excluded from the market. 30/

Put that way, it sounds reasonable, and indeed, in the margins, there have been some successes from the ability to transform an unconditional sale to a conditional license. 31/

You can "buy" a streaming movie on Youtube for $10, or "rent" it for $3; and you can pay $10/month for ad-free Spotify, $5/month for Spotify with some ads, or $0/month for ad-heavy Spotify. 32/

But these are exceptions. Most of the pre-digital offers aren't available at any price: you could buy a DVD and keep it forever, even if you never went back to the store again. 33/

If you "buy" a video on Prime or YouTube and then cancel your subscription and delete your account, you lose your "purchase."

If you buy a print book, you can lend it out or give it away to a friend or a library or a school. 34/

Ebooks come with contractual prohibitions on resale, and whether an ebook can be loaned is at the mercy of publishers, and not a feature you can give up in exchange for a discount.

For brain-wormed market trufans, the digital media dream was our nightmare. 35/

It was something I called "the #UrinaryTractInfection #BusinessModel." With non-DRM media, all the value flowed in a healthy gush: you could buy a CD, rip it to your computer, use it as a ringtone or as an alarmtone, play it in any country on any day forever. 36/

With DRM, all that value would dwindle from a steady stream to a burning, painful dribble: every feature would have a price-tag, and every time you pressed a button on your remote, a few cents would be deducted from your bank-account ("Mute feature: $0.01/minute"). 37/

Of course, there was no market for the right to buy a book but not the right to loan that book to someone else. Instead, giving sellers the power to unilaterally confiscate the value that we would otherwise get with our purchases led them to do so, selling us less for more. 38/

The Broadcast Flag was actually adopted by then-FCC chairman @chairmanpowell, so we sued him, along with our allies at @publicknowledge and @ALALibrary, and kicked his ass, and the Broadcast Flag died in 2005:

eff.org/cases/ala-v-fcc 39/

But the dream of the Broadcast Flag never died. All the streaming apps on your phone come with the same restrictions that the Broadcast Flag would have imposed on over-the-air videos.

It's *much* worse on your TV. 40/

Your cable box is a gigantic, energy-sucking, wallet-draining piece of shit; the average US household spends $200 on these clunky, insecure devices, and every attempt to #UnlockTheBox has been thwarted by Hollywood and the @CopyrightOffice:

eff.org/deeplinks/2016… 41/

The UTI business-model didn't take hold in most markets, but it's alive and well in your cable box. That box is *mandatory*, and modifying it runs afoul of DMCA 1201, meaning you can go to prison for five years for helping someone unfuck their cable box. 42/

Back when PVRs like Tivo entered the market, viewers were as excited about being able to skip ads as broadcasters and cable operators were furious about it. 43/

The industry has treated ignoring or skipping ads as a form of theft since the invention of the first TV remote control, which was condemned as a tool of piracy, since it enabled viewers to easily change the channel when ads came on. 44/

The advent of digital TV meant that cable boxes could implement DRM, ban ad-skipping, and criminalize the act of making a cable box that restored the feature. 45/

But early cable boxes didn't ban ad-skipping, because the cable industry knew that people would be slow to switch to digital TV if they lost this beloved feature. 46/

Instead, the power to block ads was a sleeper agent, a Manchurian Candidate that lurked in your cable box until the cable operators decided you were sufficiently invested in their products that they could take away this feature. 47/

This week, @SkyUK started warning people who pressed the skip-ad button on their cable remotes that they would be billed an extra £5/month if they fast-forwarded past an ad. The UTI business model is back, baby - feel the burn!

examinerlive.co.uk/news/sky-warns… 48/

This was the utterly foreseeable consequence of giving vendors the power to change how their devices worked after they sold it to you, under conditions that criminalized rivals who made products to change them back. 49/

Back in 2004, @Wired published a special edition featuring reviews of new digital AV technology, almost all of which was encumbered with DRM. 50/

I'd worked as a *Wired* reviewer on and off for years, and I published a blog post taking the magazine to task for failing to note that all the features that it was praising in these devices could be taken away by the manufacturer at any time:

memex.craphound.com/2004/12/28/bit… 51/

Then editor-in-chief @chr1sa defended the move, saying that DRM would encourage rightsholders to make their media available, and this was a net benefit:

longtail.typepad.com/the_long_tail/… 52/

I replied that this wasn't the point: if you're a trusted reviewer and you telling readers, "Buy this device because it has these three excellent features," you have a duty to warn them that any of these features could be taken away. 53/

This would be due to factors beyond your control, leaving you without any recourse:

memex.craphound.com/2004/12/29/cor… 54/

This is a case I've made to other reviewers since, but no one's taken me up on my suggestion that every review of every DRM-enabled device come with a bold warning that whatever you're buying this for might be taken away at any time. 55/

In my opinion, this is a major omission on the part of otherwise excellent, trusted reviewers like @ConsumerReports and @Wirecutter. 56/

Everywhere we find DRM, we find #fuckery. Even if your cable box could be redesigned to stop spying on you, you'd still have to root out spyware on your TV. 57/

Companies like @Vizio have crammed so much spyware into your "smart" TV that they now make more money spying on you than they do selling you the set.

pluralistic.net/2021/11/14/sti… 58/

Remember that the next time someone spouts the lazy maxim that "If you're not paying for the product, you're the product." The problem with Vizio's TVs isn't that they're "smart." The problem isn't that you're not paying enough for them. 59/

The problem is that it's illegal to unfuck them, because Vizio includes the mandatory DRM that rightsholders insist on, and then hide surveillance behind its legal minefield.

The risks of DRM aren't limited to having your bank-account drained or having your privacy invaded. 60/

DRM also lets companies decide who can fix their devices: a manufacturer that embeds processors in its replacement parts can require an unlock code before the device recognizes a new part. 61/

They can (and do) restrict the ability of independent service depots to generate these codes, meaning that manufacturers get a monopoly over who can fix your ventilator, your tractor, your phone, your wheelchair or your car.

doctorow.medium.com/about-those-ki… 62/

The technical term for these unlock codes is #VINLocking, and the "VIN" stands for "vehicle identification number," the unique code etched into the chassis of every new car and, these days, burned into into its central computerized controller. Big Car invented VIN-locking. 63/

VIN-locking is the major impediment to securing the #RightToRepair. Manufacturers of all kinds bootstrap the DMCA - a Clinton-era copyright law - into a new doctrine that @saurik calls #FelonyContemptOfBusinessModel." 64/

Removing DRM is illegal, so any business model that hides behind DRM is illegal to thwart:

doctorow.medium.com/how-to-fix-car… 65/

With Felony Contempt of Business Model, repair is just the tip of the iceberg. When security experts conduct security audits of DRM-locked devices, they typically have to bypass the DRM to test the device. 66/

Since bypassing this DRM exposes them to legal risks, many security experts simply avoid DRM-locked gadgets. Even if they are brave enough to delve into DRM's dirty secrets, their general counsels often prohibit them from going public with their results. 67/

This means that every DRM-restricted device is a potential reservoir of long-lived digital vulnerabilities that bad guys can discover and exploit over long timescales, while honest security researchers are scared off of discovering and reporting these bugs. 68/

That's why, when a researcher goes public with a really bad security defect that has been present for a very long time, the system in question often has DRM - and it's why media devices are *so* insecure, because they *all* have DRM. 69/

But these days, "media device" has ceased to be a meaningful category. As we warned Chairman Powell in 2003, soon every device would have a general purpose computer inside it, and any rule regulating "media devices" would regulate *everything*. 70/

Cars are media devices. Many new cars sell with @SIRIUSXM players built into their media centers (mine did, and I was bombarded with calls and letters from Sirius *begging* me to subscribe to it). These players have DRM. They also have incredibly grave security defects. 71/

Security researcher @samwcyo and his colleagues discovered they could hijack Sirius XM-enabled cars, armed with the VIN number on its windscreen. Sirius's authentication sucks and once you authenticate to an in-car Sirius-enabled app, you're in:

gizmodo.com/sirius-xm-bug-… 72/

Curry and pals were able to plunder personal information from connected cars, lock and unlock them, and execute other commands available through the cars' telematics systems. 73/

A similar hack of Jeep cars in 2017 let attackers seize control over steering, brakes and accelleration:

wired.com/2015/07/hacker… 74/

The auto industry itself admits that its products gather so much information on you - the contents of your phone, the places you go - that any breach could endanger your very life. 75/

Indeed, they made this claim to try to scare Massachusetts voters away from passing Right to Repair legislation in 2020:

pluralistic.net/2020/09/03/rip… 76/

The same structural factors that make cars dumpster-fires of slapdash security are also present in your phone, and, thanks to the 2017 decision to standardize DRM in browsers, in your browser:

eff.org/deeplinks/2017… 77/

This all starts with the idea that the problem with "content" is that Congress gave us, the public, too many rights under copyright, and that nickel-and-diming us to buy those rights a la carte would fix this problem. 78/

20 years later, the benefits of this system are thin gruel indeed, and the costs keep mounting. 79/

Image:
Cryteria (modified)
commons.wikimedia.org/wiki/File:HAL9…

CC BY 3.0
creativecommons.org/licenses/by/3.… 80/