Elizabeth Osder designs Web sites for companies like the Financial Times in London, and she has a problem. A vice president at iXL Enterprises Inc. in New York, she knows that the sites she designs must deliver readers and revenue. Many readers can bring in lots of revenue. But this revenue can be cut dramatically if someone steals the sites' content -- text, images and layout. And digital content is easy to cut and paste.
But a complicated site drives away readers. "You can't manage the rights of your assets if you can't distribute them easily," she says, adding that there's a need to both control content and put it where it can be sold.
Many Web sites are grappling with similar concerns. The designers want their sites to be easy to use, but they also want to prevent illicit copies from cutting into revenue. Balancing these two needs is complex because you can't prevent copying. By the very nature of Web software, every time someone visits a Web site, his browser automatically makes a copy of everything there - it has to so the user can read the content. You just don't want users making copies for their friends.
The music industry looks at the growth of MP3 and its relatively small, downloadable digital music files with despair. Music fans frequently copy the files instead of buying legitimate copies from record stores.
This concern has led to a frantic interest in an area called digital-rights management. New companies are creating new approaches for corralling bits and reducing the proliferation of bootleg copies. Meanwhile, established companies are retrofitting older software to provide some content control.
At present, most rights-management projects are experimental. Reciprocal Inc. in Buffalo, New York, built a Web site to sell in electronic form the works of some authors at Simon and Schuster Inc., with proceeds going to charity during the 1999 holiday season. Adobe Systems Inc. has launched a site, PDF Merchant (http://www.adobe.com/products/pdfmerchant/main.html), to sell digital content encoded with Acrobat.
Most other solutions are still being kicked around in labs and boardrooms. The music industry is committed to finding a practical way to control proliferation of digital copies, but the technology is far from common. The Secure Digital Music Initiative has ambitious goals, but developing new and usable technology takes time. Sunnyvale, California-based InterTrust Technologies Corp., a leader in this field, has started cooperative ventures with manufacturers and announced many solutions, but 1999 holiday shoppers found it easier to find products to play unprotected MP3 files.
The bad news: None of these schemes is guaranteed to work. If the information is displayed on the screen, then it is accessible in the computer. An illicit program can be designed to repeat the process and store an unprotected copy. An attacker could simply reprogram a device driver or use a debugger to unlock the key to any encryption. These programs, often called "screenscrapers," make illicit copies as they display the information.
Most companies acknowledge this danger but say they just want to make stealing information harder than buying a legitimate copy. George Friedman, chief technical officer at Infraworks, a digital rights management (DRM) developer in Austin, Texas, says, "We know we're going to be hacked, but we've designed our software to be easily upgraded. We plan on plugging the holes as quickly as they're discovered."
Tagged or Tied
Proposed technical solutions can be divided into two camps: tags and locks.
Some companies insert hidden information, called tags or watermarks, into files. These tags can carry messages as simple as, "This document copyrighted 2000 by Wombat Love Music." More complex schemes can personalize watermarks with the legitimate holder's name, enabling the source of an illicit copy to be tracked down.
Locking up data is the other solution. Companies are disabling the printing functions and removing the cut, copy and paste functions from programs in the hope of thwarting document thieves. In some cases, developers are inserting new layers of protection software directly into the operating system to prevent copying at as low a level as possible.
San Jose-based Adobe is experimenting with both technologies. Its Photoshop software allows embedded watermarks in images. These watermarks, developed by Digimarc Corp., can survive cropping, printing, scanning and many compression functions. The system inserts signals of various frequencies into the background noise of an image with discrete fourier analysis. The presence or absence of specific frequencies is distilled into a number showing who owns the image.
Adobe is also expanding protection features in the Portable Document Format (PDF) of Acrobat. This allows print documents to be shipped in a relatively device-independent format. David Lehr, senior business development manager at Adobe, says the latest version has "all of the standard ways to control printing, editing, cut and copy text. What's different is we can lock it to a specific computing habitat."
The new system can examine the unique identification numbers in computers, hard disks or even Zip disks from Roy, Utah-based Iomega Corp. and lock up content so it can be viewed only in those locations. An Acrobat file could be locked up so it can be read only on a computer with a particular IP address. It could be attached to a particular Zip disk so it wouldn't open if copied onto another disk. The system bundles all potential restrictions into a small permissions file containing all the access information.
An extensive data-locking system, InTether, is being built by Infraworks. Its software patches actually infiltrate Windows to prevent piracy. The software blocks unauthorized copies by reprogramming device drivers for printers, disk units and other potential leaks. InTether stores all protected data in one big encrypted file. Any programmer who tries to access the data directly will encounter only noise.
According to Friedman, Infraworks adopted this architecture because it lets the system protect data without changing individual applications. A word processor or spreadsheet, for instance, executes a system call to open a file. InTether intercepts it, sets up the blocks and then decrypts the data.
With InTether, documents can be programmed to be viewed for a certain period of time or a certain number of times. Printed copies can be forbidden or limited to a fixed number. This system enables all possible applications. It's an ambitious undertaking. The company must tackle all operating system versions and modify the software to deal with all changes. New features or versions can break older code.
One big challenge is protecting users' privacy. In recent months, users learned that software was surreptitiously recording and reporting on their usage patterns. In one case, Seattle-based RealNetworks Inc.'s RealAudio player would report every song a user listened to. In another, a toy cursor would report which sites a user visited.
Most Web operations make money by charging each person for access to data. This duplicates the traditional publishing model of selling one copy per reader, although it doesn't provide for lending copies to friends. The model also requires tracking what each person reads, a politically explosive strategy.
Today, many Web sites simply choose to disclose their surveillance procedures in advance. "There's a tremendous utility in personalization. It just will make people's work lives productive," Osder says. But she cautions that "policies have to be crystal clear, and keeping track of people's choices is a very high responsibility."
Fair Use
Another difficult political problem is supporting "fair use." This provision of copyright law gives a legitimate holder of copyrighted material several rights, including the right to make backup copies and to quote small portions of a document. There are too many legal loopholes to summarize here. But supporting the tradition promises to be a challenge for DRM companies.
"There's definitely a camp that feels that if you put too many burdens on the consumers, they're not going to use it. One reason that piracy occurs today is that there's no way to get [the product] legitimately," says Todd Sawicki, minister of the medium (a.k.a. marketing director) at Loudeye Technologies Inc., a Seattle company that processes digital music for the Web. For this reason, many DRM systems let owners of copyrighted material make a limited number of copies. Lehr says Adobe is trying to remain politically neutral by providing a wide range of features that content publishers can use or ignore.
"The publisher can decide I'll let you extract text from a document or I won't.' This is a large debate for the publishing industry to figure out, not for Adobe [to solve]," he says.
Lehr points out that technology may enhance users' opportunities. If an Acrobat file is tied to a particular Zip disk, then that disk can be shared just like a book. The publisher doesn't need to worry about proliferating copies.
Criminalization
A big debate centers on how to deal with programmers who crack the copyright protection - which has already happened with DVD encoding. One problem: There are many legitimate reasons for circumventing the system. A record company wants to reissue an album but has lost the unprotected master. An artist creating a movie poster needs images from the protected MPEG version.
Legitimate tools can quickly spread into the black marketplace.
Another dispute involves users of open-source operating systems like Linux or FreeBSD, who want to hook up new devices to their machines. But manufacturers trying to control their rights worry that open source code will make it easy to circumvent protection mechanisms.
All of these issues are being addressed by a new, fast-growing industry. Many different approaches are being tried, and the marketplace will sort out which solutions are useful and which fail.
Osder says her clients are taking a cautious approach. "The interesting problem for me is how to integrate the pieces," she notes. "How does your content-management system work with your rights system? How do you protect people's privacy while giving them the files they want?" Based on her experience, "management of content rights will be the key to unlocking new business," she says.
Wayner is a freelance writer in Baltimore. You can reach him at pcw@flyzone.com.