From: Robert Hettinga <rah@shipwright.com>
Date: Sun, 9 Nov 1997 02:34:27 +0800
To: cryptography@c2.net
Subject: Content controls
Message-ID: <v03110712b08a5490f95c@[139.167.130.248]>
MIME-Version: 1.0
Content-Type: text/plain




--- begin forwarded text


X-Sender: hutchinson@click.ncri.com
Mime-Version: 1.0
Date: Sat, 8 Nov 1997 09:29:04 -0500
To: Robert Hettinga <rah@shipwright.com>
From: hutchinson@ncri.com (Art Hutchinson)
Subject: Content controls
Cc: whgiii@invweb.net, dcsb@ai.mit.edu
Sender: bounce-dcsb@ai.mit.edu
Precedence: bulk
Reply-To: hutchinson@ncri.com (Art Hutchinson)

>>>A whole bunch of people are now talking about these cash-settled recursive
>>>auction processes, and they're a direct, and now obvious, consequence of
>>>bearer (or at least instant) settlement markets for information on geodesic
>>>networks. When you add anonymity to the transaction, you pretty much have
>>>the final straw for "rights" tracking. Watermarks just tell you who the
>>>information was stolen from, for instance. So, one more industrial
>>>information process bites the dust.
>
>>Whoa!  Hang on here.  Sure, watermarks will tell you who information was
>>stolen from, but they're just a stalking horse... a weak second cousin to
>>*persistent* content control technologies (such as IBM's Cryptolopes and
>>Intertrust's Digiboxes).  These allow rightsholders to manage a wide
>>range of parameters (including price, usage context, and any other
>>variable for which you can imagine having a certificate).  Whats
>>fundamentally different about what are generically referred to as secure
>>envelopes, is that they can maintain controls *indefinitely*
>>(persistence), across an un-
>>known, ad hoc, web of distribution over which one otherwise has no
>>control.  And yes, this can all work even in a completely disconnected
>>environment (laptop at 35,000 feet).
>
>>They allow rightsholders, if they so choose, to *continue* being rights-
>>holders in a highly networked, digital world, and in a wide range of new
>>ways, based on entirely new (or old) business models, that take advantage
>>of rich/elaborate conditions for usage (e.g. you can view this picture
>>anonymously, but it will cost you 2X as much, and you can only get it at
>>low resolution, and you can't view it at all unless you can prove that
>>you don't live in the Middle East).  No certificate for these conditions?
>>Sorry, no content.
>
>>They are based the same basic stuff (public key cryptography of course)
>>that *can* fuel wild anarchic visions of anonymous exchange.  ;)
>
>>But they aren't at all deterministic of any particular economic model.
>
>Well how exactly does one prevent data from being stolen once it has been
>unlocked? I pay my 2X to view the picture anonymously and now I copy it
>save it and distribute it worldwide. I fail to see how any
>encryption/watermark scheme can prevent me from doing so.

The control technologies to which I referred earlier turn the lock/unlock
idea into far more than a binary choice.  This is what I meant by
"persistence".  The content cannot be used without its accompanying
control set (which again, *might* include payment).  Part of the control
set I may impose on anonymous viewers could include preventing them from
copying or saving the content directly in digital form.

This is counter-intuitive to those of us who are used to having cut/paste
available at our fingertips in most applications, but its relatively trivial
to disable these functions on a file by file basis.  Alternatively, I might
impose controls that permit anonymous users to see *only* lower reso-
lution versions. (by analogy, if you're going to wear a ski mask into a
jewelry store, you aren't likely to be shown the expensive stuff - if they
let you in the door in the first place).

If you were really determined, you could always take a photo of the
screen, re-scan it, do some image enhancement to get rid of the graini-
ness, re-save it and post it on your web page for all to see, (the
so-called digital-to-analog-to-digital work-around), but this is darned
inconvenient.
Also, try doing that with music or movies.... while avoiding the roving
automated net 'bots that will be out looking for illegal copies of content
(these are already common).  Not worth it.  For most people.

If it were, we'd already have massive illegal scanning operations in
third-world countries, and plenty of demand for their wares.  Sure,
this exists, and may even grow a bit around the fringes, but this hardly
proves the case for a single vision of an anarchic Robin Hood future for
all content (Sell today else I rip you off tomorrow!!)

As a non-disclosed third party, I'm not at liberty to discuss the 'guts' of
either the Crytolope or Digibox technologies (though I have seen them)
Both are covered, as you might imagine, by a fairly extensive array of
active and pending patents.  If you want to learn more, I'd recommend
contacting them directly:

www.intertrust.com   (or their partner, Softbank NetSolutions)
www.infomkt.ibm.com

Cheers.

- Art

Art Hutchinson                                       hutchinson@ncri.com
Northeast Consulting Resources, Inc.     phone: (617) 654-0635
One Liberty Square                                 fax: (617) 654-0654
Boston, MA 02160                                 www.ncri.com
------------------------------------------------------------------------------
"Working at the intersection of business and IT strategy to
help organizations embrace electronic commerce opportunities"



For help on using this list (especially unsubscribing), send a message to
"dcsb-request@ai.mit.edu" with one line of text: "help".

--- end forwarded text



-----------------
Robert Hettinga (rah@shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>