OSS Watch team blog

I never expected to see a reference to Digg on the BBC News’ front page. Although both have esteemed positions among my rss feeds, somehow I just couldn’t see their spheres overlapping. Digg, if you haven’t heard of it, is a technology news site that operates on a collaborative filtering principle. Web links are submitted by users, and other users vote for (or ‘digg’, to adopt the site’s cyber-hipster dialect) the links that they find interesting. Digg’s front page is a sociological snapshot of the preoccupations of geekdom. Stories on technological issues like Digital Rights Management, open source software and console gaming are side by side with links to political blogs, movie trailers, Youtube rips of last night’s Colbert Report and paparazzi shots of starlets getting out of cars with low suspension.

Being the kind of site it is, Digg has repeatedly covered the attempts by amateur technologists to circumvent the copy protection on the next generation of video discs. Sony’s Blu-Ray and Toshiba’s HD-DVD formats both use complex encryption techniques to try to prevent consumers from duplicating their contents. Feelings run high on both sides of this issue. Many argue that it is unreasonable of content providers to prevent their customers from making backups of the movies that they buy. Content providers point to the widespread copyright violation on the internet as the reason that they have to take aggressive steps to protect their products from illegal duplication. In the case of DVDs, the encryption employed (dubbed CSS or Content Scrambling System) was defeated rapidly, and this has prompted the copyright-supported industries to spend a lot of effort and expense on its replacement - AACS or Advanced Access Content System.

Media copy protection as an endeavour has one major problem - a truly secure scheme would have to prevent the consumer from watching the content. As consumers were not likely to tolerate this totally secure scheme, a compromise had to be found. Thus the means to decrypt (and watch or copy) the content are provided to the consumer on the disc, but they are hidden. Having learned from the failure of CSS - in which a software player was hacked to reveal its decryption key - the content providers have made AACS’ method of hiding the key extremely complex. Keys from the player’s software, the player’s disc drive and the disc itself are needed to play the content. Despite these complications, immense effort has been deployed by amateur technologists to find the keys, and earlier than many expected, cracks in AACS have begun to emerge. Until very recently these efforts had been ignored by the AACS-LA, the trade body that administers this copy protection technology. They always expected some keys to be compromised, and had built a key revocation system into AACS to deal with this. If someone hacked your model of player to gain its device keys, the AACS-LA would change the encryption on all future discs to make them unplayable on that model. As a consumer you would have to upgrade the player’s firmware yourself, have your retailer do it or be content to only watch old discs. Obviously this would annoy a lot of people but better that - the content providers reasoned - than have the entire format compromised as happened with DVD.

However, in February 2007 it emerged that AACS had been compromised further. A hacked HD-DVD player had been used to successfully discover a ‘processing’ key. Although this key could be rendered invalid through revocation - just like the device keys - the hacked player could always be used to generate a new processing key from newly released discs. If the AACS-LA wanted to plug this hole in their copy protection scheme, they would have to prevent the dissemination of the newly-discovered processing key and all of its successors.

On May 1st, the AACS-LA started issuing takedown notices under Title One of the DMCA (Digital Millennium Copyright Act) to everyone listed in Google as having posted the key. If your site featured those sixteen hex pairs, the AACS-LA argued, you were abetting the circumvention of a ‘technological protection method’ as defined within the DMCA. Worse still, the so-called ’safe harbors’ introduced within the DMCA to protect web sites and ISPs from copyright infringement by their users did not apply to the posting of these numbers. The AACS-LA were not claiming ownership of copyright in the numbers - it is likely that there is no copyright in them to be owned.

Digg had a story on the discovery of the processing key dating back to February. When they received a takedown notice from the AACS-LA requesting that they remove the story - which included the key itself - they complied. If they had failed to do so, they would have risked a civil action alleging contributory liability for copyright infringement. Unfortunately for Digg’s administrators, some of their users noticed that the story had disappeared. Due to the mass-moderated nature of the site and the prickliness of its users on the subject of censorship, a new story featuring the key was soon surfing to the top of the front page. Digg’s admins deleted that one too. Another emerged. That too was deleted, and the user who posted it was banned…

I was watching this happen just before going to bed on the night of the May 1st. Digg’s admins had just put up a blog post explaining that they were a small team and that a civil action from the AACS-LA could destroy them. Stories featuring the processing key kept appearing then getting deleted. When I got up the next morning, every story on the front page featured the key and most of them a good few expletives. Checking the Digg blog I saw that the admins had given up.

On reflection I think that the BBC were right to give the story coverage. While it’s easy to caricature it as a cadre of geeks throwing a hissy fit, in fact it encapsulates a large issue around the emerging framework of internet reporting, and the legal frameworks that surround it. The incredible success of Digg’s collaborative filtering model of content discovery is being aped everywhere, from MySpace to Netscape.com to BBC News itself (with its ‘Most Emailed/Most Read’ boxes). Implicit in this model is the recognition that however good your editors are, your users are really the experts on what they themselves want to read. Digg’s owners make large amounts of advertising revenue for essentially just providing a sexy AJAX framework for users to interact, all under an attractive brand. Why is the brand attractive? Because it is defined by those it attracts - in a never-ending iterative process. Digg’s users have made the Digg brand stand for (among other things) rabid opposition to DRM. While legal action from the copyright-supported industries could destroy a site like Digg, alienating its users most definitely will.