From DRM to Rights Management Services

miladus writes "Microsoft has formed an academic Think Tank on Trustworthy Computing. The Academic Board is to advise Microsoft on 'security, privacy and reliability enhancements in[...] products and technologies so that Microsoft can obtain critical feedback on product and policy issues related to its Trustworthy Computing.' An interview with two members of the board is an interesting read, especially concerning the global implications of privacy. Of note, is the absence of DRM discussion. But DRM shows up as 'Rights Management Services' in the promised Widows Rights Management Services to be released later this year. it will deliver a 'platform-based approach to persistent policy rights for Web content and sensitive corporate documents of all types'"

Comments

The question is...

[alhobbel]

how much will those brainiacs get paid? I've never trusted "scientific" opinions from researchers paid by commercial companies. (What's more, I don't even trust most scientific opinions:)

What happens when MS has a new version of Office?

[rickthewizkid]

So, Everyone that goes to the new version of Office will be locked into a forced upgrade stream? What happens when MS comes out with Office 12? Will everyone that uses 11 find that their documents suddenly "expire" because the new version of office is out?

I don't like it. MS wants to control every 0 and 1 that flows through your computer.

Looks like its time to dig out the 'ole Commodore 64. :)

Just my 64k-is-enough-for-me's worth
-RickTheWizKid

Good stuff

[t0ny]

things like this are really essential, especially for companies and organizations that have concerns about confidential information.

For example, where I work, we are required by law to have a level of security on certain information; this info should never be reaching people who do not fall under the same laws.

With a technology in place to protect that data, our jobs as the IT staff becomes much easier.

MS is, in my view, breaking new ground with this; some people may not like what they are doing, but you have to admit that nobody else is putting this stuff into their OS (when there is clearly a need for it).

Re:Good stuff

[Anonymous Coward]

DRM is not information security.

Re:Good stuff

[t0ny]

Thats right. And the article wasnt about DRM. Didnt you read the article (or even the /. summary)? Taken right from the summary:

Of note, is the absence of DRM discussion.

Re:Good stuff

[fermion]

While I certainly see how access control to certain documents is beneficial to many entities, I do not understand how this product would be beneficial to companies with real security concerns.

For example, if all one wishes to do is help insure that internal memos are not leaked to f*ckedcompany, this technology will provide a useful barrier. However, if you are trying to protect patient transcripts, one would hope that a suitable technology is already implemented. After all, MS Office, and MS Office, has many insecurities because it tries to be a business and consumer level jack of all trades. To me, security is enhanced by having only the necessary features integrated into a packaged built for the type of security mandated by the regulations

Even for stopping leaks, success is probably dependent upon enforcement of DCMA. Anyone who copies and pastes will be guilt of circumvention.

Re:What happens when MS has a new version of Offic

[Billly Gates]

Or as another way to look at it will companies like Enron use drm to make sure to obstruct justice or have their documents timebomb after each quarter so there is no evidence?

Will Microsoft use drm to make sure the DOJ can not investigate them for illegal practices. If Bill Gates unfamouns email about choking netscapes air supply timebombs then the doj would have no evidence. Case closed!

I'm missing something. . .

[Rojo^]

How exactly is Digital Rights Management expected to work? Is the idea sort of a "this message will self destruct in five seconds" kind of deal? From DRM story to DRM story posted on Slashdot, I see the discussions range from privacy and data integrity to piracy or rights. The ability to cause sensitive data to disappear seems more like a technological tool that can be added to other tools for specific types of communication, not some imposition of our rights to download w4r3z on KaZaA or whatever. In fact, if I get sent an email that will self-destruct, what's keeping me from forwarding that message to a sendmail server with no such mechanism for message self-destruction, copying / pasting the message into a text document, or even screenshotting the contents? This comment isn't meant to flame or troll -- I simply want to know what I don't.

I must be paranoid . . .

[Idou]

but I think you must trust MS 100% before this can be considered a "good thing."

"With a technology in place to protect that data, our jobs as the IT staff becomes much easier."

It's very simple, if, say, my medical information gets out 'cause some MSCE stopped thinking about security 'cause MS told them to, you better believe I am going to do everything in my power to destroy that incompetent individual's career.

I see people stupidly pick MS all the time for no other reason than it is "MS." Well guess what, most of the time things are NOT working as a result. That's fine, but when we are talking about security required by laws, you better make damn sure YOU actually understand the system you are implementing, and I have yet seen an MS product implemented by someone who actually had an understanding of the innerworkings of the product (though they did read the marketing brochure . . .).

Re:What happens when MS has a new version of Offic

[Pray_4_Mojo]

While the implications of Microsoft being able to leverage ("embrace and extend") any built in DRM/CRM (Digital Rights Management/Content Rights Management) is disturbing, what worse is that companies are going to jump all over this kind of technology. It literally allows the company to control information from CEO right down to the mailboy's desktop. To a corporation that doesn't respect/trust/value its employees, this technology is a godsend, up there with keystroke loggers.

What's worse, is it will allow corporations to act with even more impunity. Microsoft isn't the only corporation whose business model could stand to gain something through DRM. They're talking about restricting what a person can do with data -- including preventing that "We're Dead if this thing shows up in court" memo from being printed by a Whistleblower.

Letting corporations act solely in their best interest, and preventing the individual from counter acting in his, is a dire formula for a free society.

Re:Widows

[kfg]

If you can't read or spell of what use is previewing?

KFG

RMS != security

[argoff]

You could have rights managment systems out the yinyang, but if the software running it is full of bugs, buffer overflows, back doors, code that auto preruns unauthorized stuff, or sends private info to MS headquarters (Yeah I know MS would never have eny of these problems) Then it will not matter a bit, even if every damn piece of data and code is digitally signed, registered, and pre-authed - it won't matter. In fact it could make things worse as people actually leave their systems less secure - assuming that they are less hackable or that they will know when people copy stuff. BZZZT. God help them, they'll need it.

No. MS is more subtle than that

[kfg]

Here's how it works. The new version of Office comes out, and it's perfectly backward compatable.

But it isn't *forward* compatible.

So all you have to do is get one company that a lot of other companies need to do business with in on the plot and get them to make the switch.

Your Office documents are perfectly readable by them, but everything they send YOU your older version can't read. So if you want to continue to do business with them you have to switch too.

It's a very effective way to force upgrades without giving any overt appearance that that's what you're doing.

They don't lock you out of your documents. They lock you out of everybody else's.

KFG

Are 'time-bombed documents' illegal?

[nurb432]

As an evasion of the law, its not much different then paper shredding of documents that shows one guilt.. "paperless office"

Again, I must be paranoid . . .

[Idou]

but I don't believe in the "black box" form of security. If something is not transparent to me, then I cannot access whether or not it is secure or not (and neither can a third party), and if I was in the business of security, I would not be meeting my legal obligation of "professional due care" simply by buying a black box.

If you consider the above "MS bashing" then I think you have been exposing yourself to too much "MS marketing," 'cause I am just telling you how it is. If that is my personal data you are handling, and you are using the MS "black box" to "protect" it, I will sue you and your organization if that information gets out.

Clear and simple. You are not performing your duty, you are just maintaining a black box on the basis that MS marketing would never lie, and marketing buzz words like "trusted computing" does not change that fact.

Ulterior motive

[Hellkitten]

Seeing how DRM has become a negative abbreviation they are trying to move away from it, but realizing that this could happen to whatever acronym they choose the have chosen one that hurts their opponents too

If RMS became the tree letters people associate with taking control away from users and into the hands of the bic corportaions houw would that affect the credibility of free software champion RMS?