This is a big deal, but it's technical enough that it's flying under the radar of most media outlets, I'm afraid.

First, some background. As things like Flash are (rightly) being phased out, the W3C decided that it needed something new. For those who don't know, the W3C (short for the World Wide Web Consortium) is a group of techies, companies, non-profits, etc. who get together and decide about standards for how the Internet should work. HTML? The standard for that is established by the W3C.

In the past, it's always worked on a consensus, meaning unanimity. But then about four years ago, it began developing a new standard for DRM, particularly for video. The idea is that companies like Netflix, Amazon, and YouTube want to be able to control access to their content, and make it harder for people to watch it if they're not supposed to, or to rip a stream for later use, etc.

So a few months back the W3C came up with a new standard, called Encrypted Media Extensions (EME). This standard is much broader and more intrusive than before, and ignores the legal frameworks in the US and EU. I also find it significant that the editors on the report of the standard all work for Google, Microsoft, or Netflix.

The Electronic Frontier Foundation (EFF) raised three main problems.

First: security and privacy. Thanks to the DMCA (and its EU equivalent), it is a felony to circumvent any form of DRM. This means that if, say, Amazon were to implement this form of DRM, there is absolutely no legal way for researchers to test a given implementation of the standard to see if it actually works, or if there are any gaps. Instead, we'd just have to wait for someone who doesn't care about the law to find such a gap, hack a ton of people, and then hope that Amazon fixes it. It's a black box, on a potentially unprecedented scale.

Second: accessibility. The W3C rejected a covenant that would have made an exception to the aforementioned anti-circumvention law for bots that do things like add subtitles or photosensitivity warnings. The W3C director's decision ignored the DMCA implications, saying only that the W3C working group had found no issues with accessing things like subtitles. But that wasn't the objection; the objection was that no one can add those things other than the content providers.

Third: Content decryption modules (CDMs). These are the things in your browser, the plugin or built-in code. Just like when Flash was at its zenith, it basically means that you have to go to Adobe or whoever else for permission to use certain kinds of content. Where this gets to be a problem is that it means that if anyone wants to be allowed to use the standard, they have to do anything and everything that the content providers permit. There's nothing to stop them from denying a given plugin or browser maker a CDM license. Given that the keys are stored by the content provider, this in turn means they can lock out anyone who doesn't use conforming software.

The EFF appealed the decision to accept the EME standard, which was the first appeal in the history of the W3C. Their earlier formal objections go into detail about many of the problems. The appeal was rejected, and despite only 58% of members supporting the plan (a big deal in a group that has always relied on consensus, like I said), it was formally adopted.

This has in turn prompted the EFF to resign from the W3C.

So. This really is a big deal, despite the fact that adhering to the standard is ostensibly voluntary. By all being on board, it means that many of the largest content providers (including Google (which means YouTube), Amazon, and Netflix) are in a position to require that the new standard be used if you want to use their services. It allows them to create a monopoly while avoiding antitrust law. It may also mean that Linux and other open-source operating systems are entirely cut off from EME-protected content, although that remains to be seen. And it allows these corporations to do all this without having to take responsibility for it: they can wash their hands and say they're just following the standards set by an independent organization.

Moreover, it may actually make ISPs have to do the same, at least in the US. The same federal law that shields ISPs from liability for what gets transmitted over their networks (e.g. piracy) only provides this shield if ISPs "accommodate[] and do[] not interfere with standard technical measures." These "measures" are anything used by a copyright holder to protect its works that is available to anyone, does not impose a substantial burden on the ISP, and "ha[s] been developed pursuant to a broad consensus of copyright owners and service providers in an open, fair, voluntary, multi-industry standards process." That is, the W3C.


posted 2403 days ago