Some interesting discussion of the next generation encryption of DVDs

Ed Felten over at Freedom to Tinker dissects the new encryption system being considered for DVDs. The existing system of encryption of (and 'technological protection' of) DVDs is the 'CSS' (Content Scrambling System). Whatis.com offer this definition of CSS:

'Content Scrambling System (CSS) is a data encryption and authentication method used to protect digital versatile disk (DVD) movies from being illegally copied, distributed, and viewed from other devices, such as computer hard drives. CSS is one of several copy-protection methods currently used in today's DVDs.
The CSS method was developed by members of the DVD Copy Control Association (DVDCCA). This association includes companies in the U.S. motion picture industry (members of the MPAA) and the consumer electronics industry. The Matsushita and Toshiba companies are largely credited with the first main development efforts of the CSS method for encryption and decryption of DVD movies.'

CSS used a system which was notoriously easy to circumvent. It was 'broken' in 1999 by Norweigian teenager Jon Johanson, who wrote and released 'DeCSS'. This little bit of code led to some really big and expensive litigation, including the notorious 'DeCSS' case in the United States, where major movie studios, members of the MPAA, sued 2600 Magazine and its publisher, Emmanuel Goldstein, for violation of the Digital Millennium Copyright Act, Section 1201. The studios claimed that by posting and linking to DeCSS, 2600 was providing a technology for "circumvention" of access and copy controls on copyrighted works. The Second Circuit Court of Appeals, in New York, agreed with the studios that DeCSS was an unlawful circumvention device. For more of a story on DeCSS, see the Wikipedia entry.

So much for background. The interesting thing is that, according to Ed Felten, the new encryption system is more effective - at least in limiting entry for prospective makers of DVD players. This is because, according to Ed Felten,

Each player device is assigned a DeviceID (which might not be unique to that device), and is given decryption keys that correspond to its DeviceID. When a disc is made, a random "disc key" is generated and the video content on the disc is encrypted under the disc key. The disc key is encrypted in a special way and is then written onto the disc.
When a player device wants to read a disc, the player first uses its own decryption keys (which, remember, are specific to the player's DeviceID) to unlock the disc key; then it uses the disc key to unlock the content.
This scheme limits entry to the market for players, because you can't build a player without getting a valid DeviceID and the corresponding secret keys. This allows the central licensing authority, which hands out DeviceIDs and keys, to control who can make players. But there's another way to get that information -- you could reverse-engineer another player device and extract its DeviceID and keys, and then you could make your own players, without permission from the licensing authority.
To stop this, the licensing authority will maintain a blacklist of "compromised" DeviceIDs. Newly manufactured discs will be made so that their disc keys can be unlocked only by DeviceIDs that aren't on the blacklist. If a DeviceID is added to the blacklist today, then players with that DeviceID won't be able to play discs that are manufactured in the future; but they will still be able to play discs manufactured in the past.

Ed Felten's view that this could be effective has led to some quite extended debates in the comments section on this post; they are worth a read.

Relevance for Australia? Well, assuming it all goes ahead, we will get it too of course. And the usual issues apply. First, as I understand it, this will again make it harder for open source people to produce DVD players. At the moment, as I understand it, it is possible to get an open source program for playing DVDs on your PC, either with DeCSS already in there (or you can find DeCSS and install it as necessary). All these systems which seek to tie encryption to a licensing body create possibilities for refusing licenses for open source players. Doesn't mean such licenses won't be granted ever, but they could be hard to do.

Second area of relevance: such a system could be used to continue the practice of region-coding, which has been of considerable policy concern here in Australia. In general, policy-makers have indicated that they don't want to do things that will enforce region-coding. The current system of region-coding has been relatively easy to attack at least on policy grounds because the region-coding purpose of the encryption and its keys is so transparent - partly because it is not an individualised system. In a system where DeviceIDs are issued only to a limited number of devices (if that is indeed possible), the system can STILL be used for region-coding, but when you circumvent these individualised codes, it is going to be that much harder to argue that you are circumventing JUST to overcome the region-coding.