3 October 2013

W3C Approves DRM in Web Standards

This is terrible news. The World Wide Web Consortium (W3C) has allowed DRM to become part of the specification for HTML5. This means that going forward, browsers will no longer be under the full control of their users.

The Electronic Frontier Foundation (EFF) predicts that this is just the beginning and this move could eventually lead to browser flags to prevent viewing page source, restricting downloading of images and preventing inspection of Javascript. Now that "protected content" is accepted, it will surely spread to these other areas.

We pointed out that EME would by no means be the last "protected content" proposal to be put forward for the W3C's consideration. EME is exclusively concerned with video content, because EME's primary advocate, Netflix, is still required to wrap some of its film and TV offerings in DRM as part of its legacy contracts with Hollywood. But there are plenty of other rightsholders beyond Hollywood who would like to impose controls on how their content is consumed.

Just five years ago, font companies tried to demand DRM-like standards for embedded Web fonts. These Web typography wars fizzled out without the adoption of these restrictions, but now that such technical restrictions are clearly "in scope," why wouldn't typographers come back with an argument for new limits on what browsers can do?

Indeed, within a few weeks of EME hitting the headlines, a community group within W3C formed around the idea of locking away Web code, so that Web applications could only be executed but not examined online. Static image creators such as photographers are eager for the W3C to help lock down embedded images. Shortly after our Tokyo discussions, another group proposed their new W3C use-case: "protecting" content that had been saved locally from a Web page from being accessed without further restrictions. Meanwhile, publishers have advocated that HTML textual content should have DRM features for many years.

A Web where you cannot cut and paste text; where your browser can't "Save As..." an image; where the "allowed" uses of saved files are monitored beyond the browser; where JavaScript is sealed away in opaque tombs; and maybe even where we can no longer effectively "View Source" on some sites, is a very different Web from the one we have today. It's a Web where user agents—browsers—must navigate a nest of enforced duties every time they visit a page. It's a place where the next Tim Berners-Lee or Mozilla, if they were building a new browser from scratch, couldn't just look up the details of all the "Web" technologies. They'd have to negotiate and sign compliance agreements with a raft of DRM providers just to be fully standards-compliant and interoperable.

The decision to allow DRM into web standards is a huge step backwards for the internet, for openness and for the rights of users.

Edit: This may actually be the fatal blow needed to finally kill Adobe Flash in the browser. Flash is mostly just used for delivering video these days due to it's built in DRM features. If DRM enabled video capabilities come baked into browsers, there will no longer be a need to continue using Flash in most cases. This is a win for users as their browsers will be much more secure without Flash installed.

However, it seems that the HTML5 specification doesn't actually provide a DRM implementation, just a method for such an implementation. This means that although we could end up killing Flash, we may be lumbered with countless DRM plug-ins that are only compatible with one or two sites each and may even be worse in terms of security and memory usage than Flash is. We will just have to wait and see.

Post a comment

(required)

(required)

(required, not published)

(optional)