4 ms·

> So where do you draw the line? A reasonable suggestion would be to draw the line around private data. By design, DRM is intended to restrict people's use of

> So where do you draw the line? A reasonable suggestion would be to draw the line around private data. By design, DRM is intended to restrict people's use of data which the publisher wants to spread as widely as possible (on the condition that they are paid for every copy). This data is therefore not private in any sense. All your other examples work with this line: Private keys are obviously private; internal company documents are "private" in the same sense that corporations are people; government secrets are private (and countries are legal people); and Facebook should be keeping people's personal data secret on their behalf.

comboy 6y ago
It somewhat pushes the answer into "private" definition but it does sound good. But then, if a company implements DRM using its private key and somebody steals that private key?
- dane-pgp 6y ago
  Well, I think that protecting "private" data should be the default but there would be exceptions (because reality is complicated, and so is the law). For example, I don't think that all information created by a government should be given the same protections as information about individual humans, which is why we have Freedom of Information laws. I would even go so far as to say that this principle should apply to corporations, at least for information that is no longer commercially relevant. We already have "public interest" exceptions for things like reporters exposing the private lives of politicians, and that sort of careful consideration also has to be applied to requests invoking "the right to be forgotten". Anyway, even if a society didn't make DRM systems illegal outright, it could accept a legal judgement that "private keys" which are distributed to end user devices are not to be considered private. As a practical matter, though, if your DRM system relies on the secrecy of a key that can fit in a QR code, then you shouldn't expect the law to put that genie back in the bottle for you.

comboy 6y ago

It somewhat pushes the answer into "private" definition but it does sound good. But then, if a company implements DRM using its private key and somebody steals that private key?

dane-pgp 6y ago
Well, I think that protecting "private" data should be the default but there would be exceptions (because reality is complicated, and so is the law). For example, I don't think that all information created by a government should be given the same protections as information about individual humans, which is why we have Freedom of Information laws. I would even go so far as to say that this principle should apply to corporations, at least for information that is no longer commercially relevant. We already have "public interest" exceptions for things like reporters exposing the private lives of politicians, and that sort of careful consideration also has to be applied to requests invoking "the right to be forgotten". Anyway, even if a society didn't make DRM systems illegal outright, it could accept a legal judgement that "private keys" which are distributed to end user devices are not to be considered private. As a practical matter, though, if your DRM system relies on the secrecy of a key that can fit in a QR code, then you shouldn't expect the law to put that genie back in the bottle for you.