Monday, September 18, 2006

NZ: SCC wants to avoid data lock-out

New Zealand takes a sensible lead in drafting requirements for DRM systems:
http://www.stuff.co.nz/stuff/0,2106,3799364a28,00.html

(Thanks MotherLUG)

The Government will consider vesting an agency with powers to strip digital restrictions off documents containing government information.

The State Services Commission released a set of policies advising government departments how to use digital rights management (DRM) - under which only certain software can open certain files - as well as Trusted Computing, which embeds technology in hardware to make information on it harder to view, steal or alter.

DRM is commonly used to impose restrictions on media files to prevent "piracy" of films and music, but can apply to any proprietary file formats that can only be read by certain software. Trusted Computing is a concept involving several technologies promoted by a group of industry heavyweights that include AMD, Microsoft, HP and IBM.

The SSC wants to ensure government agencies can always access their own information. It says government agencies must not use DRM or Trusted Computing unless there's a clear business reason to do so.

They also call for an independent agency - probably Archives New Zealand - to hold "master keys" to all tools that government agencies applied to restrict access to documents. This would let it strip DRM protection from documents to regain control of the information in them if it needed to.

Without a master key, the SSC fears the Government might not be able to access documents if software companies went bust, refused to support older versions of their products, or got into a dispute with the Government.

The policies also ensure digital restrictions used by the Government don't violate citizen's privacy rights.

State Services Commission spokesman Jason Ryan says the policies are deliberately written without mentioning New Zealand, in the hope that other countries might adopt the same guidelines.

"We wanted the document to spark debates in other jurisdictions," he says.

Mr Ryan says if more countries adopt similar policies, software and hardware vendors would be more likely to start designing products to meet their requirements.

Trusted Computing is controversial with privacy groups because it can involve recording the software that is used on computers to verify DRM hasn't been compromised.

It's more commonly used to encrypt data on a hard drive so it can't be accessed if it's stolen, and to make computers less susceptible to viruses.

So far DRM tools have been relatively easy to circumvent.

However, if DRM is combined with Trusted Computing - for example, by ensuring a file can only be run on the computer that created it, or with software that hasn't been altered - the prospect of users being locked out of documents could become a more pressing issue.

No comments: