Media Wonk

RIP CSS? - March 30, 2007

Is there anything left of CSS—the encryption system used to prevent unauthorized copying of DVDs?

DVDs had been on the market barely more than a year when CSS was fatally hacked by then-16 year old Norwegian Jon Lech Johanson and friends.

But the studios, who had no choice but to continue using CSS despite its being compromised, have long nurtured at least faint hopes that some of the damage might one day be repaired.

The plan was to introduce additional security measures to CSS, such as secure bus encryption and digital watermarks, that software developers and hardware makers would have to implement in future DVD players. In exchange, the studios would authorized a limited amount of “managed copying” and “managed recording” of DVDs: copy your DVD to a hard drive using approved DRM; burn a DVD from downloaded content.

The vehicle for the grand compromise was to be the CSS license agreement, as administered by the DVD Copy Control Assn., and which all DVD player manufacturers must accept if they want their players to be able to decrypt major studio movies.

In addition to describing the technical specifications of CSS, the agreement spells out the way DVD drives must, and must not, be designed. For instance: no digital outputs on set-top DVD players; mandatory implementation of regional restrictions on playback; and no using a licensed DVD drive to build a device for copying DVDs.

Under the grand compromise, the terms of the CSS license would be amended to prescribe exactly how such copying could be done and the sort of DRM the receiving device would need to support.

The key to the whole megillah, though, was the ability to enforce the rules in the license agreement.

With the ruling Thursday by California Superior Court Judge Leslie C. Nichols in DVD-CCA’s breach-of-contract suit against Kaleidescape Systems, a maker of high-end home media servers, that ability is now in doubt.

Kaleidescape’s servers let users store the contents of hundreds of DVDs on a hard drive and then access them over a home network. To get the contents onto the hard drive you load your the DVD to the server’s (CSS-licensed) DVD drive, which then decrypts and copies the data.

DVD-CCA claimed that design violated the CSS license by, among other things, using a licensed drive to build a DVD copying device, and permitting playback of DVD content without the original disc being present in the DVD drive.

According to Judge Nichols, however, those rules are contained in a separate document from the CSS technical specifications covered by the license. And the separate document is not properly incorporated into the agreement.

Therefore, the rules spelled out in that separate document cannot be enforced.

Apart from the embarrassment visited on DVD-CCA’s drafters, the ruling throws into doubt the studios’ hopes of extending CSS to incorporate new business models for DVD such as managed copy.

If you can’t enforce the license as it is, you surely can’t enforce whatever new security requirements you hoped to include in a managed-copy agreement.

While DVD-CCA has vowed to appeal the ruling (which admittedly is weird and picayune) it’s hard to imagine the industry discussions around a managed-copy agreement getting anywhere until the mess is sorted out.

By then, you’re likely to have any number of other servers on the market merrily making managed copies on their own and the question of reaching an agreement will be moot.

So, too, will studio hopes of using managed copy to patch the holes in CSS.

LEAVE A COMMENT