top | item 5773020

US entertainment industry to Congress: make it legal for us to deploy rootkits

608 points| Suraj-Sun | 12 years ago |boingboing.net | reply

257 comments

order
[+] beloch|12 years ago|reply
What qualities do people look for when buying movies and music?

1. The content they want.

2. Quality (i.e. resolution, bitrate, etc.)

3. Reliability (it actually plays)

4. Low annoyance (no ads, warnings, etc.)

5. Safety (guaranteed freedom from malware, etc.)

The movie and music industries haven't done a perfect job of delivering #1-4. Region coding means the content users want is frequently only available through pirate channels. Lower quality releases (DVD vs Bluray) are also often all that is available in some regions. Bluray is not reliable if users don't keep their hardware/software up to date. Nearly all DVD's and bluray discs on the market are utterly infested with annoying advertisements and warning screens.

#5 was the one thing that legally purchased media had an undeniable edge in over pirated media. If users lose trust in the safety of legally purchased media they will be driven to piracy in unprecedented numbers.

It is tempting to give RIAA and MPAA the rope to hang themselves with, sit back, and laugh. However, let's not forget that every piece of code they write and every root-kit they successfully deploy will soon be taken advantage of by black-hats, quite probably in ways that will cause damage to systems completely unrelated to media playback of any sort. The only way I can see to let the MPAA/RIAA proceed is to require them to post a significant bond (in the billions) to pay for damages their rootkits will cause. Managing how damages are going to be awarded is going to be a legal nightmare though, since this will not affect only U.S. systems and citizens. If the U.S. permits this, I sincerely hope other nations hold the U.S. government responsible for damages, so the U.S. had better make sure Hollywood is ready to foot the bill.

[+] shmerl|12 years ago|reply
#5 Safety (guaranteed freedom from malware, etc.)... was the one thing that legally purchased media had an undeniable edge in over pirated media.

Disagreed. Sony rootkit was on the legally purchased media. DRM on streaming services can do all kind of stuff without users consent. DRM built into hardware with cameras can do even weirder stuff (just note the crazy DRM idea patented by Microsoft regarding detecting the people in the room). Since DRM is a black box, you never know what it can do. There is completely no reason to trust that it will respect your privacy and rights. Therefore DRMed media has no edge over pirated media at all.

Safety requires transparency (for the user), as well as trust in the used technology. DRM by its very definition is non trustworthy and non transparent, it's the antithesis of that. It's totally opaque precisely because it attempts to hide something from the user. Because ironically, DRM proponents don't trust the user! User is treated as potential criminal by default. How can users in situation when they aren't trusted, trust the DRM vendor in return? They can not, and they should not! Trust can be only mutual. I.e. DRM always implies something shady and risky. DRM proponents should be treated as potential criminals by default in return. And what do such criminals usually hide in their code? Malware.

[+] rednukleus|12 years ago|reply
You left out one important point:

6. Convenience.

I believe that the content industry is relying on a sufficient number of people still finding it easier to buy a DVD/Bluray rather than pirate. For technical people, pirating is already sometimes more convenient for reasons that you stated.

There is also a

7. Ethics

Some people do not find pirating ethical under any circumstances, and will inconvenience themselves to avoid it.

[+] TeMPOraL|12 years ago|reply
> However, let's not forget that every piece of code they write and every root-kit they successfully deploy will soon be taken advantage of by black-hats, quite probably in ways that will cause damage to systems completely unrelated to media playback of any sort.

It will be stupidly easy to execute; if the malware shuts down computer when it detects illegal download, the only thing an attacker needs to do is to trick the computer/user into downloading illegal content. And that's it. Though this simple trick doesn't let them steal data or take control of the computer, there are many uses an attacker can find for just killing the machine. Blackmailing, social engineering, or just disturbing some crucial business operations. I can even imagine 4chan folks trolling people like this for fun.

[+] spindritf|12 years ago|reply
> It is tempting to give RIAA and MPAA the rope to hang themselves with, sit back, and laugh. However, let's not forget that every piece of code they write and every root-kit they successfully deploy will soon be taken advantage of by black-hats

Wouldn't it be the opposite? Like a free pentest? Malware they come up with would be widely available (included in the price of any movie) for dissection.

BTW Next release of Qubes[1] will need an "entertainment" AppVM.

[1] http://qubes-os.org/trac/wiki/QubesArchitecture

[+] noonespecial|12 years ago|reply
If "they" are both the planters of the rootkit (taking over the computer) and the ones claiming to be wronged, looking for recompense, doesn't this create an unreconcilable conflict of interest as well as a worthless chain of custody for evidence of any wrongdoing? What would stop them from simply taking over computers, planting evidence and profitting (extorting) hugely?

I would think that once my computer spends any length of time not under my direct and exclusive control, I would no longer be solely liable for any actions that may have been taken with it. There would be huge doubt, no?

[+] nathan_long|12 years ago|reply
This is an excellent point. "We can only get $X per song in damages? Plant 100 songs on that computer."
[+] waterlesscloud|12 years ago|reply
This is not going to go where they think it will go.

Right now their enemies are just pirates wanting to watch Game Of Thrones for free. A business threat, certainly, but one they're generally handling well.

But start infecting people's computers, and a portion of them are going to fight back. Then the entertainment industry has enemies actively trying to destroy their systems.

A whole different level of conflict, and one which I am certain they are not prepared for.

Never go for an escalation you don't need and will hurt you more than it hurts them.

[+] vidarh|12 years ago|reply
If I ever find a rootkit on my system stemming from a company that thinks they can do stuff like this, and it is legal, it is to a demonstration that the law is not worthy of any respect any more, and that it is time for war. And given the resource discrepancy, the only way of fighting back against companies like this would be to cause vastly disproportionate amounts of damage. I'm sure getting rootkits into their networks wouldn't be all that hard.
[+] munin|12 years ago|reply
"...there are increasing calls for creating a more permissive environment for active network defense that allows companies not only to stabilize a situation but to take further steps, including actively retrieving stolen information, altering it within the intruder’s networks, or even destroying the information within an unauthorized network."

this is actually way worse than the headline indicates. the crazy bastards want the legal authority to actively exploit other peoples computers and "take back" information from it. they want the ability to re-write the world.

it would be pretty frightening that digital media companies were unaware that you couldn't "retrieve stolen information" from computer systems, except no other company seems to know that this is actually impossible so it's just kind of de regueur.

I want to say that this will of course go nowhere because the legislatures support of far weaker measures (like CISPA) is lukewarm, but then again this is the group that brought us the DMCA. it would be especially ironic if the MPAA was more empowered to use computer hacking to protect popular music from theft, than technology and national defense companies trying to protect national defense information and private consumer information.

[+] TheCondor|12 years ago|reply
Would that require disclosure?

A problem now which is more frightening (I can secure my network from the media companies, not worried about that one bit) is the remarkable number of companies with known security problem that won't and don't disclose it. Going on the offensive should be illegal unless they can disclose damages which justify it and then their customers can sue.

I don't see this happening in a healthy world, defense will get much much better much more quickly if it was to be legal though, ultimately it would involve violence though.

[+] yuhong|12 years ago|reply
Well, DMCA was back in 1998.
[+] kunai|12 years ago|reply
I'm sick and tired of being in such a lazy-ass, apathetic society that possesses zero regard to freedom.

Stallman may be a nut, but when you think long and hard about what he says, and think about SOPA, PIPA, and this lobby, in horror, your face twists in fear and you watch, helplessly, as your fellow citizens bend over backwards and let the government have their way.

I don't even know what to do anymore. Nobody will lobby against Hollywood; people already gobble up TMZ and are too obsessed with celebrity pseudo-culture and movies and pop music that they won't do it.

We need more activists. And without them, we are fucked.

[+] obviouslygreen|12 years ago|reply
And your answer is Stallman?

Yes, he is a nut. In the sense of "no one will ever take him seriously, especially anyone involved in mainstream decision-making, who has ever read anything he has written," which is in this case the most relevant metric. Stallman is never going to be any help here, nor is anyone like him, because any "normal" person -- that is, one that other people won't ignore out of hand -- will ignore him out of hand. This includes politicians, to whom said "normal" people are the all-important majority.

"We need more activists" is bullshit. You think we need more activists? More of those outliers that get lampooned in every media outlet for railing against the status quo? Because that's what activists are to most people: Nuts and/or malcontents.

Of course, my real problem with this statement is exactly the same reason I'm not making it. You think we don't have enough activists? GO BE ONE. If you think they can do any good and you believe that "we are fucked" without them, stop posting on HN, get off your ass, and DO SOMETHING.

Otherwise get back on the bench with the rest of us, because all your whining about mass media and celebrity culture is just that. You can gripe all you want that people aren't doing anything, but as soon as you start telling people what they SHOULD be doing, either you'd better be doing it yourself or you'll have to excuse those of us -- everyone -- who will not take you seriously.

In the event that you actually are interested in backing up your hollow rhetoric: The only way to work this system is from the inside. So start campaigning, or start schmoozing, because while real change is essentially impossible, the only way to mitigate damage is by convincing the relevant politicians that it's in their best interests to do so.

[+] vy8vWJlco|12 years ago|reply
"I don't even know what to do anymore."

Code.

People use Skype because there's no clear alternative (maybe work on Jitsi... It still needs a server for the good stuff). People use Facebook because there's no alternative (maybe work on RetroShare). People let their government tell them what to do because they think it's better than anarchy (maybe work on a political Kickstarter). Copyright enforcement against BitTorrent users has gone into high gear because BitTorrent is good at sharing but weak in anonymity. Fix that. Don't make tools to break laws, just make tools. Write software to empower individuals and make institutions unnecessary and you won't have to spend as much time cleaning up after institutions and the egos that run them when they get carried away.

Promoting open-source software as a way to counter spyware, and general activism, is better than nothing, but the best way to change the world is still to invent it IMHO. (Just don't throw yourself on the fire unnecessarily either... Bitcoin's author was wise to keep his identity out of it.)

[+] ChuckMcM|12 years ago|reply
We need more activists. And without them, we are fucked.

You can change the system from within as well. While it is impractical to go out and run for President and hope to win, one of the things I hope the current crop of young adults will see is that they have the power to become the system and change it. First build a resume in public service (city council, county supervisor, state representative) then use your training to help you and your fellow revolutionaries move into a position of power and change.

One of the saddest things is that the folks in power have convinced the youth of America that they are powerless and nothing can be done forcing them into acts of "activism" which allows them to be identified and eliminated.

Perhaps an example that doesn't resonate with you but has been doing what your compatriots have not, is the Tea Party. These folks have shown you that it isn't about dominating the world, its about setting a theme, recruiting to your cause, and then using the institutions that are in place to allow you to affect change, to work for you.

[+] seandhi|12 years ago|reply
This paper barely even mentions music or movies, and its proposals are for going after foreign entities who steal intellectual property, such as R&D, to develop counterfeit goods.

This is less about going after little Timmy for downloading a movie and more to do with a Chinese firm stealing biotechnology secrets from a U.S. company to produce its own products.

[+] beedogs|12 years ago|reply
I lobby against Hollywood by refusing to give them a thin dime of my money.
[+] unknown|12 years ago|reply

[deleted]

[+] sliverstorm|12 years ago|reply
I'm not sure we need be this terrified. Gear-heads made similar claims about freedom as cars became more complicated and less user-serviceable. But you know what? While cars have their issues, and are indeed now more difficult to service, they have continued to get better- a lot better. The last totally user-serviceable cars were made in the 60's and early 70's. Many of the improvements come from improvements to manufacturing, but the sophisticated electronic control systems are integral.

Now, the internet is of course not an automobile. But my point is, batshit insane legislation aside, perhaps maintaining the maximum amount of freedom is not as valuable as we think? I'd hate to be stuck with late 60's cars.

[+] TheBiv|12 years ago|reply
I tried to be rational and then I got to the second paragraph of their own brief:

"The second and even more pernicious effect is that illegal theft of intellectual property is undermining both the means and the incentive for entrepreneurs to innovate, which will slow the development of new inventions and industries that can further expand the world economy and continue to raise the prosperity and quality of life for everyone. Unless current trends are reversed, there is a risk of stifling innovation, with adverse consequences for both developed and still developing countries."

Source: http://ipcommission.org/report/IP_Commission_Report_052213.p...

[+] ericcumbee|12 years ago|reply
Because every country strives to be more like Syria.

"MPAA told Congress that they wanted SOPA and knew it would work because it was the same tactic used by governments in "China, Iran, the UAE, Armenia, Ethiopia, Saudi Arabia, Yemen, Bahrain, Burma, Syria, Turkmenistan, Uzbekistan, and Vietnam."

[+] seandhi|12 years ago|reply
This has little to do with the entertainment industry. This is dealing with intellectual property such as research and development.

They are trying to protect U.S. companies from having their R&D stolen and used by foreign companies, calling for sanctions via the FTC and by amending the espionage act to go after those who steal trade secrets, for example. The whole paper is on protecting the innovations developed in this country from being copied by foreign entities without repercussions, and when viewed in this light, the proposals are not that crazy.

I recommend reading the paper directly, as the BoingBoing link completely misrepresents it.

http://ipcommission.org/report/IP_Commission_Report_052213.p...

[+] smsm42|12 years ago|reply
The proposals that allow select private companies to deploy destructive software which would land other people in jail very quickly is that crazy. Notion that it is somehow OK to kidnap my property because somebody thinks I owe them some money is that crazy. We have courts and due process for that. We can see how they are abused by copyright trolls (see Prenda Law case, for example, but there are many more). I can't even describe how much more abuse will be invited if cyber-criminal tactics would be made legal for them. It is that crazy and more, and no amount of moral panic about supposed foreign spies who steal all our R&D can justify any of it.
[+] adrusi|12 years ago|reply
Thank you for pointing this out. I was looking for which specific entertainment firms to blame, and found "The National Bureau of Asian Research" instead.
[+] mercurial|12 years ago|reply
Does it say anywhere how deployment would be restricted? Even if it's the case, it's both dangerous (I could easily imagine this getting deployed by accident because a contractor set it wrong) and one hell of a slippery slope.
[+] cognivore|12 years ago|reply
>> But start infecting people's computers, and a portion of them are going to fight back. <<

I already fought back. I don't watch movies, nor TV. No cable, no Netflix, no movie theaters, no nothing. Fsck 'em.

You want to do the same? Stop watching their lowest common denominator tripe and read a book or make something up for yourself. When they have no money they'll go away. And what will we have lost? Wasted hours sitting in front of their junk.

[+] greenyoda|12 years ago|reply
Are they also going to push for laws that mandate that all anti-virus software must ignore their rootkits?

And with secure boot in Windows 8, it will be harder for rootkits to remain undetected by hiding in the boot loader. Will the entertainment industry push for laws that force operating system vendors to provide back-doors for the official malware?

[+] oakwhiz|12 years ago|reply
Unless Microsoft signs the rootkits purposefully.
[+] JanneVee|12 years ago|reply
No it won't be harder for the entertainment industry to create rootkits. You just buy a proper certificate and sign it like any other driver developer. Secure boot does nothing to protect the users from the entertainment industry.

And if we remember what happened the last time that happened when an entertainment company deployed a rootkit. They made it much easier for unskilled malware writers to hide their work. And IIRC it wasn't trivial to remove the rootkit Sony deployed.

[+] betterunix|12 years ago|reply
Frankly, this might be the sort of kick in the ass people need to start writing more secure software. Who wants their software to be known as the MPAA's attack vector?

On the other hand, I suspect that the MPAA would be in for a world of hurt if they did this. They would not only be dealing with file sharing, but also a coordinated campaign by blackhats to take down their systems, boycotts organized by the EFF and the like, lawsuits from companies whose employees brought rootkit infected machines on the corporate network, etc.

[+] kunai|12 years ago|reply
Forget black hat; any sane person would organize attacks against the MPAA.

I know Anonymous is one of the prime offenders in this area, but I wouldn't be surprised if many on Reddit organized and attacked the MPAA's systems.

[+] darxius|12 years ago|reply
> blackhats to take down their systems

I'm pretty sure something like this would get the greys and whites involved too.

[+] wereHamster|12 years ago|reply
From the report:

> there are increasing calls for [...] that allows companies [...] actively retrieving stolen information

They are still living in the last century, and think that if somebody steals something from them they can take it back. They have yet to grasp what this 'digital media' is.

[+] bobsoap|12 years ago|reply
They grasp it alright, but they haven't figured out how to monetize it properly yet, especially compared to their established physical business model, which already has all the infrastructure in place, and they are trying to exploit to the very end.
[+] mikegagnon|12 years ago|reply
When I read those excerpts from this report, I assumed it was written by some extremist lobbying group that doesn't have any real power. Then I read this statement from Congressman Mike Rogers (Chair of CHPSCI, House Permanent Select Committee on Intelligence):

“It is already clear to me that this report is going to make a very important contribution to the discussion about the grave danger that IP theft poses to our economic well-being. In particular, all should carefully read what the report has to say about Chinese economic espionage. I heartily agree that Congress and the Administration need to act quickly to help American companies defend the hard work and innovation that is the life-blood of our economy. That must begin with getting cyber information sharing legislation signed into law."

https://intelligence.house.gov/press-release/chairman-rogers...

The report and Congressman's statement came out on the same day.

[+] ck2|12 years ago|reply
Why should the entertainment industry get special treatment?

Local, state, federal police, IRS should install rootkits to monitor all transactions and activity, turn on audio and video capture from webcams.

Of course it's absurd and would destroy consumer trust of any device connected to the internet.

[+] Zigurd|12 years ago|reply
The movie and music publishing businesses are tiny compared to the telecom industry. It amazes me that they are able to get such proposals taken seriously.

This is beyond wacky in light of serious security threats from both organized crime and foreign governments. The same machines they want to root to check on your music and movies are used for serious work in industry and government.

[+] da_n|12 years ago|reply
This does not surprise me. I currently am legally entitled to watch several dozen movies, and quite a few TV shows on iTunes, I suppose I've spent about £500 over the years. Here's the problem. I cannot transfer any of these legally purchased movies or TV shows to other platforms, I am held ransom inside a platform-specific eco-system apparently forever. I am a willing customer, I want to reward creators, but in return I am treated like a criminal by the entertainment industry. If there is one thing which is clear it is that the entertainment industry hate their customers.
[+] fkdjs|12 years ago|reply
http://ipcommission.org/report/IP_Commission_Report_052213.p...

> The Commission on the Theft of American Intellectual Property > With U.S. companies suffering losses and American workers losing jobs

Jobs. Translation: this is a PR piece.

> The Department of Homeland Security, the Department of Defense, and law enforcement agencies should have the legal authority to use threat-based deterrence systems that operate at network speed against unauthorized intrusions into national security and critical infrastructure networks

Huh? This includes national security now? Are they deliberately blurring the lines between pirating and national security? Why I think so.

> Informed deliberations over whether corporations and individuals should be legally able to conduct threat-based deterrence operations against network intrusion, without doing undue harm to an attacker or to innocent third parties, ought to be undertaken.

They want to legalize Sony's rootkit, but they want to do it right. Rootkits in the wild cannot be tamed, don't even go there.

> if counterattacks against hackers were legal, there are many techniques that companies could employ that would cause severe damage to the capability of those conducting IP theft.

You do something that the system thinks is pirating and your computer blows up. What could go wrong.

> ...The Commission is not ready to endorse this recommendation because of the larger questions of collateral damage caused by computer attacks

Ahh I see, they're reasonable after all! IOW, they want to make their rootkit legalization idea sound sane.

> Recommend to Congress and the administration that U.S. funding to the World Health Organization (WHO) program budget in whole or in part be withheld

At this point I want to punch someone in the face.

I can't read anymore.

[+] justanother|12 years ago|reply
At a past address, neighbors would leave a bundle of fresh green coconuts, and a few DVDs to back up, at my front stairs. This worked well; They'd get their DVDs backed up (hey, I didn't ask questions), I'd get my coconut water fix.

At my current address, I have access to my own coconut bundles by the dozen, but I still have to wonder, if this came to pass, imagine how many coconuts would I get for 'unlocking' and recovering the computers they would leave at my door due to MPAA 'stabilizing' their situations!

Put another way, like DVDCSS, this is just another minor annoyance to the technically inclined, and only serves to penalize the less-computer-literate, and enrich the people who do favors for them.

[+] shmerl|12 years ago|reply
DRM lobby must have started smoking some heavy stuff. It's not enough that they insist that breaking DRM is illegal, now they want to make spyware DRM to be legal. True intentions revealed. The next - they must be deploying the Watchbirds.