Site Sponsor:

mcafee_logo.gif
line

Now Available:

Featured Resource:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Dan or post a comment to the blog.

« Microsoft Silverlight Promises Web App Security | Main | Digg Revolt Shows Need to Temper Majority Rule in Web 2.0 »

The Digg Meltdown, Censorship and Privacy

Digg removing posts with a key for HD-DVD rights management struck a raw nerve. The comments around the Internet range from the "you can't copyright a number" to "its about censorship". Some of the best comments I saw are at Washington Post's Post IT The HD-DVD Digg revolt . What those comments and others I've seen demonstrate is just how many ways this story cuts, including:

-Digg "caving in" to a cease and desist order claiming publishing the key violates the intellectual property of someone (we don't know yet who sent the C&D order)

-Digg censoring comments about the story even when those posts did not include the key

-A sense of entitlement about publishing information that has some value to someone else

-The feeling that big media makes too much money anyway and undermining DRM is just

- And, this one sounds like some off the wall comment from the O'Reilly Factor - "I pirate because I'm a patriot." The argument is that since China and North Korea don't have anti-piracy laws it "behooves me to have access to the same software as the competition" according to uNiVerse555, a commentor at the Post IT blog.

The question that most concerns me is this notion that you can't copyright a number and we should all have free speech rights to post encryption keys. Well, then what about social security numbers, bank account numbers, and credit card numbers? Look, their just numbers, right? But if you have a little more information, like a name and address, that number becomes a lot more valuable. It's the same thing with encryption keys. To most of us, it just a number; to someone wanting to pirate copy protected material it's worth a lot more.

For the record, I'd rather pay more for music and videos and ditch DRM, it's a pain in the neck. That doesn't make me the "Decider" though. The encryption key shouldn't have been published anymore than someone's social security number or credit card number.

You don't have to like big media companies, or DRM, or even the guy next door but you can't going around screwing them by publishing private and confidential data. That's part of living in a civil society.

TrackBack

TrackBack URL for this entry:
http://www.realtime-websecurity.com/type/mt-tb.cgi/293

Comments

Civil society? hmmmmm maybe we should have a CIVIL GOVERNMENT people are following their lead, take, take, take

I was thinking of something similar to nanotech's comment. When there is so much apparent disregard for laws among government officials and the presumption it's OK to do something if you can get away with it, it's no wonder we've come to the point that people will publish someone else's encryption key and argue it as a free speech matter.

It is not illegal to simply post a SSN or bank account number. It is illegal to use it to access someone's personal accounts or information. Knowing about the key should not be a crime, using it should be.

Yes, that's a good point, it's not a crime to know someone elese social security number. The problem is that we then have to trust everyone who knows the SSN, key, etc. not to use it and not to share it with others who might use it. We need encryption because we don't trust others and secret keys are the foundation. I think the same logic applies to SSN, credit card, bank account numbers, etc.

I still think there are serious questions about confidentiality and privacy in this story, but thanks to Ed Felten at Freedom To Tinker for the wry humor of "You Can Own an Integer Too — Get Yours Here" (http://www.freedom-to-tinker.com/?p=1155).

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Dan Sullivan's Bio:

Dan Sullivan is a systems architect with 20 years of IT experience that includes engagements in enterprise security, application design, and systems architecture. His experience includes a broad range of industries, including financial services, manufacturing, government, retail, gas and oil production, power generation, and education. Dan’s security-related project work has ranged from requirements analysis for enterprise information security to designing and implementing security for database applications and enterprise portals. Dan has written about information security and other enterprise information management topics for Business Security Advisor, DM Review, Intelligent Enterprise, and E-Business Advisor. You can contact Dan at: dan_sullivan@realtimepublishers.net