Abstract
Internet-based distribution of mass-market content provides great opportunities for producers, distributors, and consumers, but it may seriously threaten users’ privacy. Some of the paths to loss of privacy are quite familiar (e.g., mining of credit-card data), but some are new or much more serious than they were in earlier distribution regimes. We examine the contributions that digital-rights-management (DRM) technology can make to both compromising and protecting users’ privacy. We argue that the privacy-enhancing technology (e.g., encryption, anonymity, and pseudonymity) that absorbs most of the attention of the security R&D community cannot by itself solve the privacy problems raised by DRM, although it can play a role in various solutions. Finally, we provide a list of “privacy engineering” principles for DRM systems, some of which are easy to implement and potentially quite effective.
Supported in part by ONR grants N00014-01-1-0795 and N00014-01-1-0447 and NSF grant CCR-0105337.
This work was largely done while the author was visiting InterTrust STAR Lab.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Ross Anderson. Why information security is hard-an economic perspective, January 2001. http://www.cl.cam.ac.uk/~rja14/.
BBBOnLine. Privacy seal. http://www.bbbonline.com/privacy/.
R.M Brady, R.J. Anderson, and R.C. Ball. Murphy’s law, the fitness of evolving species, and the limits of software reliability. Technical Report 476, Cambridge University Computer Labority, 1999.
Stefan Brands. Rethinking Public Key Infrastructures and Digital Certificates; Building in Privacy. The MIT Press, Cambridge, MA, August 2000.
Jason Catlett, Marc Rotenberg, David Banisar, Ed Mierzwinski, Jeff Chester, and Beth Givens. Open letter to Kevin Ryan, June 2001. http://www.junkbusters.com/doubleclick.html.
Electronic Privacy Information Center and Junkbusters. Pretty poor privacy: An assessment of p3p and internet privacy, June 2000. http://www.epic.org/reports/prettypoorprivacy.html.
Lorrie Cranor, Marc Langheinrich, Massimo Marchiori, Martin Presler-Marshall, and Joseph Reagle. The Platform for Privacy Preferences 1.0 (P3P1.0) Specification, W3C Candidate Recommendation, December 2000. http://www.w3.org/TR/P3P/.
Wei Dai. Crypto++ 4.0 benchmarks. http://www.eskimo.com/~weidai/benchmarks.html.
Complaint, DeLise vs. Fahrenheit Entertainment, No CV-014297, Sup. Ct. Cal. Marin County, September 2001. http://www.techfirm.com/mccomp.pdf.
John D. Dingell, Edolphus Towns, and Edward J. Markey. Letter by House Democrats asking FTC to investigate TiVo, March 2001. http://www.house.gov/commercedemocrats/press/107ltr30.htm.
Economist. Keeping the customer satisfied, July 2001.
Organisation for Economic Co-operation and Development. Guidelines on the protection of privacy and transborder flows of personal data, September 1980. http://www.oecd.org/dsti/sti/it/secur/prod/PRIV-EN.HTM.
FTC advisory committee on online access and security: Final report, May 2000. http://www.ftc.gov/acoas/.
Kevin Fu, Emil Sit, Kendra Smith, and Nick Feamster. Dos and don’ts of client authentication on the web. In Proceedings of the 10th USENIX Security Symposium, Washington, D.C., August 2001.
Ian Goldberg and Adam Shostack. Freedom network 1.0 architecture, November 1999. http://www.freedom.net/.
Carl Gunter, Stephen Weeks, and Andrew Wright. Models and languages for digital rights. Technical Report STAR-TR-01-04, InterTrust STAR Lab, March 2001. http://www.star-lab.com/tr/.
Dana Hawkins. Gospel of privacy guru: Be wary; assume the worst. USNews.com, June 2001.
Kelly Jackson Higgins. PKI: DIY or outsource? InternetWeek.com, November 2000.
Mark Hochhauser. Lost in the fine print: Readability of financial privacy notices, July 2001. http://www.privacyrights.org/ar/GLB-Reading.htm.
David Karger, Eric Lehman, Tom Leighton, Rina Panigrahy, Matt Levine, and Danny Lewin. Consistent hashing and random trees: Distributed caching protocols for relieving hot spots on the world wide web. In Symposium on Theory of Computing, 1997.
German Legislator. German Teleservices Data Protection Act.
German Legislator. Gesetz zu dem Staatsvertrag über Mediendienste.
David Mazieres and M. Frans Kaashoek. The design, implementation and operation of an email pseudonym server. In 5th ACM Conference on Computer and Communications Security, 1998.
R. Morris and K. Thompson. Password security: A case history. Comm. of the ACM, 22(11), November 1979.
Stefanie Olsen. Accounting companies tackle online privacy concerns. CNETNews.com, September 2000.
Stefanie Olsen. Earthlink promises’ anonymous’ web surfing. CNETNews.com, March 2001.
National Research Council Panel on Intellectual Property (R. Davis chair). The Digital Dilemma: Intellectual Property in the Information Age. National Academy Press, Washington, D.C., 2000.
Carl Shapiro and Hal R. Varian. Information Rules: A Strategic Guide to the Network Economy. Harvard Business School Press, Boston, 1999.
P.F. Syverson, D.M. Goldschlag, and M.G. Reed. Anonymous connections and onion routing. In Proceedings of the 1997 IEEE Symposium on Security and Privacy, May 1997.
TRUSTe. Seal programs. http://www.truste.org/programs/.
The European Union. Directive 95/46/ec on the protection of individuals with regard to the processing of personal data and on the free movement of such data, July 1995.
David Wagner and Bruce Schneier. Analysis of the ssl 3.0 protocol. In 2nd USENIX Workshop on Electronic Commerce, 1996.
Willis W. Ware. Records, computers, and the rights of citizens. Advisory Committee on Automated Personal Data Systems, July 1973.
Alma Whitten and J.D. Tygar. Why johnny can’t encrypt. In USENIX Security, 1999.
Tim Wilson. E-biz bucks lost under ssl strain. InternetWeek.com, May 1999.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2002 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Feigenbaum, J., Freedman, M.J., Sander, T., Shostack, A. (2002). Privacy Engineering for Digital Rights Management Systems. In: Sander, T. (eds) Security and Privacy in Digital Rights Management. DRM 2001. Lecture Notes in Computer Science, vol 2320. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-47870-1_6
Download citation
DOI: https://doi.org/10.1007/3-540-47870-1_6
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-43677-5
Online ISBN: 978-3-540-47870-6
eBook Packages: Springer Book Archive