1. Vista, TC and Competition Policy Ross Anderson Cambridge University and Foundation for Information Policy Research

2. Economics and Security Over the last six years, we’ve started to apply economic analysis to information security Over the last six years, we’ve started to apply economic analysis to information security Economic analysis often explains security failure better! Economic analysis often explains security failure better! People who can protect a system are often not the people who suffer when it’s hacked People who can protect a system are often not the people who suffer when it’s hacked And information security mechanisms are used increasingly to support business models rather than to manage risk And information security mechanisms are used increasingly to support business models rather than to manage risk

3. New Uses of Infosec Xerox started using authentication in ink cartridges to tie them to the printer. Followed by HP, Lexmark and others Xerox started using authentication in ink cartridges to tie them to the printer. Followed by HP, Lexmark and others Motorola started authenticating batteries to mobile phones Motorola started authenticating batteries to mobile phones Increasingly crypto is used to lock customers in, tie products, bundle services, enforce cross-subsidies and rig markets Increasingly crypto is used to lock customers in, tie products, bundle services, enforce cross-subsidies and rig markets Vista will deepen this Vista will deepen this

4. What’s Software Worth? The value of a software company is the total switching costs of all its customers The value of a software company is the total switching costs of all its customers E.g., law firm with 100 fee earners paying €800 a seat for Office -> it would cost €80K to retrain staff on OpenOffice, convert files etc E.g., law firm with 100 fee earners paying €800 a seat for Office -> it would cost €80K to retrain staff on OpenOffice, convert files etc In software, lock-in = market power In software, lock-in = market power The same holds for many online services The same holds for many online services

5. Rights Management and Competition IRM – Information Rights Management – changes ownership of a file from the machine owner to the file creator IRM – Information Rights Management – changes ownership of a file from the machine owner to the file creator Files are encrypted and associated with rights management information Files are encrypted and associated with rights management information The file creator can specify that a file can only be read by Mr. X, and only till date Y The file creator can specify that a file can only be read by Mr. X, and only till date Y Shipping in Office since 2003 Shipping in Office since 2003 What will be the effect on the typical business that uses PCs? What will be the effect on the typical business that uses PCs?

6. Why is Microsoft so Keen? At present, a company with 100 PCs pays maybe €800 per seat for Office At present, a company with 100 PCs pays maybe €800 per seat for Office Remember – value of software company = total switching costs Remember – value of software company = total switching costs So – cost of retraining everyone to use Linux, OpenTC etc is maybe €80,000 So – cost of retraining everyone to use Linux, OpenTC etc is maybe €80,000 Once documents can’t be converted without creators’ permission, switching cost is higher Once documents can’t be converted without creators’ permission, switching cost is higher Bill: ‘we came to this thinking about music but then realized documents and email were much more interesting’ (NB works with OpenTC too!) Bill: ‘we came to this thinking about music but then realized documents and email were much more interesting’ (NB works with OpenTC too!)

7. Strategic Issues Who will control users’ data? Who will control users’ data? Microsoft view – everything will be on an MS platform (your WP files, presentations, address book, pictures, movies, music) Microsoft view – everything will be on an MS platform (your WP files, presentations, address book, pictures, movies, music) DG Comp view: illegal! – ordered MS to unbundle WMP DG Comp view: illegal! – ordered MS to unbundle WMP Google view – all your data on our server Google view – all your data on our server Apple view – buy all your music through our channel Apple view – buy all your music through our channel

8. Software Industry Issues At present, there are petabytes of ‘free’ data for new apps to use (I.e., your data) At present, there are petabytes of ‘free’ data for new apps to use (I.e., your data) Future apps can use TC (Vista or Open) to lock in users by locking down their data Future apps can use TC (Vista or Open) to lock in users by locking down their data The software industry will become less dynamic, more like a ‘normal’ industry The software industry will become less dynamic, more like a ‘normal’ industry Maybe we’ll see software subsidizing hardware, as in games consoles Maybe we’ll see software subsidizing hardware, as in games consoles Effects on innovation, growth, choice Effects on innovation, growth, choice

9. Rights Management and the Content Industry What happens when you link a concentrated industry (platforms) with a less concentrated industry (music / movies)? What happens when you link a concentrated industry (platforms) with a less concentrated industry (music / movies)? Varian (Jan 2005) – most of the resulting surplus goes to the platform owner Varian (Jan 2005) – most of the resulting surplus goes to the platform owner Music industry was scornful – but by October were worried and in 2006 started panicking Music industry was scornful – but by October were worried and in 2006 started panicking Musicians saw fee per single fall from 34p to 3p – and are now cutting out the majors Musicians saw fee per single fall from 34p to 3p – and are now cutting out the majors Gutmann argues that Vista tries to do for HDTV what Apple did for music downloads Gutmann argues that Vista tries to do for HDTV what Apple did for music downloads

10. The Information Society More and more goods contain software More and more goods contain software More and more industries are starting to become like the software industry More and more industries are starting to become like the software industry The good: flexibility, rapid response The good: flexibility, rapid response The bad: frustration, poor service The bad: frustration, poor service The ugly: monopolies The ugly: monopolies How will the law evolve to cope – and who gets to write it? How will the law evolve to cope – and who gets to write it?

11. Specific Policy Issues More ‘Security’ isn’t necessarily better More ‘Security’ isn’t necessarily better More ‘Trust’ isn’t necessarily better More ‘Trust’ isn’t necessarily better Need to stop firms dumping liability and onus of proof Need to stop firms dumping liability and onus of proof Think: ATMs, phishing. Vista and CC nos? Think: ATMs, phishing. Vista and CC nos? Need for private action Need for private action `Fruit of the poisoned tree’ provisions `Fruit of the poisoned tree’ provisions

12. Conclusions Will the Commission get more involved in information goods and services markets? Will the Commission get more involved in information goods and services markets? Very probably – but at present, policy is ad-hoc, a patchwork Very probably – but at present, policy is ad-hoc, a patchwork What are the goals? (Kroes’ “global competition culture”? Sovereignty?) What are the goals? (Kroes’ “global competition culture”? Sovereignty?) The mechanisms? (interoperability?) The mechanisms? (interoperability?) Paradigms / metaphors? (cars? drugs?) Paradigms / metaphors? (cars? drugs?) Tech versus app regulation? Tech versus app regulation?