1. How TPMs Can (and Should) Control Copyright Presentation to InternetNZ Copyright Workshop Prof. Clark Thomborson 13 th February 2007

2. Outline A Theory of Control Four control systems (Lessig): legal, economic, cultural, architectural. Four control specifications: prohibitions, permissions, obligations, exemptions. Copyright Control by Technological Protection Measures (TPMs) Control on the boundary of trust: exports and imports of copyright material; granting and revoking membership in the trusted system. Control inside the boundary, e.g. licences. TPMs are also subject to controls!

3. Lessig’s Taxonomy of Control LegalIllegal Moral Immoral EasyDifficult Inexpensive Expensive

4. How to Specify Controls By prohibitions, i.e. “Thou shalt not kill.” General rule: An action (in some range R) is allowed, with exceptions R1, R2, R3,... By permissions, i.e. an entry visa. General rule: An action in P is not allowed, with exceptions P1, P2, P3,... Hierarchy of controls on allowed actions: R: allowed R1: prohibited R2 R3 P1 P2

5. Specifying Controls on Inactions By obligations, i.e. “Honour thy father and mother.” General rule: An action (in some range O) is not required, with exceptions O1, O2, O3,... By exemptions, i.e. “A trustee shall be answerable only for losses arising from his own defaults, and not for involuntary acts,...” General rule: An action in E is required, with exceptions E1, E2, E3,... Obligations and exemptions can be specified hierarchically.

6. Applying this Theory What actions and inactions can be controlled by a TPM? Control at the boundary of trust: exports and imports of copyright material; granting and revoking membership in the trusted system. Controls within the trusted system, e.g. licences.

7. Quis Custodiet Custodes Ipsos? The TPM must itself be controlled!

8. Acknowledgements & Sources Privilege and Trust, LOCKix: Richard O'Brien, Clyde Rogers, “Developing Applications on LOCK”, 1991. Trust and Power: Niklas Luhmann, Wiley, 1979. Personae: Jihong Li, “A Fifth Generation Messaging System”, 2002; and Shelly Mutu-Grigg, “Examining Fifth Generation Messaging Systems”, 2003. Use case (WTC): Qiang Dong, “Workflow Simulation for International Trade”, 2002. Use case (P2P): Benjamin Lai, “Trust in Online Trading Systems”, 2004. Use case (ADLS): Matt Barrett, “Using NGSCB to Mitigate Existing Software Threats”, 2005. Use case (SOEI): Jinho Lee, “A survey-based analysis of HIPAA security requirements”, 2006. Trusted OS: Matt Barrett, “Towards an Open Trusted Computing Framework”, 2005; and Governance of Trusted Computing: Thomborson and Barrett, to appear, ITG 06, Auckland. Corporate DRM: “Enterprise Information Protection & Control”, a position paper under development in the Jericho Forum, www.jerichoforum.org.www.jerichoforum.org