HTML, EME and Open Standards

Open Standards are standards (specifications of formats or protocols) that follow five simple rules.

They have to be:

1. subject to full public assessment and use without constraints in a manner equally available to all parties;
2. without any components or extensions that have dependencies on formats or protocols that do not meet the definition of an Open Standard themselves;
3. free from legal or technical clauses that limit its utilisation by any party or in any business model;
4. managed and further developed independently of any single vendor in a process open to the equal participation of competitors and third parties;
5. available in multiple complete implementations by competing vendors, or as a complete implementation equally available to all parties.

The importance of Open Standards is somewhat highlighted by its definition itself: an Open Standard can simply be used by anyone, without restrictions. This allows any developer to implement such a standard, and avoids user exclusion - anyone is free to use an Open Standard. This importance has been recognized though the years, and lately that recognition has reached into higher policy levels, with countries like Portugal mandating that the Public Administration must exclusively use Open Standards, as a way to ensure citizens unrestricted access to public data and services.

One good example of an Open Standard is HTML. Even if you're not very aquainted with technical issues, you probably already heard about HTML -- or at least seen a "Web address" (called URL) like "http://somesite.org/this.html". This happens because HTML is the "language of the web": each webpage is written in a format, called HTML, and since all the web pages are written in that same format, and because that format is an open standard, anyone can create a computer program (in this case, a web browser) that reliably receives the web page in that format and knows how to correctly display it on your computer screen. This is what makes it possible for you to see the same web page on your phone, your computer, your tablet, even if you are using different programs to see it. It doesn't matter weather you're using Android's web browser on your phone or Firefox on your computer, while your friend is using iOS's web browser and Safari on his Mac laptop. Everyone can see correctly a web page: that's one of the beauties of the Web, and that happens because HTML is an Open Standard.

So, what's this EME thing? And why are people fussing about "DRM in HTML"?

EME is a proposed specification that aims to "extend HTMLMediaElement" (which is a part of the HTML specification). What this means is that, if EME is approved, a part of HTML's current specification is going to be updated. The "new version" includes two kinds of changes: some mandatory and some optional. In its own words, "Implementation of Digital Rights Management is not required for compliance with this specification: only the Clear Key system is required to be implemented as a common baseline." W3C argues that this constitutes no problem, and that they are not adding DRM into HTML, because implementing DRM is not required. However, the fact that implementing DRM is possible (even if not mandatory) means that, if a website uses such an implementation, either your web browser also uses it, or you won't be able to see that part of the website (remember what I said before about the web being seen by everyone? That wouldn't happen anymore.) Of course, this wouldn't need to be an issue at all: if the specification allows for that implementation, its just a matter of all browsers implementing it, right? Wrong. The problem here is that the "specification does not define a content protection or Digital Rights Management system".

In other words: EME introduces the possibility to use things (DRM systems) that are not part of the specification, so the complete specification (a way for an independent party to implement all the specification) isn't available -- EME is not an Open Standard. And since EME aims to be inserted into HTML (by updating part of its specification), then HTML will have an extension (EME) that has "dependencies on formats or protocols that do not meet the definition of an Open Standard themselves". Yes, EME approval would make HTML stop being an Open Standard.

Summing up

HTML is an Open Standard, and that is good for everyone. So good, in fact, that some countries, like Portugal, mandate that public administrations can only use Open Standards. However, there is a proposal (EME) that, if approved, will make HTML stop being an Open Standard. That will have an high negative impact in Public Administrations, citizens and the overall web community -- which nowadays means the citizens of the world.

This approval would have an high social, political and cultural impact everywhere. From the current era of shared knowledge, easy access to information, and overall making the world more accessible, we might be heading towards the dark ages of the web. There is, of course, a solution: let's make W3C know that we oppose EME, and ask them not to approve it.

DRM hopefully to be fixed in Portugal

DRM bills being discussed, with a physical DRM'd book
sent by ANSOL serving as an argument

2001's European Directive 2001/29/EC says that member states must legally protect DRM measures, making it illegal to circunvent them. But it also states that they must ensure that it doesn't prevent uses permitted thanks to copyright exceptions (for instance private copy).

The transposition of that directive to the Portuguese Law (CDADC) was made in 2004, but the way that CDADC ensures that copyright exceptions is protected doesn't work. CDADC states that you can't circunvent DRM, but since you must be able to exercise the copyright exceptions, it states that in those cases you have to request the means to achieve your objective to IGAC (a state administration service). The problem is that if you request those means to IGAC, they won't hand them over to you because they don't have it.

Well, that is now going to change. Two Portuguese parties submitted to the Parliament a couple of bills with the same basic objective: to change CDADC, changing the way the law ensures the right to copyright exceptions by simply stating that if the DRM in question prevents any of those exceptions from being exercised, then you can circunvent them in order to exercise them. Simple and effective, right?
These two bills were debated in the parliament, and then approved in generality. Now they follow it's natural path, to a comission that will merge both bills and do amendments (amendments that will not change the essence of the bills, I hope), and the final text will be again voted in the Parliament, who can turn it into Law, finally giving back users the rights that were taken from them nine years ago.

Timeline:

2001 - 2011/29/EC EU directive is published

2004 - EU directive is transposed to Portuguese Law

2013-06-12 - general discussion about two bills aiming to fix the Law

2013-06-14 - both bills approved in general

2013-06-26 (10:00) - Comission meeting scheduled to discussion and vote of both bills in speciality

DRM in HTML5

Many people have doubts regarding how can possibly be an issue of having DRM on HTML, the foundation language of the entire web. One person in particular had the doubt of "how can it be possible that DRM (closed by its nature) is inserted into a standard?"

I have replied to her about it (in Portuguese), but I think that, with some adaptations and a translation, this text might also have a wider use for those of you trying to understand HTML, standards and DRM. Oh, and don't forget, click on the image in the right to sign a petition against DRM on HTML.

The "short answer"

You should attend to the Document Freedom Day 2013 celebration event nearer to you: they're happening starting today until April all around the world. There, I'm sure, there will be people knowing and willing to explain to you any questions regarding open standards in general and the "DRM in HTML" issue in particular.

The "long answer"

A standard should be considered open if it complies with a number of requisites. Here's the list (taken from this page, that explains each point better):

An Open Standard refers to a format or protocol that is:

• Subject to full public assessment and use without constraints in a manner equally available to all parties;
• Without any components or extensions that have dependencies on formats or protocols that do not meet the definition of an Open Standard themselves;
• Free from legal or technical clauses that limit its utilisation by any party or in any business model;
• Managed and further developed independently of any single supplier in a process open to the equal participation of competitors and third parties;
• Available in multiple complete implementations by competing suppliers, or as a complete implementation equally available to all parties.

Unfortunately not every format is an open standard, or, in other words, doesn't comply with the previous points. If the proposal to have DRM on HTML5 is accepted, HTML will stop being an open standard, since it will stop complying with the second requirement of the list.

In more detail: the proposal on the table is called EME (Encrypted Media Extensions). An HTML document can include EMEs, and the specification of EME enables the website to require a certain "Content Decryption Module" (CDM). And here lies the problem: CDMs aren't standards (much less open standards!) and the EME specification doesn't include or refer to any specification of any CDM. In other words: the definition of open standard we just saw isn't complied, because to implement HTML5 we have to implement EME, which has to accept any CDM, which isn't a standard and so we cannot implement.

In other words, with an example: I make a website, and put there a media object (video, for instance) using EME, and I specify in the HTML document that the EME object needs the CDM module (which is a form of DRM) called "OneTwoThree". Now, if you want to see that website, you need a web browser that knows how to undertand HTML5 and EME (both possible since there's the specification), and the browser then needs to get the CDM called "OneTwoThree" (imagine it as being a browser plugin, not unlike Flash) and use it to play the video. The problems are obvious now: what if the CDM only exists for one specific Operating System? What if the CDM isn't free? You know... the thypical problems of a non-open standard format.

Direitos contra Direitos

I'll be there, representing representing DRM-PT.

Anti-DRM T-Shirt contest

Torrent Freak is doing an anti-DRM t-shirt contest, go there to see cool t-shirt designs and to vote on your favourite!