10

Is DRM, which some spell as "Digital Rights Management", others as "Digital Restriction Management", allowed by the GPL? In other words, can software that implements DRM be licensed under the GPL? Assume version 3 of the GPL.

What if the DRM scheme requires some kind of secret to work? Wouldn't the GPL require this secret to be published and GPL licensed too, making the DRM useless?

6
  • Shall we start an edit war ;) I'd like the tag to be "drm" because it is 1) shorter, 2) open to be read as "digital restrictions management.
    – user490
    Jul 12, 2015 at 17:50
  • When in doubt, take it to meta!
    – overactor
    Jul 12, 2015 at 17:53
  • My two cents is that drm is preferable though.
    – overactor
    Jul 12, 2015 at 17:59
  • 2
    @overactor I will take this to meta, later.
    – user490
    Jul 12, 2015 at 18:01
  • @EricGärtner what I hadn't noticed yet is that digital-rights-management was already a tag in use. In that case renaming it is something you can't just do on your own but should discuss first. Leave it like the editors did for now and see how the meta discussion goes.
    – overactor
    Jul 12, 2015 at 18:39

2 Answers 2

9

There is nothing which prohibits you from creating software which implements DRM and licensing it under GPL. The GPL can be applied to any software, regardless of what that software does when it is run.

But from a purely technical viewpoint, open source software can hardly be effective at enforcing DRM because the user could easily modify the software to ignore any restriction the DRM mandates to impose on use of the data the program processes. Requiring some secret to make the software work would also be ineffective because the software could be modified to reveal said secret.

But there is also the legal aspect. There are laws in some countries which forbid to circumvent DRM in some situations, even when it would be technically possible to do so. However, the GPLv3 (not v2) tries to circumvent this. It has section 3 "Protecting Users' Legal Rights From Anti-Circumvention Law." which states that a GPLv3 covered software does never count as a protection measure in regards to laws which forbid to circumvent technical measures to enforce copyrights. This makes GPLv3 software ineffective for implementing DRM, both technically and legally.

A workaround which is available when the DRM-based software runs on dedicated hardware is to lock down the hardware in a way that a modified software does not run ("tivoization"). A clause which would have prohibited this did not make it into the final version of the GPLv3.

9
  • This is only true if you own all the copyright for the software. If any other contributors have partial copyright ownership then you cannot use DRM unless you get their permission. For example, VLC tried to distribute their software on the iOS app store but it was pulled after a contributor complained about them distributing a binary that technically had DRM (even though the DRM was configured so any user anywhere in the world could download the binary for free as long as they agreed to Apple's standard EULA). Jul 12, 2015 at 11:15
  • 1
    @AbhiBeckert That's a different topic. This question was about software which implements DRM, not protection of the software itself with DRM.
    – Philipp
    Jul 12, 2015 at 11:42
  • @FreeRadical That's what section 3 of the GNU GPLv3 is about.
    – Philipp
    Jul 12, 2015 at 18:32
  • @Philipp thanks for correcting me, although that's not clear even when I re-read the question, perhaps it should be re-worded. Jul 12, 2015 at 22:19
  • @FreeRadical it often is not possible to modify the software to ignore whatever restrictions the DRM puts in place, because there is usually encryption in place and you need access to a "secret" for the software to function at all. The easy way to work around that is to just not provide the secret in the source code, only provide it in the public binary distribution (we do this with one of my projects to sign the binary so that users do not install a version upgrade was compiled by somebody else, who may have included a trojan horse) Jul 12, 2015 at 22:23
4

No, the GNU GPL 3 does not prohibit DRM.

Note that in legal terms, DRM is usually referred to as (Effective) Technological Measures (ETM).

The relvant text is in part 3 of GPLv3:

When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.

This text does not forbid DRM/ETM in free software, but provides an explicit permission to circumvent, thereby removing the legal protection otherwise given to ETM by the DCMA and similar laws.

This is a compromise text resulting from a massive resistance from hardware manufacturers and some software developers (including Linus Torvalds) to initial attempts to declare DRM/ETM incompatible with GPLv3.

What if the DRM scheme requires some kind of secret to work? Wouldn't the GPL require this secret to be published and GPL licensed too, making the DRM useless?

No, it would not. DRM/ETM schemes that leverages on Public Key Encryption (PKE) technologies exists. The DRM software would be open source. However, the secret key to "unlock" the application would not, and could be delivered to individual users (presumably after they've paid a premium) out of band. The TOS for the premium service could disallow public sharing of secret keys, and/or the PKE would tie each secret key to a single device, making sharing of secret keys ineffective.

What the GPLv3 anti-DRM clause does, is to permit brute force and other cryptographic attacks on this scheme, in jurisdictions (which is most of them in 2015) that has outlawed "circumvention of technological measures".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.