Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
Is DRM, which some spell as "Digital Rights Management", others as "Digital Restriction Management", allowed by the GPL? In other words, can software that implements DRM be licensed under the GPL? Assume version 3 of the GPL.
What if the DRM scheme requires some kind of secret to work? Wouldn't the GPL require this secret to be published and GPL licensed too, making the DRM useless?
There is nothing which prohibits you from creating software which implements DRM and licensing it under GPL. The GPL can be applied to any software, regardless of what that software does when it is run.
But from a purely technical viewpoint, open source software can hardly be effective at enforcing DRM because the user could easily modify the software to ignore any restriction the DRM mandates to impose on use of the data the program processes. Requiring some secret to make the software work would also be ineffective because the software could be modified to reveal said secret.
But there is also the legal aspect. There are laws in some countries which forbid to circumvent DRM in some situations, even when it would be technically possible to do so. However, the GPLv3 (not v2) tries to circumvent this. It has section 3 "Protecting Users' Legal Rights From Anti-Circumvention Law." which states that a GPLv3 covered software does never count as a protection measure in regards to laws which forbid to circumvent technical measures to enforce copyrights. This makes GPLv3 software ineffective for implementing DRM, both technically and legally.
A workaround which is available when the DRM-based software runs on dedicated hardware is to lock down the hardware in a way that a modified software does not run ("tivoization"). A clause which would have prohibited this did not make it into the final version of the GPLv3.
No, the GNU GPL 3 does not prohibit DRM.
Note that in legal terms, DRM is usually referred to as (Effective) Technological Measures (ETM).
The relvant text is in part 3 of GPLv3:
When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
This text does not forbid DRM/ETM in free software, but provides an explicit permission to circumvent, thereby removing the legal protection otherwise given to ETM by the DCMA and similar laws.
This is a compromise text resulting from a massive resistance from hardware manufacturers and some software developers (including Linus Torvalds) to initial attempts to declare DRM/ETM incompatible with GPLv3.
What if the DRM scheme requires some kind of secret to work? Wouldn't the GPL require this secret to be published and GPL licensed too, making the DRM useless?
No, it would not. DRM/ETM schemes that leverages on Public Key Encryption (PKE) technologies exists. The DRM software would be open source. However, the secret key to "unlock" the application would not, and could be delivered to individual users (presumably after they've paid a premium) out of band. The TOS for the premium service could disallow public sharing of secret keys, and/or the PKE would tie each secret key to a single device, making sharing of secret keys ineffective.
What the GPLv3 anti-DRM clause does, is to permit brute force and other cryptographic attacks on this scheme, in jurisdictions (which is most of them in 2015) that has outlawed "circumvention of technological measures".
