Source files of fsfe.org, pdfreaders.org, freeyourandroid.org, ilovefs.org, drm.info, and test.fsfe.org. Contribute: https://fsfe.org/contribute/web/ https://fsfe.org
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

open-letter-ec-drm-html.en.xhtml 8.6KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160
  1. <?xml version="1.0" encoding="UTF-8" ?>
  2. <html>
  3. <head>
  4. <title>Open Letter on European Commission about DRM in HTML5</title>
  5. </head>
  6. <body>
  7. <h1>Open Letter to European Commission about DRM in HTML5</h1>
  8. <p>To: Commissioner Cecilia Malmstroem (Home Affairs)</p>
  9. <p>CC: Antonio Tajani (Enterprise)<br />
  10. Viviane Reding (Justice)<br />
  11. Joaquin Almunia (Competition)<br />
  12. Michel Barnier (Internal Market)<br />
  13. Neelie Kroes (Digital Agenda)</p>
  14. <p>Dear Commissioner Malmstroem,</p>
  15. <p>we are writing to you on the occasion of the international Day Against
  16. Digital Restrictions Management, which today is being celebrated around the
  17. world. We are very concerned about the security of European citizens, and
  18. we ask you to take action to protect them.</p>
  19. <p>The Free Software Foundation Europe (FSFE) is an independent charitable
  20. non-profit dedicated to promoting Free Software and freedom in the
  21. information society. Today we would like to direct your attention to a very
  22. specific threat to the freedom and security of computer users
  23. everywhere.</p>
  24. <p>Both at work and in our personal lives, we conduct a large part of our
  25. activity through Web browsers. Ever more of our work and life migrates into
  26. the digital domain, and many people use a growing number of web services to
  27. work, create, socialise, and express themselves. Businesses and public
  28. sector organisations similarly rely on web browsers as crucial tools to
  29. perform their everyday tasks.</p>
  30. <p>Recently, the importance of the Web browser was highlighted when <a
  31. href="http://www.us-cert.gov/ncas/current-activity/2014/04/28/Microsoft-Internet-Explorer-Use-After-Free-Vulnerability-Being">numerous
  32. state agencies and IT security companies warned about a long-standing
  33. critical security problem in the widely used Microsoft Internet Explorer
  34. browser</a>, soon followed by warnings of a <a
  35. href="http://helpx.adobe.com/security/products/flash-player/apsb14-13.html">vulnerability
  36. in the also widely used Adobe Flash Player</a>.</p>
  37. <p>These incidents were only the most recent ones to highlight the
  38. importance of ensuring that such a crucial piece of software as the Web
  39. browser is fully under the control of its user. The <a
  40. href="https://www.allianz-fuer-cybersicherheit.de/ACS/DE/_downloads/anwender/software/BSI-CS_071.html">German
  41. Federal Office of Information Security (BSI) issued a list of
  42. recommendations for secure Web browsers and their components</a> for
  43. use in companies and public bodies on April 14. The BSI notes that due to
  44. the way they are used, "Web browsers are exposed to especially high risk
  45. from malware". In the list of recommendations for a secure Web browser,
  46. the BSI includes the demand that <strong>Web browsers and their components should
  47. be completely auditable</strong> (Point 1.6). </p>
  48. <p>Web browsers like Mozilla Firefox or the Chromium browser have succeeded
  49. in this regard, providing the public with web browsers that are not only
  50. fully auditable, but which can also be freely shared and improved. This is
  51. in line with the <a href="/activities/os/def.html">Open Standards</a>
  52. approach which has made it possible for the Internet and the World Wide Web
  53. to thrive and grow into its current role as a vital platform for economic
  54. activity, social interaction without borders, and unchained creativity.</p>
  55. <p>The protocols on which the Internet is built, such as the TCP/IP stack
  56. and the HTML standard, are fully open and implemented in myriad <a
  57. href="/about/basics/freesoftware.html">Free Software</a> products. Free
  58. Software powers the vast majority of Web servers, smartphones, embedded
  59. devices, and many other applications of technology. The rise of today's
  60. leading Web companies, such as Google, Facebook, and Amazon, would not have
  61. been possible without Free Software, and they could not operate without it
  62. today. Whatever European companies step up to challenge them are inevitably
  63. going to rely on Free Software and Open Standards as well. Free Software and
  64. Open Standards are both the foundation of our digital world, and the condicio
  65. sine qua non for its future.</p>
  66. <p>HTML5 is the latest revision of the HTML standard. It is hard to think
  67. of a standard that is more crucial for the World Wide Web. HTML5 will
  68. deliver a number of important improvements, and is set to be the basis of
  69. the World Wide Web for the coming years, and to allow for the kind of rich,
  70. responsive interactivity that will allow browsers to replace "apps" as
  71. controllers for everything from thermostats to automobiles.</p>
  72. <p>This is why we are very concerned about efforts currently in progress at
  73. the World Wide Web Consortium, which oversees many of the key standards on
  74. which the Internet and the World Wide Web are based, to <strong>encourage use of
  75. the Content Decryption Module (CDM)</strong> which cannot be audited. The CDM,
  76. though not specified in the HTML5 standard itself, is required by the
  77. so-called "Encrypted Media Extension" (EME), developed by a W3C working
  78. group. This extension's primary purpose is to satisfy the desire of a
  79. limited number of content providers with traditional business models to
  80. generate revenue through restrictive distribution practices. With EME, the
  81. W3C would be <strong>building a bridge to let content providers take control of
  82. users' computers</strong>, letting them impose restrictions far in excess of what
  83. consumers' rights and copyright allow.</p>
  84. <p>The discussion about EME at W3C is largely driven by a few large
  85. US-based companies, and except the BBC <a
  86. href="http://blogs.fsfe.org/gerloff/2014/04/29/w3c-whos-working-on-drm-in-html5/">takes
  87. place without significant European involvement</a>. Given these
  88. circumstances, the discussion will likely result in a solution that fails to
  89. take the needs of European citizens, businesses and governments fully into
  90. account.</p>
  91. <p>Auditing the Content Decryption Module will be difficult, because the source
  92. code of this functionality will be a closely held secret of the company
  93. which provides it. Performing such an audit and reporting security flaws
  94. would also be <strong>illegal in the many countries which have adopted so-called
  95. "anti-circumvention" laws</strong>. Reporting a security problem in CDM would expose
  96. the reporter to the risk of prosecution for making a circumvention
  97. device.</p>
  98. <p>In consequence, individuals, companies and organisations (including the
  99. European Commission) would likely end up increasing the amount of software
  100. with unknowable security problems which it uses in a high-risk setting.</p>
  101. <p><strong>Integrating DRM facilities into HTML5 is the antithesis of everything
  102. that has made the Internet and the World Wide Web successful</strong>. It is
  103. directly contrary to the interests of the vast majority of Internet users
  104. everywhere, and especially in Europe.</p>
  105. <h2>Recommendations</h2>
  106. <p>The discussions within W3C are now at a crucial juncture in this regard.
  107. It is still just about possible to prevent the W3C from making it too easy
  108. to effectively require the inclusion of such secret, inauditable software
  109. in Web browsers.</p>
  110. <ul>
  111. <li>We urge the Commission to engage with the W3C and ensure that the
  112. organisation takes these concerns on board as it decides on the adoption
  113. of the Encrypted Media Extension (EME).</li>
  114. <li>We further ask the Commission to underline its commitment to the
  115. security and freedom of Europe's citizens by pledging not to make use of
  116. the Encrypted Media Extension in its own infrastructure, even if EME
  117. would be standardised by W3C.</li>
  118. <li>At a minimum, the W3C should require covenants from EME participants
  119. through which they promise not to take action against entities who report
  120. and demonstrate vulnerabilities in EME and the CDM; and covenants to
  121. safeguard entities who reverse-engineer and publish details of EME and
  122. CDM implementations for the purpose of interoperability, including
  123. interoperability with Free Software.</li>
  124. </ul>
  125. <p>At FSFE, we look forward to supporting the Commission in taking the
  126. appropriate actions to safeguard the interests of Europe's citizens and
  127. companies, and remain at the Commission's service.</p>
  128. <p>
  129. Sincerely,<br />
  130. Karsten Gerloff, President Free Software Foundation Europe
  131. </p>
  132. </body>
  133. </html>