can-you-trust.html (17457B)
1 <!--#include virtual="/server/header.html" --> 2 <!-- Parent-Version: 1.96 --> 3 <!-- This page is derived from /server/standards/boilerplate.html --> 4 <!--#set var="TAGS" value="essays cultural drm" --> 5 <!--#set var="DISABLE_TOP_ADDENDUM" value="yes" --> 6 <title>Can You Trust Your Computer? 7 - GNU Project - Free Software Foundation</title> 8 <!--#include virtual="/philosophy/po/can-you-trust.translist" --> 9 <!--#include virtual="/server/banner.html" --> 10 <!--#include virtual="/philosophy/ph-breadcrumb.html" --> 11 <!--GNUN: OUT-OF-DATE NOTICE--> 12 <!--#include virtual="/server/top-addendum.html" --> 13 <div class="article reduced-width"> 14 <h2>Can You Trust Your Computer?</h2> 15 16 <address class="byline">by <a href="https://www.stallman.org/">Richard 17 Stallman</a></address> 18 19 <p> 20 Who should your computer take its orders from? Most people think 21 their computers should obey them, not obey someone else. With a plan 22 they call “trusted computing,” large media corporations 23 (including the movie companies and record companies), together with 24 computer companies such as Microsoft and Intel, are planning to make 25 your computer obey them instead of you. (Microsoft's version of this 26 scheme is called Palladium.) Proprietary programs have 27 included malicious features before, but this plan would make it 28 universal.</p> 29 <p> 30 Proprietary software means, fundamentally, that you don't control what 31 it does; you can't study the source code, or change it. It's not 32 surprising that clever businessmen find ways to use their control to 33 put you at a disadvantage. Microsoft has done this several times: one 34 version of Windows was designed to report to Microsoft all the 35 software on your hard disk; a recent “security” upgrade in 36 Windows Media Player required users to agree to new restrictions. But 37 Microsoft is not alone: the KaZaa music-sharing software is designed 38 so that KaZaa's business partner can rent out the use of your computer 39 to its clients. These malicious features are often secret, but even 40 once you know about them it is hard to remove them, since you don't 41 have the source code.</p> 42 <p> 43 In the past, these were isolated incidents. “Trusted 44 computing” would make the practice pervasive. “Treacherous 45 computing” is a more appropriate name, because the plan is 46 designed to make sure your computer will systematically disobey you. 47 In fact, it is designed to stop your computer from functioning as a 48 general-purpose computer. Every operation may require explicit 49 permission.</p> 50 <p> 51 The technical idea underlying treacherous computing is that the 52 computer includes a digital encryption and signature device, and the 53 keys are kept secret from you. Proprietary programs will use this 54 device to control which other programs you can run, which documents or 55 data you can access, and what programs you can pass them to. These 56 programs will continually download new authorization rules through the 57 Internet, and impose those rules automatically on your work. If you 58 don't allow your computer to obtain the new rules periodically from 59 the Internet, some capabilities will automatically cease to function.</p> 60 <p> 61 Of course, Hollywood and the record companies plan to use treacherous 62 computing for Digital Restrictions Management (DRM), so 63 that downloaded videos and music can be played only on one specified 64 computer. Sharing will be entirely impossible, at least using the 65 authorized files that you would get from those companies. You, the 66 public, ought to have both the freedom and the ability to share these 67 things. (I expect that someone will find a way to produce unencrypted 68 versions, and to upload and share them, so DRM will not entirely 69 succeed, but that is no excuse for the system.)</p> 70 <p> 71 Making sharing impossible is bad enough, but it gets worse. There are 72 plans to use the same facility for email and documents—resulting 73 in email that disappears in two weeks, or documents that can only be 74 read on the computers in one company.</p> 75 <p> 76 Imagine if you get an email from your boss telling you to do something 77 that you think is risky; a month later, when it backfires, you can't 78 use the email to show that the decision was not yours. “Getting 79 it in writing” doesn't protect you when the order is written in 80 disappearing ink.</p> 81 <p> 82 Imagine if you get an email from your boss stating a policy that is 83 illegal or morally outrageous, such as to shred your company's audit 84 documents, or to allow a dangerous threat to your country to move 85 forward unchecked. Today you can send this to a reporter and expose 86 the activity. With treacherous computing, the reporter won't be able 87 to read the document; her computer will refuse to obey her. 88 Treacherous computing becomes a paradise for corruption.</p> 89 <p> 90 Word processors such as Microsoft Word could use treacherous computing 91 when they save your documents, to make sure no competing word 92 processors can read them. Today we must figure out the secrets of 93 Word format by laborious experiments in order to make free word 94 processors read Word documents. If Word encrypts documents using 95 treacherous computing when saving them, the free software community 96 won't have a chance of developing software to read them—and if 97 we could, such programs might even be forbidden by the Digital 98 Millennium Copyright Act.</p> 99 <p> 100 Programs that use treacherous computing will continually download new 101 authorization rules through the Internet, and impose those rules 102 automatically on your work. If Microsoft, or the US government, does 103 not like what you said in a document you wrote, they could post new 104 instructions telling all computers to refuse to let anyone read that 105 document. Each computer would obey when it downloads the new 106 instructions. Your writing would be subject to 1984-style retroactive 107 erasure. You might be unable to read it yourself.</p> 108 <p> 109 You might think you can find out what nasty things a treacherous-computing 110 application does, study how painful they are, and decide 111 whether to accept them. Even if you can find this out, it would 112 be foolish to accept the deal, but you can't even expect the deal 113 to stand still. Once you come to depend on using the program, you are 114 hooked and they know it; then they can change the deal. Some 115 applications will automatically download upgrades that will do 116 something different—and they won't give you a choice about 117 whether to upgrade.</p> 118 <p> 119 Today you can avoid being restricted by proprietary software by not 120 using it. If you run GNU/Linux or another free operating system, and 121 if you avoid installing proprietary applications on it, then you are 122 in charge of what your computer does. If a free program has a 123 malicious feature, other developers in the community will take it out, 124 and you can use the corrected version. You can also run free 125 application programs and tools on nonfree operating systems; this 126 falls short of fully giving you freedom, but many users do it.</p> 127 <p> 128 Treacherous computing puts the existence of free operating systems and 129 free applications at risk, because you may not be able to run them at 130 all. Some versions of treacherous computing would require the 131 operating system to be specifically authorized by a particular 132 company. Free operating systems could not be installed. Some 133 versions of treacherous computing would require every program to be 134 specifically authorized by the operating system developer. You could 135 not run free applications on such a system. If you did figure out 136 how, and told someone, that could be a crime.</p> 137 <p> 138 There are proposals already for US laws that would require all computers to 139 support treacherous computing, and to prohibit connecting old computers to 140 the Internet. The CBDTPA (we call it the Consume But Don't Try Programming 141 Act) is one of them. But even if they don't legally force you to switch to 142 treacherous computing, the pressure to accept it may be enormous. Today 143 people often use Word format for communication, although this causes 144 several sorts of problems (see 145 <a href="/philosophy/no-word-attachments.html">“We Can Put an End to Word 146 Attachments”</a>). If only a treacherous-computing machine can read the 147 latest Word documents, many people will switch to it, if they view the 148 situation only in terms of individual action (take it or leave it). To 149 oppose treacherous computing, we must join together and confront the 150 situation as a collective choice.</p> 151 <p> 152 For further information about treacherous computing, see the 153 <a href="https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html"> 154 “Trusted Computing” Frequently Asked Questions</a>.</p> 155 <p> 156 To block treacherous computing will require large numbers of citizens 157 to organize. We need your help! Please support 158 <a href="https://www.defectivebydesign.org/">Defective by Design</a>, the 159 FSF's campaign against Digital Restrictions Management.</p> 160 161 <h3>Postscripts</h3> 162 163 <ol> 164 <li><p> 165 The computer security field uses the term “trusted 166 computing” in a different way—beware of confusion 167 between the two meanings.</p></li> 168 169 <li><p> 170 The GNU Project distributes the GNU Privacy Guard, a program that 171 implements public-key encryption and digital signatures, which you can 172 use to send secure and private email. It is useful to explore how GPG 173 differs from treacherous computing, and see what makes one helpful and 174 the other so dangerous.</p> 175 <p> 176 When someone uses GPG to send you an encrypted document, and you use 177 GPG to decode it, the result is an unencrypted document that you can 178 read, forward, copy, and even reencrypt to send it securely to 179 someone else. A treacherous-computing application would let you read 180 the words on the screen, but would not let you produce an unencrypted 181 document that you could use in other ways. GPG, a free software 182 package, makes security features available to the users; <em>they</em> use <em>it</em>. 183 Treacherous computing is designed to impose restrictions on the users; 184 <em>it</em> uses <em>them</em>.</p></li> 185 186 <li><p id="beneficial"> 187 The supporters of treacherous computing focus their discourse on its 188 beneficial uses. What they say is often 189 correct, just not important.</p> 190 <p> 191 Like most hardware, treacherous-computing hardware can be used for 192 purposes which are not harmful. But these features can be implemented in 193 other ways, without treacherous-computing hardware. The principal 194 difference that treacherous computing makes for users is the nasty 195 consequence: rigging your computer to work against you.</p> 196 <p> 197 What they say is true, and what I say is true. Put them together and 198 what do you get? Treacherous computing is a plan to take away our 199 freedom, while offering minor benefits to distract us from what we 200 would lose.</p></li> 201 202 <li><p> 203 Microsoft presents Palladium as a security measure, and claims that 204 it will protect against viruses, but this claim is evidently false. A 205 presentation by Microsoft Research in October 2002 stated that one of 206 the specifications of Palladium is that existing operating systems and 207 applications will continue to run; therefore, viruses will continue to 208 be able to do all the things that they can do today.</p> 209 <p> 210 When Microsoft employees speak of “security” in connection with 211 Palladium, they do not mean what we normally mean by that word: 212 protecting your machine from things you do not want. They mean 213 protecting your copies of data on your machine from access by you in 214 ways others do not want. A slide in the presentation listed several 215 types of secrets Palladium could be used to keep, including 216 “third party secrets” and “user 217 secrets”—but it put “user secrets” in 218 quotation marks, recognizing that this is somewhat of an absurdity in the 219 context of Palladium.</p> 220 <p> 221 The presentation made frequent use of other terms that we frequently 222 associate with the context of security, such as “attack,” 223 “malicious code,” “spoofing,” as well as 224 “trusted.” None of them means what it normally means. 225 “Attack” doesn't mean someone trying to hurt you, it means 226 you trying to copy music. “Malicious code” means code 227 installed by you to do what someone else doesn't want your machine to 228 do. “Spoofing” doesn't mean someone's fooling you, it means 229 you're fooling Palladium. And so on.</p></li> 230 231 <li><p> 232 A previous statement by the Palladium developers stated the basic 233 premise that whoever developed or collected information should have 234 total control of how you use it. This would represent a revolutionary 235 overturn of past ideas of ethics and of the legal system, and create 236 an unprecedented system of control. The specific problems of these 237 systems are no accident; they result from the basic goal. It is the 238 goal we must reject.</p></li> 239 </ol> 240 241 <hr class="thin" /> 242 243 <p>As of 2015, treacherous computing has been implemented for PCs in 244 the form of the “Trusted Platform Module”; however, for 245 practical reasons, the TPM has proved a total failure for the goal of 246 providing a platform for remote attestation to verify Digital 247 Restrictions Management. Thus, companies implement DRM using other 248 methods. At present, “Trusted Platform Modules” are not 249 being used for DRM at all, and there are reasons to think that it will 250 not be feasible to use them for DRM. Ironically, this means that the 251 only current uses of the “Trusted Platform Modules” are 252 the innocent secondary uses—for instance, to verify that no one 253 has surreptitiously changed the system in a computer.</p> 254 255 <p>Therefore, we conclude that the “Trusted Platform 256 Modules” available for PCs are not dangerous, and there is no 257 reason not to include one in a computer or support it in system 258 software.</p> 259 260 <p>This does not mean that everything is rosy. Other hardware systems 261 for blocking the owner of a computer from changing the software in it 262 are in use in some ARM PCs as well as processors in portable phones, 263 cars, TVs and other devices, and these are fully as bad as we 264 expected.</p> 265 266 <p>This also does not mean that remote attestation is harmless. If 267 ever a device succeeds in implementing that, it will be a grave threat 268 to users' freedom. The current “Trusted Platform Module” 269 is harmless only because it failed in the attempt to make remote 270 attestation feasible. We must not presume that all future attempts 271 will fail too.</p> 272 273 <hr class="no-display" /> 274 <div class="edu-note c"><p id="fsfs">This essay is published in 275 <a href="https://shop.fsf.org/product/free-software-free-society/"><cite>Free 276 Software, Free Society: The Selected Essays of Richard 277 M. Stallman</cite></a>.</p></div> 278 </div> 279 280 </div><!-- for id="content", starts in the include above --> 281 <!--#include virtual="/server/footer.html" --> 282 <div id="footer" role="contentinfo"> 283 <div class="unprintable"> 284 285 <p>Please send general FSF & GNU inquiries to <a 286 href="mailto:gnu@gnu.org"><gnu@gnu.org></a>. There are also <a 287 href="/contact/">other ways to contact</a> the FSF. Broken links and other 288 corrections or suggestions can be sent to <a 289 href="mailto:webmasters@gnu.org"><webmasters@gnu.org></a>.</p> 290 291 <p><!-- TRANSLATORS: Ignore the original text in this paragraph, 292 replace it with the translation of these two: 293 294 We work hard and do our best to provide accurate, good quality 295 translations. However, we are not exempt from imperfection. 296 Please send your comments and general suggestions in this regard 297 to <a href="mailto:web-translators@gnu.org"> 298 <web-translators@gnu.org></a>.</p> 299 300 <p>For information on coordinating and contributing translations of 301 our web pages, see <a 302 href="/server/standards/README.translations.html">Translations 303 README</a>. --> 304 Please see the <a 305 href="/server/standards/README.translations.html">Translations README</a> for 306 information on coordinating and contributing translations of this article.</p> 307 </div> 308 309 <!-- Regarding copyright, in general, standalone pages (as opposed to 310 files generated as part of manuals) on the GNU web server should 311 be under CC BY-ND 4.0. Please do NOT change or remove this 312 without talking with the webmasters or licensing team first. 313 Please make sure the copyright date is consistent with the 314 document. For web pages, it is ok to list just the latest year the 315 document was modified, or published. 316 317 If you wish to list earlier years, that is ok too. 318 Either "2001, 2002, 2003" or "2001-2003" are ok for specifying 319 years, as long as each year in the range is in fact a copyrightable 320 year, i.e., a year in which the document was published (including 321 being publicly visible on the web or in a revision control system). 322 323 There is more detail about copyright years in the GNU Maintainers 324 Information document, www.gnu.org/prep/maintain. --> 325 326 <p>Copyright © 2002, 2007, 2015, 2021 Richard Stallman</p> 327 328 <p>This page is licensed under a <a rel="license" 329 href="http://creativecommons.org/licenses/by-nd/4.0/">Creative 330 Commons Attribution-NoDerivatives 4.0 International License</a>.</p> 331 332 <!--#include virtual="/server/bottom-notes.html" --> 333 334 <p class="unprintable">Updated: 335 <!-- timestamp start --> 336 $Date: 2021/09/11 09:37:22 $ 337 <!-- timestamp end --> 338 </p> 339 </div> 340 </div><!-- for class="inner", starts in the banner include --> 341 </body> 342 </html>