Digital Rights Management: The Revocable Purchase

Abstract

Digital rights management (DRM) is the family of techniques that let a seller decide, after the sale, what a buyer may do with a digital copy: on which devices it plays, whether it can be lent or resold, and whether it keeps working at all. It began as copy protection for floppy disks and as a 1983 Japanese design for metered software, became law in the U.S. Audio Home Recording Act of 1992 and the DMCA of 1998, and reached the mass market with DVDs, iTunes and e-books. Its effect on piracy was small. Its effect on ownership was large: when Yahoo, Microsoft or Ubisoft switched off a licence server, purchases stopped working, and in July 2009 Amazon deleted copies of Nineteen Eighty-Four from its customers’ Kindles. Music gave up DRM in 2009. Video, books and games kept it, and the argument moved to consumer law, where the European citizens’ initiative “Stop Destroying Videogames” collected 1.29 million signatures by 2026.

Locks Before the Name

Software publishers protected their programs long before anyone said “DRM.” Home-computer games of the late 1970s and 1980s were sold on floppy disks deliberately written with errors, odd track layouts or sectors that standard copy routines could not reproduce, and a cottage industry of copying programs, starting with Locksmith for the Apple II around 1980, answered every new scheme. Publishers added manual lookups (“type the third word on page 12”), code wheels, and hardware dongles plugged into a serial or printer port. All of them annoyed paying customers, and none stopped a determined cracker (see The Warez and Filesharing Era).

The first design for what DRM later became came from Japan. In 1983 the engineer Ryuichi Moriya described a Software Service System in which programs were distributed freely in encrypted form and decrypted by special hardware that metered and charged for their use. Moriya later developed it as “superdistribution.” The idea that copying should be free and use should be controlled, rather than the other way round, is the idea behind every modern DRM system.

The Law Takes a Side

The first time the U.S. government required copy control in consumer equipment was for digital audio tape. Record labels feared that DAT recorders, which made perfect digital copies, would destroy CD sales, and threatened manufacturers with lawsuits. The Audio Home Recording Act of 1992 settled the fight: every consumer digital audio recorder sold in the United States had to implement the Serial Copy Management System, which allowed one digital copy of an original but marked it so that the copy could not itself be copied. Manufacturers also paid a royalty of 2 percent on recorders and 3 percent on blank media into a fund for artists and labels. In exchange, home copying for private use became legal.

Six years later the Digital Millennium Copyright Act of 28 October 1998 went much further. Its Section 1201 made it illegal to circumvent any technical measure controlling access to a copyrighted work, or to distribute a tool for doing so, regardless of whether the user then infringed copyright (see Copyright and IP in the Digital Age and Reverse Engineering and the Law). The law protected the lock, not the work. A buyer who broke a DVD’s encryption to watch it on Linux broke the law even though watching a purchased film was legal.

The first casualties were researchers. In September 2000 the music industry’s Secure Digital Music Initiative challenged the public to break its proposed audio watermarks. A team led by Edward Felten at Princeton broke several of them, and when the team prepared to present its results at an academic workshop in April 2001, Matt Oppenheim of the RIAA, also an SDMI officer, wrote to warn of liability under the DMCA. The authors withdrew the paper. With the Electronic Frontier Foundation they sued the RIAA, SDMI and the Justice Department, and the paper was presented at the USENIX Security Symposium that August.

The Licence Server

The commercial music downloads of the early 2000s were sold under DRM that required the buyer’s software to fetch a licence key from the store’s server. When Apple opened the iTunes Music Store in April 2003, its songs carried Apple’s FairPlay DRM and played only in iTunes and on iPods. Microsoft’s PlaysForSure scheme, used by MSN Music, Napster’s later service and Yahoo Music, worked with dozens of players but none of Apple’s. The customer chose a store and was then tied to its devices.

The weakness of the licence server showed when stores closed. In April 2008 Microsoft told MSN Music customers that from 31 August it would stop issuing licence keys, so their songs would play only on computers already authorised and would be lost on the next new PC or reinstall. After protests it reversed itself on 19 June and promised support until at least the end of 2011. Yahoo announced in July 2008 that its licence servers would go offline on 30 September and offered coupons and, for customers with “serious problems,” refunds. Ed Felten, writing at the time, found “plenty of blame to go around”: the record labels had insisted on the DRM and Yahoo had built and sold it, and the customers, who had bought the music legally, were the ones who lost it.

Steve Jobs had already proposed giving up. In an open letter, “Thoughts on Music,” posted on Apple’s website on 6 February 2007, he argued that DRM had not stopped piracy, since most music was still sold on unprotected CDs, and promised that if the four major labels allowed it, Apple would sell only unprotected music. EMI agreed in April 2007. On 6 January 2009 Apple announced that eight million of the ten million songs in the iTunes Store were available without DRM, the rest to follow by the end of the quarter, in exchange for the variable pricing the labels had wanted. Owners of protected tracks could upgrade them for 30 cents each. Within months, the major download stores sold music without DRM, and streaming services, where the customer never owned a copy at all, made the question less important.

The Deleted Book

E-books kept DRM, and in July 2009 Amazon showed what it allowed. A company had used Amazon’s self-service publishing tools to sell Kindle editions of George Orwell’s Nineteen Eighty-Four and Animal Farm to which it did not hold the rights in the United States. When the rights holder complained, Amazon removed the editions from its store and, overnight, from its customers’ devices, refunding the price. One of the customers was Justin Gawronski, a 17-year-old in Shelby Township, Michigan, who was reading Nineteen Eighty-Four for an Advanced Placement course and had written notes in the margins of the e-book. The notes no longer pointed at anything.

On 23 July Jeff Bezos posted an apology to Kindle customers, which said of the deletion: “Our ‘solution’ to the problem was stupid, thoughtless, and painfully out of line with our principles.” Gawronski and a second customer sued. In the settlement, filed in late September 2009, Amazon paid $150,000, which the plaintiffs said would go to charity after legal fees, and agreed not to delete books from U.S. Kindles except with the customer’s consent, for non-payment or refunds, on court order, or to protect the device and network. Amazon also offered affected customers new copies with their notes restored, or a gift card.

The choice of book made the story famous. The underlying fact, that a bookseller retained the technical power to take a book back after selling it, applied to every DRM-protected book in every store. When Microsoft closed its e-book store in 2019, it stopped sales on 2 April and switched off the books in July, refunding customers in full and paying an extra $25 to those who had made annotations.

Games and the Permanent Connection

Games went the other way. PC publishers, fighting piracy rates far higher than in music, moved from disc checks to online activation. Electronic Arts released Spore in September 2008 with SecuROM DRM that allowed only three installations; buyers responded with thousands of one-star reviews on Amazon, and Spore became one of the most pirated games of the year. In February 2010 Ubisoft announced DRM that required a permanent internet connection even in single-player games. In early March 2010, shortly after Assassin’s Creed II was released for Windows, Ubisoft’s authentication servers went down for several hours (the company said they had been attacked), and paying customers could not play while pirated copies, with the check removed, worked. EA’s SimCity, released on 5 March 2013 with a mandatory connection, was unplayable for many buyers for days because the servers could not cope; Amazon briefly stopped selling the download. An offline mode came in March 2014.

The console makers tested the limit in 2013. Microsoft announced that its Xbox One would need to connect to Microsoft’s servers at least once every 24 hours to play games, and that used disc games could be traded only under conditions publishers set. After the reaction at E3 in June, where Sony announced that the PlayStation 4 would have no such rules, Microsoft dropped the policies on 19 June 2013, five months before the console went on sale.

The publishers that skipped DRM used it as a selling point. GOG, announced by the Polish company CD Projekt in July 2008 as Good Old Games, sold older and later new titles without any copy protection. Valve’s Steam, the dominant PC store, tied games to a customer account rather than to a disc or a machine.

The Server Is the Product

By the 2020s most video, books and games were sold as licences tied to an account, and the remaining fights were about what happened when the seller lost interest. In December 2023 Sony told PlayStation owners that Discovery television programmes they had bought would disappear from their libraries on 31 December because of a lapsed licence; after the reaction, Sony said it had reached a new agreement with Warner Bros. Discovery and the content would stay. The anime service Funimation closed in April 2024, and Sony, its owner, said digital copies bought there would not move to its successor, Crunchyroll.

Ubisoft’s racing game The Crew, released in 2014, could only be played with a connection to Ubisoft’s servers. Ubisoft announced in December 2023 that the servers would close, citing “server infrastructure and licensing constraints,” and from 31 March 2024 the game stopped working for everyone who had bought it. The YouTuber Ross Scott responded with a campaign, “Stop Killing Games,” and a European citizens’ initiative, “Stop Destroying Videogames,” registered on 19 June 2024. It asked the EU to require publishers to leave games they sell in a playable state when support ends. It was submitted to the European Commission on 26 January 2026 with 1,294,188 verified signatures from 24 member states; the European Parliament heard it in April 2026, and the Commission adopted its reply on 16 June 2026. In France the consumer association UFC-Que Choisir sued Ubisoft over the shutdown.

Dead End: DRM as Piracy Control

The original promise of DRM was that it would stop unauthorised copying. It did not, and the reason was built into the design: to let the buyer watch, hear or play the work, the device must decrypt it, so the key has to be on the device, and somebody finds it. CSS, the DVD encryption, fell in 1999; Blu-ray’s AACS key was published in 2007; game protection was typically cracked within days or weeks of release. A 2025 study of the game protection Denuvo found that its value lay in delaying the crack, with revenue losses estimated at about 20 percent when a game was cracked within its first week. Delay, not prevention, was the most any scheme achieved.

What DRM did reliably was give the seller continuing control after the sale. That control was used to stop lending and resale, to lock customers to one company’s devices, and, whenever a server closed, to end the purchase. The music industry, the first to drop DRM, did so in 2009 because its protected product was worse than the free one. Video, books and games kept it because, by then, they were sold as subscriptions and licences, and the server was the product.