2. Co-ordinated by aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Digital Rights Management Kirnn Kaur The British Library

3. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Introduction & Terminology Challenges (including representation of Rights Information) Classification and Evaluation of DRM Exercise 1 – survey Survey Results Case studies DNB and BL Exercise 2 – your recommendations Recommendations Outline

4. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Motivation DRM includes primarily mechanisms to protect rights like copyright and intellectual property rights of producers and authors of digital content DRM can be found in digital objects like eBooks, music, movies or video games, principally in any kind of publication DRM mechanisms are accompanied by restrictions for accessing and using the content, and reproducing (copying) the underlying digital bytes  New challenge for digital long term archiving

5. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Approach in APARSEN Develop a common understanding of Digital Rights and Digital Rights Management (DRM) Review of current State-of-the-Art in DRM techniques and tools Classification and Evaluation of DRM techniques against their impact and risk on the long-term preservation Analysis of DRM use and dealing with digital rights Analysis results of DRM surveys (like The Dutch DRM survey and the APARSEN DRM survey) and consider concrete user scenarios Recommendations for dealing with DRM materials and their preservation

6. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 ‘Rights’ associated with accessing, using, creating and publishing digital content Permissions or limitations Can relate to copyright legislation, intellectual property rights or contractual agreements Digital Rights

7. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Digital Rights Management "Digital Rights Management (DRM) involves the description, layering, analysis, valuation, trading and monitoring of the rights over an enterprise's tangible and intangible assets. DRM covers the digital management of rights - be they rights in a physical manifestation of a work (e.g. a book), or be they rights in a digital manifestation of a work (e.g. an ebook).“ from: Iannella, R. (2002). Open Digital Rights Language (ODRL) Version 1.1. Retrieved 11 25, 2013, from W3C: http://www.w3.org/TR/odrl/

8. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 What does DRM do? Control Tracking Access Use Prevention unauthorized access unintentional use legal infringements Monitoring Invoice intentional use

9. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Digital Rights Management

10. aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Challenge What is the challenge in the context of long-term preservation? preservation and protection over the long-term changing legislative base Q: - What are Digital Rights? - How are they represented? - How can they be preserved? Digital RightsDigital Rights Management DRM mechanisms are accompanied by restrictions for accessing and using the content, and reproducing (copying) the underlying digital bytes Q: - Which DRM techniques and tools are used? - Do they restrict current or future use? - Do they include an external dependency?

11. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Representation of Digital Rights To manage and preserve digital rights information, a form of their digital representation is needed => Rights Expression Languages (RELs) from: http://www.loc.gov/standards/rights/METSRights.xsd

12. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Representation of Digital Rights Examples of RELs: Open Digital Rights Language (ODRL) - created in 2000 to address the needs of the DRM sector when media players were first introduced to the marketplace METSRights - maintained by the Library of Congress XrML - increasingly used to write software licenses, standardized as the REL for MPEG-21 PREMIS - Rights entity, rights can pertain to an Object and/or Agent.

13. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Representation of Digital Rights Management and preservation of digital rights information from: http://www.loc.gov/standards/rights/METSRights.xsd

14. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Classification of most common DRM variants 1. Data carrier copy protection ► e.g., errors in data streams of audio CDs 2. Lightweight DRM ► marking techniques such as digital watermarks 3. Encryption-based password protection ► protection of access and/or use like printing, editing, copying,... 4. DRM systems ► see next slide

15. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Classification of most common DRM variants 4. DRM systems ► entire rights and access management lies outside the object

16. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Evaluation scale Evaluation ValueCharacterization no riskNo risk for future LTP measures medium Possible to use at present (at time of publication) in up-to-date hard and software environment, current LTP measures restricted, no external dependencies, medium risk for future LTP measures high Use and LTP measures already (currently) restricted, high risk for implementation of LTP measures in the future as result of external dependencies

17. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Evaluation DRM categoryRiskRationale 1. Data carrier copy protection medium current use is possible carrier has a finite life 2. Lightweight DRMno riskno restrictions on access or use 3. Encryption-based password protection medium dependency upon password may include usage restrictions 4. DRM systemshigh external dependencies high complexity

18. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 SURVEY RESULTS

19. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Introduction Purpose of the survey Approach undertaken Respondents to the survey Survey highlights Summary of survey findings

20. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Purpose The purpose of the survey was to find out how the participants handle: - DRM-protected material - the associated rights The primary aim was to discover how archiving of such objects is dealt with and what is being done to protect the rights information

21. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Exercise 1: DRM survey Please fill in the DRM survey from the perspective of your home institutions as far as possible. If you are not familiar with all the details, try to come up with plausible answers just for training purposes. If you are a student, try to take the position of your university library or an institution that you are familiar with. [20 min max]

22. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Approach The approach was to focus on memory institutions as well as research facilities and data centres To obtain new ideas on the approaches to handling DRM Web-based survey Carried out over Sept and Oct 2013

23. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey respondents 18 respondents, responses asked to be treated confidentially except for four organisations Participants: - national libraries (n=9) - scientific research organisations (n=3) - archives (n=2) - universities (n=2) - one publisher - one project Geographically, 16 of the respondents were from Europe (Austria, Denmark, Finland, France, Germany, Italy, Netherlands, Switzerland and UK) with two were from the USA..

24. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey overview Survey was divided into following sections: - Legislative framework - The data stock - Approach of dealing with DRM protected material - Approach of dealing with digital rights - Digital rights and access - Dealing with DRM protected material as data holders - Dealing with DRM protected material as data creators

25. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights – legislative framework Legal deposit legislation in various countries determines the format and delivery of digital publications Organisations apply rights in accordance with copyright law In the case of publishers, copyright law is applied based on authors' rights and contracts are in place to deal with rights issues In other cases, there are limited legislative requirements in place Where data is produced which may not be subject to legal controls such as copyright, due to the growing interest in the availability and re-use of this data access issues need to be considered

26. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights – the data stock The preservation of digital material varies depending on the organisation - Some have dealt with digital materials since their inception, others have inherited, or have grown as the amount of digital material being produced increases - Where material has been held is historic or has been inherited, preservation may not have been undertaken Data that has been archived varies enormously (publications, research datasets, website archives, audio etc.), wide range of file formats Of the 18 respondents, 61% have dealt with DRM protected material, whilst 39% do not consider DRM to be an issue for their organisation

27. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights: Approaches of dealing with DRM protected material 1 of 2 Recommendation: data related to DRM should be collected automatically during business processes along the lifecycle of the digital object  open access  DRM provider allows access under specific usage scenarios  using deposit licences in combination with conditions of use  requiring potential data users to justify their use  closed during an embargo period  data creators asked to provide material free of DRM

28. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights: Approaches of dealing with DRM protected material 2 of 2 Of the ten respondents more than half (60%) stated that they had no plans for a DRM mechanism for existing digital objects, however 40% stated plans were in place

29. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights: Approach of dealing with digital rights (n=13) 53% stated that metadata standards, like PREMIS and METSrights were in place 62% stated that they processed and preserved rights information at object level

30. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights: Digital rights and access Software tools used for access (from most popular) - Developed in-house - Commercial - Open source Access categories: - Access is limited - Open access (as well as remotely) - No public access Where access is allowed this is mainly remotely with user authentication, in some cases access only in-house

31. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights – approach of dealing with DRM protected material as data holders 79% of the organisations (n=18) are data holders 60% of respondents (n=10) stated that the detection of DRM and digital rights information is a part of their ingest process Rights information may be included within deposit agreements Automatic detection of DRM and digital rights can be undertaken using open-source tools 60% of respondents (n=10) do not accept DRM protected material Although some material cannot be provided without DRM, other material is ingested in bulk with no means of assessing the DRM status (i.e. bulk web harvesting)

32. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Survey highlights - approach of dealing with DRM protected material as data creators Where data creators are also data holders, the same DRM mechanism would apply to the material held as well as created Examples of approaches include: - simple embargo where data is released after a defined timescale - rights metadata is used to allow access via applicable services which apply relevant DRM. A publishing tool is used that automatically acts on the metadata and streaming allows viewing only but not downloading - access to web pages are also designed using the underlying rights metadata - controls are at item level which involves human interaction in order to determine the requirements for certain items and allows for the relevant actions as required

33. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 CASE STUDIES DNB BL

34. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 DNB advises its deliverers to submit DRM free publications Since 2012, DRM mechanisms are detected automatically during the ingest workflow DRM protected material is rejected and re-submission is requested Why? –DRM poses a risk to digital preservation –DNB wants to preserve “unaltered originals” and abstains from normalization measures during ingest (  Authenticity) DRM at the DNB

35. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Data types that are occasionally submitted with DRM protection: –Doctoral theses –E-Books –E-Journals –E-Papers (digital versions of newspapers) Typical DRM techniques used: –PDF document restrictions (password protection, print & copy restrictions) –Adobe’s LifeCycle Management –Encrypted ZIP containers DRM at the DNB

36. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 DRM detection at the DNB Regular unpack routine for ZIP containers uncovers encrypted ZIP containers File Information Tools Set (FITS) with JHOVE, NZLZ Metadata Extractor detects document restrictions Caution: - Limited capabilities of the metadata tools - Does every kind of restriction pose a risk to long term preservation? - It is not always possible to get the publishers to submit DRM free versions

37. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Challenges at the DNB Increase and change of file formats and DRM techniques New technologies like tables PCs and portable E-Book readers with new embedded DRM techniques Already archived objects with DRM protection: - Between 1998 and 2012, DRM was only detected manually in sample checks  Not documented  No statistical values available - In 2014, re-ingest of old these material via the new and improved ingest workflow that allows detection of DRM mechanisms - DNB is entitled to remove DRM  Future project

38. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 DRM at the BL A project was carried out in 2013 to: “provide a DRM solution that allows each work in the BL’s digital collections to be made available under the widest possible usage terms, whilst preventing digital content being used by unauthorised users, or used by authorised users in unauthorised ways.” Three key areas of work: Usage rights definitions Business requirements analysis Architecture definition document

39. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Components of DRM at the BL

40. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 DRM at the BL – keys findings Benefits Make more digitised content available for online access and re-use Collect open access, contemporary research outputs Link to open access content collected under NPLD regulations Make digitised content available under a variety of business models Link to public domain digitised content Digitise content on demand and supply it under the right usage terms Take in rights cleared, free content for portals and other services

41. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 DRM at the BL – key issues and challenges Vocabulary and terminology Business processes Maintaining changing digital rights BL copyright and IP policy; contracts Architecture Existing and new digital content Services and applications Metadata Specialist skills and knowledge

42. Digital rights and access management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Challenges at the BL Rights issues are complex which include contractual agreements and the application of legislation to digital material. These complexities also relate to our content, business processes and systems. One of our key objectives was to simplify and unify this complex world as much as possible. The challenges are listed below: - Vocabulary and terminology must be defined, understood and agreed - DRM has a major impact on business processes. In many areas our business processes are manual and could be automated - Maintain digital rights as they change over time - DRM capability to support copyright and IP policy as well as access and re-use policies - IT architecture is complex. The main areas which need to support DRM are ingest processes including strategic ingest, our catalogues and the DLS; also our services and applications - Legacy digital content, to which DRM needs to be applied; taking into account new content streams – more digitisation projects, more open access content - Access control for our services and applications at the level of the individual application, needs relevant rights metadata so that content that can be used in different services - Licences and contracts need to be automated with machine-readable rights metadata by focussing on the terms of use - Finally, the skills to apply rights metadata need to exist across a number of operational processing areas

43. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 DRM at the BL – recommendations Evaluate the proposed ‘operational DRM’ approach in more depth. Identify which services need to display usage rights so users understand what they are able to do with digital content. Undertake a more systematic analysis of digital rights maintenance, audit and tracking requirements. Analyse and document business processes. Automate existing manual processes where appropriate, within digital rights maintenance component. Implement the usage rights expressions within MER and apply usage rights retrospectively to content already held within the DLS. Make corresponding changes to ingest routines and METS profiles.

44. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 DRM at the BL – Project team Project team: Lucie Burgess (SRO) – Head of Online Services David Sweeney (PM) – Technical Project Delivery Martin Moloney (BA) – Business Assurance Ben White – Head of Intellectual Property Sally Halper – Social Sciences Content Development Manager Sean Martin – Head of Architecture & Development Lewis Crawford – Head of Architecture Team Simon Downes – Technical Data Architect Sharon Johnson - Head of Content Development Implementation Hannah Jenkins – Portfolio Manager, Audiences Anna Vernon - Licensing & Copyright Assurance Manager Stakeholders: many – including curatorial teams, IP and licensing team, architecture team, Documents Supply, Collection acquisition areas

45. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Exercise 2: recommendations quiz APARSEN came up with a number of recommendations of how to deal with Digital Rights and DRM. Do you have further ideas on how to deal with these topics? [ca. 10 min] Depending on the number of participants, 10-15 min report back to plenary

46. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 1.List four general recommendations which you believe will facilitate the long term preservation of DRM 2.List four recommendations which you believe will facilitate the protection of digital rights 3.List four recommendations which you believe will facilitate the handling of DRM protected materials DRM RECOMMENDATIONS QUIZ

47. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 RECOMMENDATIONS

48. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Areas of concern Preservation of digital rights over the long-term Update digital rights information in cases of changing legislative base R ECOMMENDATIONS FOR THE PROTECTION OF DIGITAL RIGHTS DRM could be medium- or high-risky for the long-term preservation, because: DRM - restricts access (downloading, streaming) - controls use (viewing, playing, copying, dissemenation, resell) => DRM could hinder preventive and subsequent LTP measures R ECOMMENDATIONS FOR THE HANDLING OF DRM PROTECTED OBJECTS

49. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Recommendations - general a)Keep the technical design simpleLess variations make rights, process and roles more manageable and affordable b)Use standard toolsOne tool for all formats and document types is hard to maintain and risky because of its complexity; in contrast: the usage of standard tools for a specific format is more robust against error and has only impact on the specific file format c)DRM and Rights PolicyTransparency in dealing with DRM and digital rights d)Collaboration between rights holders and archives Make the content creators and publishers aware of the risk that DRM carries related to long-term preservation so that they are more inclined to deposit digital objects free of DRM.

50. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Recommendations – protection of digital rights a)Detection of RightsWhich rights are associated with the archival content? Are the rights information supplied by the content provider or do they have to be determined? b)Documentation and Application of Rights The structured storage, management and preservation of rights information in a Rights Management System that is connected to the access function. Access and use are managed in accordance with the rights information in the Rights Management System c)Information about digital RightsRaise awareness of the user about the handling of digital materials. d)Storage in the Archival Package The additional storage of rights information with help of metadata standards like REL in the Archival Package. It allows the re-creation of rights information in case the Data Management or another Rights Management Systems is damaged or destroyed.

51. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Recommendations – handling of DRM protected objects a)DRM detectionIs an object protected with DRM measures? Precondition for further measures. b)Measures when DRM is detectedAdequate measures like further examinations, request of DRM free versions of rejection, dependent of the employed DRM mechanism c)Documentation and Archiving of DRM Archiving of DRM protected objects and documentation of utilized measures in Data Management. The purpose is to facilitate activities that are targeted towards DRM protection measures like normalization into a DRM free format or copying onto a generic data carrier. d)DRM Removal If the legal conditions allow for it, the removal of DRM protection measures in order to derive an object without DRM. e) f) Format Policy Analyse existing data stock The specification of preferred file formats facilitates the handling of utilized tools Detect potential risks related to DRM in time. The longer the risk remains undetected, the greater the risk that content is lost.

52. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Conclusion Through the integration of proprietary rights control mechanisms as an integral component of digital objects, a new problem has arisen with regard to long-term archiving For memory institutions, safeguarding the protective rights of their archived assets is essential Analyzing and assessing the used DRM techniques when considering the presented recommendations can help to be prepared

53. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 References [1]“About APARSEN”, 2014. [Online] Available: http://www.alliancepermanentaccess.org/index.php/aparsen/ [Accessed 13 03 2014]. http://www.alliancepermanentaccess.org/index.php/aparsen/ [2] R. Iannella, "Open Digital Rights Language (ODRL) Version 1.1," 2002. [Online]. Available:http://www.w3.org/TR/odrl/. [Accessed 25 11 2013]. [3]R. Grimm and C. Neubauer, "LWDRM - An Alternative Rights Management System," 2004. [Online]. Available: http://waste.informatik.hu- berlin.de/Grassmuck/drm/Folien-Grimm-Neubauer-eng.pdf. [Accessed 25 11 2013].http://waste.informatik.hu- [4]B. Rosenblatt, "Enterprise Digital Rights Managament," 14 July 2005. [Online]. Available: http://www.giantstepsmts.com/Authentica-RMS%20Whitepaper.pdf, pg. 5. [Accessed 06 03 2014].http://www.giantstepsmts.com/Authentica-RMS%20Whitepaper.pdf [5]K. Kaur, S. Hein, S. Schrimpf, M. Ras and M. Holzmayer, “Report in DRM preservation”, 2014. [Online]. Available: http://www.alliancepermanentaccess.org/wp-content/plugins/download- monitor/download.php?id=D31.1+Report+on+DRM+preservation. [Accessed 06 03 2014]. http://www.alliancepermanentaccess.org/wp-content/plugins/download- monitor/download.php?id=D31.1+Report+on+DRM+preservation

54. Digital Rights Management aparsen.eu #APARSEN Co-funded by the European Union under FP7-ICT-2009-6 Many thanks Kirnn Kaur The British Library 96 Euston Road London NW1 2DB Tel: +44 (0)20 7412 7991 mailto:kirnn.kaur@bl.uk http://www.bl.uk Stefan Hein Deutsche Nationalbibliothek Informationstechnik Adickesallee 1 D-60322 Frankfurt am Main Tel.: +49-69-1525-1722 mailto:s.hein@dnb.de http://www.dnb.de

55. aparsen.eu #APARSEN Network of Excellence