FCC Fires Wi-Fi Router Salvo in Battle of DRM vs. Open Source

Digital Rights Management (DRM), the backbone of copyright protection for every form of digital property from games and software to ebooks and music is finally coming to blows with its natural enemy: the open-source software movement.

The fight is rooted in the longstanding belief of organizations such as the Electronic Frontier Foundation (EFF) and the Free Software Foundation (FSF) that DRM and open source are "fundamentally incompatible" and comes to the fore on an unlikely front: Wi-Fi routers.

The Federal Communications Commission (FCC) has proposed a new set of regulations that would require Wi-Fi router providers such as Asus, Linksys, Netgear, and others to allow only "properly authenticated software" to operate on devices. The FCC also states that router hardware running DRM-licensed software should not be modified and that no unauthorized third parties should have access.

While the term "open source" doesn't appear even once in the document, the proposal mentions the DD-WRT open-source router project by name. DD-WRT is a free, Linux-based firmware for several wireless routers. Read between the lines, and you'll spot a concerted move to expel the many popular open-source firmware distributions and hardware configurations populating the Wi-Fi router space.

As commenters in animated debates on Hacker News and Slashdot argue, the reach and ramifications of the FCC's proposal are still unclear. John Kindervag, Vice President and Principal Analyst at Forrester Research, whose research focuses on security and risk, also expressed doubt about whether or not the FCC's requirements are realistic. "In general, DRM has a pretty good history of being bypassed," said Kindervag. "I would think this would be hard to do and to enforce."

The regulation only applies to devices in the 5GHz radio frequency band but, as InfoQ points out, this applies to more and more "dual-band" systems and those running baseband processors—and could establish a precedent for not only routers but smartphones and Internet of Things (IoT) devices.

If the requirements pass, device manufacturers that want to distribute in the U.S. will be faced with a critical business decision between enforcing government-mandated DRM or allowing open-source firmware distributions to continue to operate. Tyler Shields, Mobile and Application Security Market analyst at Forrester, said the FCC's security requirements could have a serious impact on applications—and code in general.

"Until now, we haven't had much legislation in this space but there seems to be a lot in motion," said Shields. "We won't be able to have any real security until we have legal and financial ramifications for putting out code with security flaws. I think what we are seeing is the first step towards legal liability of software. At some point, regulation will have to step in as IoT bridges the gap between digital and physical."

A coalition of organizations including the EFF, FSF, Software Freedom Law Center (SFLC), Software Freedom Conservancy, the OpenWrt and libreCMC open-source distributions, and Qualcomm have published an open letter and launched the SaveWiFi campaign (an archive.is capture; the real link is at this overloaded server) in protest of the proposed FCC rules, which are open for comment through Sept. 8.