(this page is part of the Family Guide to Digital Freedom, 2007 edition. Please do read that introduction to know more about the Guide, especially if you mean to comment this page. Thanks)

In a nutshell, Trusted Computing is yet another thing that could do you lots of good or seriously screw up your life. Let’s start from this question: apart from licensing and prices, can you, or the school and Public Administrations running on your money, freely chose any software and hardware combination you want and, above all, do anything you want with them? In a few years from now, the answer to this question may become “Yes, as long as they are in a list decided by somebody else”.

Welcome to the world of Trusted Computing

A Trusted Computing (TC) platform is a computer, DVD player or any other electronic device which is able to provide reliable information about which hardware and software components it is running. People, computers or any other device can request that information and, reading it, decide whether it’s safe or admissible to interact with the TC device. The software officially provided with a TC system, for example, may refuse to run if it detects that other software without the TC label is installed.

The trick is that, so far, it has been given for granted that this ability must be under the explicit and exclusive control of the platform’s maker, not the person who eventually purchases it. A TC-locked DVD player may refuse to give you some information even if you legally paid for it. Practically speaking, this means that that a TC player may tell you “I will not play this DVD that you legally bought. Not because I can’t, but because the movie company doesn’t like the software that you have installed on your computer”. Similarly, the website of your bank may refuse to let you in from any “platform” that they do not trust.

Internet Access Providers (IAP) may use the same technology to forbid you to connect to the Internet (or be legally forced to do so) unless you do it with a TC-compliant computer: in other words, unless you install all and only the software on your computer that they (or the government) want.

The basic idea behind TC isn’t necessarily bad: would you keep using ATM machines if they were proved to be as unsecure as today’s computers? If you must use a computer to pay some bill online or perform some other equally sensitive operation, maybe from somebody else’s computer, you should be able to know for sure that all the involved computer are in a state that protects your privacy, money and reserved data. Current computers do lack this capability. Therefore, a really effective TC wouldn’t be so bad if end users maintained the capacity to themselves declare which software is acceptable on their machines. In such a scenario, inexperienced users may still sign some service agreement with their IAP to lease or purchase TC machines, while others may self-certify their systems (under their responsibility, of course).

What matters is that everybody, not just big corporations, maintains the possibility of designing or using any kind of software he or she considers best for his or her (obviously legal) needs. This is also a matter of security. If it’s necessary to move to Trusted Computing, it is also essential that it works on as many different and independent software and hardware combinations, because this minimizes the risk that one defect in one of them causes serious problems, for example, to all the customers of all the world’s banks at the same time.

As far as trust goes, it should go both ways, shouldn’t it? When Trusted computing is concerned, this means that you should be really, really picky about which government or private authority is allowed to decide what you can or cannot do at home with the stuff you buy.

The problem is that, with all the TC designs proposed so far, definition and detection of “safe environment” rests entirely with the original owners of the hardware, software or information you need to use. If those “owners” are partners of movie companies which don’t want people to make a backup copy of their regularly purchased movies, so they can sell them more than one time, what is the end result? Nothing more than believing to have bought a (pretty expensive) computer which can also manage movies, but actually getting a mutilated VCR, even if it’s a really cool-looking one.

(this chapter continues here)