Designing devices to be remotely overridden is a bad idea

Bruce Schneier's new Wired column discusses the growing trend to designing devices so that other people can shut them down against your will — the movie theater can mute your phone, OnStar can shut down your engine, new technology deployed to stop the movie-plot threat of bus-hijackers ramming them into buildings can be used to shut down bus-engines.

Bottom line: a device designed to be controlled and shut down against its owner's wishes is inherently less secure than a device that is designed to only do the stuff its owner asks of it. This is like the hoary cliche of the accidentally pressed self-destruct button on the spaceship in bad sf movies: wouldn't the spaceship be inherently safer if none of its intentional design outcomes included sudden, catastrophic explosion?

It's comparatively easy to make this work in closed specialized systems — OnStar, airplane avionics, military hardware — but much more difficult in open-ended systems. If you think Microsoft's vision could possibly be securely designed, all you have to do is look at the dismal effectiveness of the various copy-protection and digital-rights-management systems we've seen over the years. That's a similar capabilities-enforcement mechanism, albeit simpler than these more general systems.

And that's the key to understanding this system. Don't be fooled by the scare stories of wireless devices on airplanes and in hospitals, or visions of a world where no one is yammering loudly on their cellphones in posh restaurants. This is really about media companies wanting to exert their control further over your electronics. They not only want to prevent you from surreptitiously recording movies and concerts, they want your new television to enforce good "manners" on your computer, and not allow it to record any programs. They want your iPod to politely refuse to copy music a computer other than your own. They want to enforce their legislated definition of manners: to control what you do and when you do it, and to charge you repeatedly for the privilege whenever possible.

Link