Do you trust your computer?

Computer consultant Bill Thompson wonders whether Microsoft plans to make your computer more secure are the way forward.

I don't trust my computer.

I think this is reasonable. Every day it lets nasty viruses and unwanted e-mails into my life.

It will run any program it is given, even ones that will trash my hard disk or reveal my personal secrets. And it often refuses to do what I want or simply stops working.

The price may be that these same companies get a lot more control over how we actually use them

Not one of the one billion computers that have been made can be trusted, because the way they are designed means that the central processor will carry out whatever instructions it is given, with no way of telling whether they are legitimate or not.

The result is our current security nightmare, with security holes announced every week and "patches" - program updates - needed almost every day.

This may be about to change. In the next couple of years, thanks to work by companies like Intel and Microsoft, we could have computers we can really trust.

But the price may be that these same companies get a lot more control over how we actually use them.

Click here to tell us what you think Bill should write about

We have to decide now, before it is too late, what choices we are going to make. And many of the decisions will be political, not technological.

A question of trust

It all started two years ago when chip manufacturer Intel, along with IBM, Microsoft and others, formed the Trusted Computing Platform Alliance (TCPA) to think up a way of building secure computers.

How much do you trust your computer?

Their standard was published last year, based around a special piece of hardware which could guarantee security. This would initially be a separate chip but could later form part of the processor itself.

The security chip acts as a supervisor for the computer. When you turn on a secure PC, the security chip looks to see what programs are being loaded, and will only let you run stuff that has been approved.

The approval process would work by giving each program a special "digital fingerprint" and checking to see whether the fingerprint matched the one stored by the chip.

The system is obviously designed for computers that are connected to the internet, and so would rely on having an online database of fingerprints which the security chip could access.

So when a new program was released - say a new web browser - it would be checked and certified and its fingerprint would be added to the database.

Going public

Until recently the TCPA was working away in the background. But last week, Microsoft revealed details about a new project it is working on dubbed Palladium, named after the Greek goddess Pallas Athena, a symbol of protection.

Palladium seems, from the limited technical details available, to be Microsoft's way of making a trusted version of Windows, using the TCPA specification and special hardware from Intel and AMD, another major chip manufacturer.

It would use an authorisation process developed, managed and controlled by Microsoft - the implications of which worry a lot of people.

This is not just about users trusting their PCs not to run viruses. It is also about copyright owners not trusting the users.

Putting these concerns aside, the idea of a secure computer is appealing.

With something like Palladium the problem of spam goes away. All I need is an e-mail program that only accepts properly signed messages and rejects everything else.

Then my friends and colleagues can reach me, and legitimate business can send me marketing information, but the fraudsters and get-rich-quick merchants cannot get through.

It also removes the need for virus protection. If a virus changes a program to add its own functions then that will break the digital seal, and my trusted PC will not run it.

However, this is not just about users trusting their PCs not to run viruses. It is also about copyright owners not trusting the users and trying to build controls into the computers themselves.

Digital rights

A trusted PC would not make a copy of a DVD or an audio file. It would report any copyright violations back to the rights holder.

It would rigorously enforce licensing conditions, even if those conditions take away fair use rights which copyright law would grant.

System could stop CD-copying

This is called digital rights management, and it applies to films, music and, of course, to software.

As a writer I rely on copyright law to ensure that my publishers pay me for my work. I do not give my writing away, because I need to eat.

But I am concerned that technical means of enforcing copyright are extending the law on the quiet, taking away rights that I value as a consumer - the right to quote other people's words, or to make copies for personal use.

Computer spy?

I am also concerned about having a company in control of the system which determines what files and programs can run on my computer.

Suppose Microsoft decide that someone else's e-mail program is too similar to Outlook and sues them. What is to stop them disabling that program on every trusted PC during the court case?

Suppose that WorldCom's financial records found their way on to the net and the company got an injunction preventing further publication? What is to stop Microsoft disabling the ability to read this document on a trusted PC?

There are many more issues raised by this technology. However, despite the issues and the frightening predictions of friends and colleagues in the technical press, I have a confession to make.

I think Microsoft is doing the right thing, and I think Palladium, or something like it, is what we need if we are going to make the most of the internet and the wired society. We need to trust our computers, and this is a way to achieve this.

The key thing is not the technology but how it is regulated, licensed and controlled.

I do not want to see Microsoft or any other company decide how trusted PCs work. That is the proper task of democratically-elected governments.

With trusted computers we have reached the point where digital technology needs to be regulated, just as governments decided last century that car use needed to be controlled.

Many will see this as a bad thing. I don't agree. I think it is a sign of how far the network has come.

Click here to return

Is there a technology issue that gets you going? Tell us what you would like Bill to write about in his regular column.

Bill picks up one some critical points. One that leaving security in the hands of one private company cannot be the way forward. The other is that DRM infringes your fair use rights that are upheld in the copyright laws. Media companies need to come up with a way of delivering their products in a digital format which still ensures the royalties get paid.
Sanjay Samani, UK

I'm writing this message on my computer. This phrase is pretty important, because it's MY machine that I do MY work in. It's MY workspace. It's MY tool, and MY property. As a consumer, I may make the choice between buying every piece of software Microsoft has to offer, or not having any contact with them at all. Palladium restricts this choice by threatening to fence off all non-Microsoft attached users from the rest of the world.
Dan Glegg, UK

A computer is, by definition, a user programmable device. Palladium will shut down the capability of a user to create his/her own programs. Everything "useful" which is claimed for Palladium can already be done - without breaking the computer as a general-purpose user-programmable device.
Brian Beesley, UK

It's a nice idea, and I agree if it were to be implemented then it should be run by the government, and independently regulated. But, we should have legislation now to enshrine the rights of the common man on the internet. Just because it is easier to transfer information on the internet it should not be restricted more. From an academic standing point I currently write short scripts and run them. I would dread to think how much it would cost if for every little program I write I have to get to get rights to a signature.
Richard, UK

You're assuming that Palladium/TCPA will be managed properly by the forces that brought them into play. Make no mistake, something as complex as Palladium/TCPA will need to be managed no matter how clever the underlying code might be. The government are incapable of such management, they've proven that on their own already so who else? The TCPA group itself? What about free software and refurbished PC's. A true and valid hope for those people struggling to improve their skills and knowledge in IT (both in this country and the more impoverished Third World countries). Suddenly they're faced with a "pay up or suffer" attitude. You think there's a digital divide now? Wait until Palladium kicks in. There'll only be the haves and the have-nots and never the twain shall meet.
Bruce Beardall, UK

There is no need to add a virus chip to computers. Change your application software to Linux and you will be spam and virus-free.
Peter, United Kingdom

The problem of security arises from the fact that Microsoft have a monopoly of the operating system market and the fact the average user does not know how a PC works. If the average PC user was capable enough then he/she could choose to use another operating system such as Linux which the user themselves could set up their personal security settings. I have a huge problem with a company like Microsoft telling me what software is legitimate to run on my pc or not.
Mark Lowman, England

What happens to people who develop and distribute their own programs? If I use one of Microsoft's own languages like Visual Basic to create a program which I distribute on the web then Palladium would prevent it running on any computer, even my own, as it wouldn't have certification. Or else certification would be available at a price, which would yet again favour large software developers over small ones. Would Palladium spell the end of shareware and freeware, or is this the objective in the first place?
Derek, UK

It is a fine line between trusting your PC and not becoming frustrated with your PC. Is this going to cost me more? Yes, neither Microsoft or any other PC is going to work on providing a system that does not cost the customer more. And is this going to frustrate me? Yes, this system will in some way require the user to agree to various computer systems being run on the PC whether as they come across them or setting up the system in the first place.
Annwyl, London, UK

I do trust my computer: it only does what it is told to do, and the only person who controls it is myself. I want to stay it that way and at any rate Bill Gates is the last person I would let decide what I can run on my computer.
Adalbert Jahnz, France

Advances in technology are not the only solution to unethical uses of computers. Spam, piracy and virus propagation (amongst other things) continue due to the greedy pricing of digital goods by copyright owners, shocking ignorance of personal computer security by a significant portion of the online community, and the anti-competitive practices of certain software and hardware manufacturers. The real solution will involve pricing digital goods more reasonably, guaranteeing consumer privacy and ensuring a level playing field for all manufacturers.
Nathan Jones, UK

As a computer scientist, I don't see how these proposals are actually going to work. Someone will eventually come up with a way of fooling the system into thinking it's receiving fingerprints from Microsoft. Secondly, I don't see how this is going to work politically. Thirdly, I - and millions like me - won't want this at all. We'll use Linux, we'll use other chip manufacturers, we'll choose - and if we can't choose, fight - to ensure that our computers are ours to use.
Tom, UK

This isn't so much a suggestion, merely I felt the desperate urge to say that this "trusted PC" rubbish is clearly meant for people who have no idea how to use a PC. I have had this email account with Yahoo for many years - about six to be exact, and despite using it for all official documentation, have never once received the kind of spam you refer to. Perhaps if you were more selective as to who you reveal your address to, you may not be as inundated as you imply.
James Rhodes, UK

The suggestion of better security in this case is propaganda. The facts of the matter are that moves such as Palladium, despite the cosy references to protection and security, are all about controlling what the user can do with their computer, even restricting activities that are legal but that some large corporations don't want to allow.
Peter Joanes, UK

The idea of this Big Brother chip is appalling! I would like to be able to use my computer fully without being scared that it may shop me in for looking at un-approved documents, or prevent me from using public domain software.
Ben Parry, UK

The trusted computing initiative is little more than an attempt by Microsoft to cement their monopoly before alternatives become too popular. My forcing users to only run code that has been signed as trustworthy by big business, nobody else can develop code. While this means little to the man in the street, it does mean that alternatives suddenly become impossible to use. Alternatives such as Linux, the various flavours of BSD, BeOS, and others effectively become illegal. One of the major strengths, if not the primary strength, of open source software is that it can be modified by the end user to make it fit the end user's needs more effectively. The approach outlined by Microsoft denies the user the ability to develop, experiment, and innovate.
Jim Howes, England

This is a very dangerous move. Effectively you will be handing over the rights to all your personal information to a foreign company with convictions for abusing its monopoly and infringing copyrights. It will also have the effect of strengthening Microsoft's monopoly on the desktop and crowding out other competitors such as Linux and Mac. And the benefits? Well the main one is that the music business can control what media we play on our machines. And there may be some security benefits such as stopping viruses. The solution? Vote with your wallet - boycott these products
Mike Newton, UK

This is crazy. There is already a perfectly good mechanism to stop your PC being harmed by viruses or being damaged through the use of malicious code. It's called a well written operating system. I use Linux on my PC and have never suffered from a virus and if I want to run code someone else has sent me I can run it under the auspices of a different user; one that has no permission to modify my files or the system files. Anything that a piece of hardware on your motherboard can do *could* be done by software via a secure 'micro kernel'. Yes, it would need to be well written and extremely carefully checked for pitfalls, but so does hardware. This myth that we must be protected by hardware is lunacy.
David Beaumont, England

Send us your comments:
Name:

Your E-mail Address:


Country:

Comments:

Disclaimer: The BBC will put up as many of your comments as possible but we cannot guarantee that all e-mails will be published. The BBC reserves the right to edit comments that are published.

---

The Bill Thompson column is courtesy of BBC WebWise, part of BBC Education's ongoing campaign to teach people about the internet and how to use it. Bill is a regular commentator on the BBC World Service programme Go Digital