Philips pushes lightbulb firmware update that locks out third-party technology

Does Philips claim their product complies with the standard? Does their lockout violate the standard? Can the ZigBee Alliance (of whom Philips is a member) demand that Philips remove branding claiming compliance if the answers to the first two questions is yes? If they can so demand, can they take legal action (false advertising) if Philips refuses?

4 Likes

I guess anything other than copy-pasting the text of the law can be considered “interpreting”, but there’s really not much wiggle room. The anti-circumvention provision of the DMCA states that "No person shall circumvent a technological measure that effectively controls access to a work protected under this title" … “to circumvent a technological measure” means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner" (that’s a copy-paste).

To be clear, I am not defending the law. It’s a terrible law, and I’m guilty of breaking it myself.

2 Likes

If it can be broken, it does not effectively control the access anymore.

2 Likes

I wondered who was going to hire the Keurig CEO…

4 Likes

I used to think that I was an ignorant old fart for stocking up on incandescent bulbs.

Well, maybe I am an i.o.f., but after reading this thread I’m pretty sure that it was not for that reason.

2 Likes

I’m as happy to be indignant about DRM as the next guy, but there’s a little more going on here.

The ZLL standard defines behavior of the devices (bulbs, switches, etc). Philips bulbs are certified for the standard and haven’t changed. The standard expects hubs may have unique features or not interoperate; that’s why hubs don’t certify for the standard in the same way.

The GE and Cree bulbs are both known to have link issues and stop talking to hubs of all brands. Because they adhere to the standards but are unreliable, people have been complaining to hub makers and calling about hub issues for what are other vendor’s device issues. In that case, is it surprising Philips would set their hub not to talk to those devices?

You can still pick a hub that is more open and use it with all your Zigbee devices (GE, Cree, Philips, & more). SmartThings seems to do a good job, straddling the line between consumer-friendly and developer-friendly. My non-geek wife can use it, but there’s a growing community using APIs to publish scripts to link devices not included by default.

There’s a good discussion about Philips’ decision, device issues that led to this, and what it means for the industry direction at the SmartThings forums.

8 Likes

So, how many software engineers does it take to change a light bulb, Answer, none its a Hardwar…oh wait !

4 Likes

Laws require interpretation, both by vendors, users, and courts. There is indeed wiggle-room here (phwoar!). Firstly, “No person shall circumvent a technological measure that effectively controls access” is practically a deliberate contradiction in terms. If you were able to circumvent it, then it did not effectively control access. What they might have meant was something like “technological measures intended to control access”… but that’s not what they said. The “work protected under this title” is not the bulb itself, but the microcontroller firmware code. So the law as is prohibits one from reverse-engineering and patching Philip’s own firmware, but not from replacing it with other code you like better. There could be ways for them to lock users into using only their firmware, such as hardware checksums, but most manufacturers don’t bother going that far. If the device is not running their code, it is not eligible for copyright protection.

The grey area then becomes the question of: “How did somebody somehow make inter-operable firmware?”

2 Likes

“Open the pod bay doors, Hue.”

3 Likes

You can tie yourself in knots trying to misread the text and and narrowly define individual words, but the law really is quite straightforward in what it says.

I guess you’re just ignoring the part that says “avoid, bypass, remove, deactivate, or impair”.

If an object contains software that restricts or controls the operation of the object, you may not "avoid, bypass, remove, deactivate, or impair " that software. It says what it says, and it says it very clearly.

1 Like

Someone needs to point Phillips toward what’s happened to Keurig…

2 Likes

Most statements can be interpreted in dozens of ways, it’s not as if I need to look for ambiguity.

Now who’s singling out words?

For firmware, this is a tautology. All firmware “controls the operation of the object”, there is no meaningful distinction between this and the licensing of any other code. Philips themselves made the firmware updateable, presumably on-purpose. It’s like the difference between buying a computer and running a cracking program to get the login password, versus wiping the whole thing and doing a fresh install. The former might technically be unlawful, but the latter is not, because not using their OS at all does not bypass restrictions in their copyrighted code, it avoids using their code altogether, so its license and copyright cease to apply.

The difficulty is in the details. If the hardware is proprietary, they assume there isn’t anything else which will run on it off the shelf, without the end-user having their proprietary information.

I find it both verbally and technically ambiguous, but I am well aware that there are those who feel an incentive to interpret it as having specific meanings.

Agreed. I love the legal and policy challenges and the public education campaigns. Tor and CC are fantastic. But what about the practical side?

Couldn’t FOSS coders organize a wiki or other resource to teach the less, er, tech literate to directly use FOSS code and networking tools for all of their social justice work?

1 Like

That’s the impression I get… After going to the store and looking at this stuff for a year or two now, waiting for one brand or another to rise to the top but seeing none, AND after reading case after case of this stuff simply not working I can’t say I’m surprised that Philips wants to control access of their system so that it can be more reliable.

If I go into Lowe’s or Home Depot wanting to spend bucks on a “smart lighting” or “home automation” system, and one of them says “Our stuff works 99% of the time, as long as you use devices from this list” That’s the one I’m going for. All the other standards or protocols or hub systems out there are vague at best about which products they’ll work with, and even the ones they specify fart out all the time.

1 Like

You’re literally using the same words as the law. The law specifically says you may not avoid the software, and you’re arguing that actually it’s totally fine to avoid the software. There really are none so blind as those who will not see.

Another positive was that unlike the harsh 5000K+ fixtures they’re being replaced by, they don’t destroy your night vision. It doesn’t help that the fixture designs more often than not throw light all over the place sideways instead of mostly downwards. I’m sure the people living on the third floor of the nearby buildings appreciate the blinding glare in their bedrooms.

(And streetlight color rendering should really be a non-issue; you’re walking or driving around, not doing food photography.)

2 Likes

“It wasn’t breaking and entering, the door was wide open — after I kicked it in.”

1 Like

Then the headline must be wrong, because it says that the firmware can be updated. Any update to the firmware is merely replacing one set of restrictions or controls with another. If you install v0.4.12, then you are “avoiding” v0.4.11, 0.4.10, 0.4.9, etc. What does the DMCA say about rolling back firmware? If I buy the unit with 0.4.10 and it works in my setup, and then it’s borked when I try 0.4.12, hadn’t we already established that I had a legal right to use 0.4.10?

How about when I pointed out that firmware which controls a device has no meaningful distinction from any firmware, generally?

No, I am arguing that the law is, as I said, both verbally and technically ambiguous. There are certain conditions for the use/avoidance of the software, and those conditions could be more explicit. I don’t doubt that many judges might prefer a restrictive interpretation of the law as written. But the vagueness is a two-edged sword - making it easier to judge uses as infringement, but also making it nearly impossible to clarify what uses would not be infringement.

Like the example I gave of installing a new OS on your computer. You old OS has access control restrictions, so isn’t wiping it a circumvention of those? The DMCA could be invoked with regards to updating any firmware, on anything. But it isn’t, so one might assume that there are instances of fair use recognized. Because the DMCA does not stipulate that one needs to run a specific firmware version on their devices. But if you install one, you are subject to its laws and copyright.

I have given you some examples to illustrate how I perceive the issue, and asked you questions about related scenarios. Pasting the text of the law and calling me “blind” does not strike me as being very persuasive.

There are several layers of people.

One is the bottom-of-the-barrel kind that when asked to switch off a computer switches off the monitor (actually happened to a techsupport friend a few days ago). We can write off those for now, maybe write a few best practices that they won’t read and follow anyway.

Then there are levels of increasing knowledge. These can be helped with using simple rules at first (so they at least won’t screw up too much when choosing stuff so their techsupport friends/family members won’t have that bad job, and more complete advises for the more knowledgeable ones.

Once we hit the level of coders, it gets more interesting. Here we need repositories of code and tools, discussions and experience sharing.

And it gets even more interesting at the top level, where third-party firmware gets analyzed and bugs like DRM patched away. More interesting tools are there, and possibly a need for strong pseudonymity and protection of the contributors from the corporations, while providing a way to profit from their work.

And at the most interesting level we reach the realm of chip decapping and microprobing and imaging, and reclaimed or even homemade machinery to do so, and lowering the barrier of entry to this area so more people can have fun on this particular sandbox…

As an engineer, I think both statements are true.

I think it is perfectly fine to kick in a door in my own house.
Edit: Even if the municipial code says otherwise.

1 Like

This parallel isn’t just a theoretical one, it has important legal ramifications. Under Section 1201 of the DMCA […] it’s a felony to remove a digital lock like this one, even for a legitimate purpose.

I believe you are misreading the law. DMCA section 2012(f) explicitly allows reverse engineering of software for the purpose of achieving interoperability, and there’s case law to support the view that this exception would apply in a case like this. While that doesn’t prohibit Philips from including this restriction, bypassing the restriction is likely to be considered fair use under US law.

2 Likes