Is DRM effective?

Question

Reddit is all abuzz about DRM, piracy and all related topics. I don't really know much about the details in the technology here, but people were throwing around statements like these (all pulled from the same thread):

DRM would only affect pirates if everyone had to crack their game, but no, anyone can easily play these games because someone has already cracked the DRM, so it's no use at all, NO pirates have to deal with it.

---

My problem with DRM is that I don't see any evidence that it actually does anything to prevent piracy. [...] DRM only seems to end up inconveniencing legitimate paying customers. In some cases it's bad enough that after purchasing a game I will just go ahead and illegally download it because in doing so I'm getting a superior version.

And other similar comments can be quickly found. The basic gist seems to be that DRM is so easily bypassed by pirates that it may as well not be there. So, assuming that the purpose of DRM is to prevent pirating a game, does it work?

Answer 1

Short answer: No.

Long answer: You need to look at the definition of "effective".

Does it accomplish the purpose of preventing people from pirating the game it protects? Sometimes. And even then, usually only briefly. As a case study, let's look at Assassin's Creed 2 by Ubisoft. According to press releases at the time they had instituted a radical new DRM method that required the player to be constantly connected to the internet to make sure their account was and remained verified, and losing connection to the authentication servers for more than thirty seconds dropped you out of the game.

Ubisoft hailed it as the ultimate anti-piracy solution and smugly dismissed everyone who complained about how it's ridiculous for a single-player game to require an internet connection or how it massively inconvenienced anyone with a spotty connection as 'whining would-be pirates'.

There was a (mostly) working crack almost before the game was good and well released, and a fully functioning one within a month. The crack was thorough enough that Ubisoft's next game using the same DRM was fully cracked within days.

Total "effectiveness" of this DRM scheme: One month of possibly limited piracy.

Negative consequences: Severely inconvenienced paying customers who needed permanent internet connections just to be able to play a single-player game; massive inconvenience when the release day instant load took the authentication servers down (Ubisoft swears up and down that it was a DDoS by said whining pirates, disregarding the fact that said pirates were the only ones at that point that could play the game); enraging a nontrivial chunk of their former customer base who have subsequently declined to buy any new Ubisoft games and instead take their money to companies that don't accuse them all of thievery.

Was this "effective"? Not unless the intended purpose was to lose business.

Don't get me wrong. I understand the publishers' dilemma -- they really would like to get paid for the games they design, create and/or publish. And I have no objection to paying them, and if they want some kind of reassurance that the people who play their games did pay for them, that's entirely reasonable. And I like digital distribution -- it means not having to spend time traveling to town and searching five different game stores only to discover that the game is completely sold out -- and I understand that said digital distribution means that asking for a word in the manual doesn't really work anymore. And far too many pirates try to justify themselves with this kind of circular logic.

On the other hand, "reasonable" efforts to check whether a game hasn't been pirated do not, in my opinion, extend to the electronic equivalent of a body cavity search every time you make a purchase at the supermarket - another notorious example is the StarForce "Copy Protection Scheme" that amounted to the equivalent of a rootkit.

(You may note that the various mouthpieces defending StarForce also all insist that everyone complaining about it are 'obviously from international piracy groups' that really are only fearmongering because of the way the awesome system completely thwarts them. It's a recurring refrain)

And the above doesn't cover the long-term problem of what happens when, say, your old install CD gets too scratchy for the CD check DRM to recognize it (happened to me with three separate games; I wound up downloading a crack for one of them, purchasing the second via Steam when it was on sale and getting the third when it appeared on GOG.com. Funny anecdote, but the game I'd downloaded the crack for always had some kind of issue with the in-game cutscenes not playing, which was cleared up by the crack as well. Score one for the pirates.) XKCD pointed out that basic problem very succinctly, and it doesn't apply to just games.

Of course, there are DRM solutions that are more acceptable -- stepping away from the purity pedestal insisting that no DRM is ever "acceptable" -- such as Steam, which not only checks just once during install, and lets you play entirely offline if that's what you want, but also serves big heaps of added value such as automatic updating, keeping track of what you bought so you can reinstall it at any time, an easy to access storefront, regular sales and a social network to sweeten the pot.

Given the way Gabe Newell is rolling in cash at the moment, you'd almost have to suspect that maybe the whole "let's not treat our customers like criminal scum" approach has something going for it. Incidentally, he had a few things to say about DRM as well.

Additionally, many "indie games" don't bother with DRM at all, or at most use a serial key -- the additional cost to develop or license a DRM solution would eat unacceptably into their profits. Again, given the popularity of a lot of these, the lack of DRM doesn't seem to have hurt their business model much.

So to summarize: In my opinion - and that of several fairly big names in the game industry as well - overly restrictive DRM does far more harm than good, especially when customers realize that they can either pay money for the game and suffer the DRM's inconveniences, or download the pirated version, play the game for free and have a better gaming experience because the DRM isn't getting on their nerves.

On the other hand, nonrestrictive DRM that adds significant value to the playing experience makes for repeat customers.

Answer 2

Short answer: We do not know for sure, but it is likely for most products some DRM is better than none.

Long answer: There were no controlled experiments done which would reliably answer this. The experiments which were done (like DRM-free product sales of old games) are not representative enough, as the product sold is different from a typical new game and even the target audience is likely to be different. There are few things to consider.

What is DRM

Anything which tries to prevent obtaining unauthorized copies of a digital product is a DRM. It may be something very simple (like a serial number) or complicated (like StarForce or SecuROM copy protection schemes).

No protection - plenty of copying

When price is high and there is nothing preventing copying, it is very likely there will be many people copying the product. The exact number varies with platform, genre and location. It is estimated around 70 % of the users for most new PC games did not buy the game (see e.g. Why Aren’t Console Piracy Rates Higher?). What is not established (and it is hard to establish) is how many of those people would buy the product if copying would not be possible.

Still I think we can formulate a following assumption: (i) by making DRM more efficient in preventing copying there will be more people who will buy the game instead of copying it.

Too much protection - reduced sales

When DRM is perceived to be too restrictive (like it was in case of EA Spore, or many StarForce protected games), it harms sales. Note: in the end it does not matter if the DRM is really restrictive or not, it is enough it is percieved as such and receives a bad publicity.

This leads to another assumption: (ii) by making DRM too restrictive there will be less people bying the game, as more of them will decide to copy it instead, or not to have it at all.

Thought experiment - finding optimum DRM

There are plenty of DRM forms, with varying efficiency and varying adverse effects for legitimate users. Generally the more successful is DRM to prevent copying, the more it is restrictive as well. If there would be a DRM which would reliably prevent making illegal copies but would present no restrictions to a legitimate user, it is likely to be very effective in increasing sales (even this is not 100 % sure, as sometimes illegal copies may actually increase sales by serving as a means to try before you buy). However let us assume now that as DRM increases efficiency, it also increases adverse effects (and often also cost of implementing DRM increases). If publisher is interesting in maximizing his profits, he needs to find optimum of the function:

• + profits gained by people buying instead of copying (assumption (i))
• - profits lost by people not buying (assumption (ii))
• - cost of implementing and applying the DRM

I think it is obvious that in most cases the optimum point will lie somewhere in the middle. It is hard to establish where exactly the optimum is, but it is very unusual that it would be no DRM at all.

Summary

Some DRM causes increased profits, but as DRM becomes perceived as too much restrictive, it lessens the profits. The exact optimum varies with product and platform.

Note: I am aware assumption (i) is central and critical assumption. I doubt there are any controlled experiments done in this area, but I think it is quite safe to assume the people behavior is similar for digital products as for real products. A simple analogy: almost no store assumes people will pay "just because they want", but there is usually some kind of "anti-stealing measures", like having the cashier near the store exit, so that customers have to go around it. Such measures are not too restrictive (no shop owner is searching each customer for stolen items) and exact optimum depends on how much goods cost and how easy it is to steal them. I have yet to see a self-service jewelry store, but such arrangement is common for groceries.