The Comcast DTA Dance

The Bauminator recently reported on Comcast Corp. (Nasdaq: CMCSA, CMCSK)'s plans to deploy digital terminal adapters (DTAs) without video content protection, though the devices include the option of turning on a “lite” content protection system from Motorola Inc. (NYSE: MOT) later. (See Comcast's DTAs: Security Optional .)

As noted:

According to people familiar with the project, the Broadcom Corp. chipsets that will grace these DTAs will be capable of activating content protection via a firmware download. Those chips, at least for this phase of the project, are being hardwired or "burned in" with Motorola Inc.’s "privacy mode." -- a content protection system that's already used with video-on-demand fare.

While Motorola’s “privacy mode” is used to protect individual VOD streams, it is not in the same league as full conditional access (CA) systems (including Motorola’s MediaCipher) that are aimed at securing paid digital video content that is broadcast continually. In other words, if a hacker succeeds in cracking the protection for a VOD stream, they get one movie. If they crack the CA protecting a cable operator’s entire digital programming lineup, they get free access to everything else.

So, Comcast is going to use [ed. note: well, the operator said it has the option to use] VOD-class protection for broadcast digital content? One can’t help but wonder: What on earth are they thinking?

The stated logic behind the decision is that by installing DTAs without CA, Comcast can avoid the Federal Communications Commission (FCC) 's draconian separable set-top security rules. (See Countdown to 'Seven-Oh-Seven'.) Then, if and when a new FCC commissioner arrives with a new White House administration in 2009, Comcast can take a shot at getting a waiver that will allow the company to turn on Motorola’s minimalist protection software.

So, while Comcast waits and hopes for change at the FCC, it will only be able to send digital video signals to DTAs “in the clear.” That would mean the MSO could use DTAs only for the reception of programming that is currently sent in the clear -- retransmitted broadcast TV and a handful of limited basic cable networks, like C-SPAN and QVC. Even if Comcast gets a waiver to turn on “privacy mode,” it is unlikely that basic cable networks with valuable content -- like CNN, Discovery, Fox Sports, or MTV -- would trust the technology to protect their digital assets, let alone premium channels like HBO or Showtime.

Geeks familiar with the situation say that Moto’s “privacy mode” is a public encryption solution based on ANSI/SCTE 52 and only uses single-DES encryption. Even Docsis cable modems employ triple-DES to ensure data transmission privacy.

Furthermore, Comcast’s DTAs can activate “privacy mode” by downloading the firmware onto common flash memory and executing it on a shared CPU. This is a far cry from the dedicated security processor architecture MSOs are demanding for the full-blown downloadable CA solution they are seeking with PolyCipher LLC . (See Cisco, Moto Take Control of DCAS .) The bottom line: No serious digital cable or satellite pay TV provider has ever deployed such a flimsy CA solution for paid video programming.

Clearly, a key driver for Comcast’s DTA decision is saving a couple bucks per box. In the end, though, it may prove to be pennywise and pound foolish. It is not unforeseeable that at some point in the future, customers enjoying a very limited “all-digital” service from Comcast with a DTA might like to add a few more channels to their subscriptions. Without strong CA in the device, the only option will be for Comcast to roll a truck to replace that DTA with a more sophisticated digital set-top box.

While a headache and expense for Comcast, this would be Motorola’s dream come true. Indeed, a nightmare scenario for Motorola would be for $30 DTAs to prove wildly successful, cutting down shipments for more expensive digital set-tops, and putting pricing pressure on the entire set-top category as DTAs set a new baseline cost expectation. While supporting Comcast’s DTA plans, Motorola probably would prefer for DTAs to be DOA.

Employing a DTA design that offers the option of supporting a more robust CA solution seems a no-brainer for Comcast. Alternately, DTAs with an empty card slot could even be used. In either case, FCC separability requirements would be met, albeit with a minor hardware cost penalty, and Comcast would have a more flexible, extensible device.

Perhaps most importantly, Comcast would also avoid jeopardizing its track record of content protection leadership with programmers. The company’s reputation as the operator of the largest secure delivery network for broadcast digital video is itself an extremely valuable asset to be protected.

— Michael Harris, Chief Analyst, Cable Digital News