Summary

The browser got a common door

By 2017, encrypted movies already played through several browser arrangements. W3C wanted the browser, rather than an external plugin, to manage the conversation between a web page and a content-decryption system. Its 6 July backgrounder made that institutional case: move the interaction inside the browser's security and privacy controls while keeping protected video available on the web.

The finished Encrypted Media Extensions specification gave a page methods to discover a key system, request access, create sessions and exchange messages needed to play encrypted media. Its own abstract drew a bright line. The document supplied a common API; it did not define a complete content-protection system. Only Clear Key was required as a shared baseline. Other key systems and the content-decryption modules behind them could differ.

That division was the design and the fight. A browser could implement the API, and a site could call it, while actual access to a protected film still depended on a supported key system, a CDM and a license exchange. The interface made one part interoperable. The system behind the interface retained separate owners and rules.

Seven objections reached the Director

W3C's 6 July 2017 disposition grouped the objections into seven areas: user protection, free-software support, undefined CDMs, anti-circumvention law, accessibility adaptation, new entrants and archiving. The Director decided to publish the revised specification as a Recommendation. Some objections produced clarifications. Others were overruled.

On CDMs, the disposition said the working group had tried to devise a common interface between implementations. It put that work outside the first version's scope and overruled its absence as a reason to stop publication. On the legal covenant, W3C said it had sought member consensus on a nonaggression proposal and failed. It recommended that implementers refrain from using anti-circumvention law against security and privacy research. A recommendation to individual organizations did not create the binding covenant the objectors sought.

The disposition also acknowledged a practical limit. With closed CDM implementations, the specification could set expectations for user protection but could not technically enforce complete protection. W3C still judged the browser-mediated system an improvement over plugin arrangements. The same document contained both the institutional bet and the part that standards prose could not operate by itself.

The appeal counted the authority

EFF's 12 July appeal notice challenged the decision process. It argued that the membership had never been asked to decide on a covenant protecting security research and other work affected by DRM law. EFF claimed that without such protection, promised privacy, accessibility and market-entry benefits could be undermined. Those are the appellant's arguments, recorded in its own message, not findings about every CDM or browser.

The organization then put the Director's decision to its members. W3C's 18 September announcement reported 108 members supporting the advance, 57 opposing it and 20 abstaining. W3C published EME as a Recommendation that day. Its announcement stressed that browser implementation was voluntary and that EME was not required for HTML compliance. The vote nevertheless settled what W3C would endorse as a web standard.

The room behind the door stayed uneven. W3C standardized the route from page to decryption system, required a Clear Key baseline and set rules around the interface. It did not standardize every CDM, grant everyone access to every protected video or adopt the requested legal covenant. The 2017 decision shows a standards body making a real choice about its boundary: enough common machinery to bring encrypted video into the browser, with the hardest ownership and research questions left to the organizations that built and licensed the machinery.