Why DRM alone can't stop piracy

DRM can't stop piracy on its own because it protects a video only on its way to the screen. Once a lecture is playing, it can be filmed with a second phone, recorded on devices where protected playback is weak, or watched through a shared login, and DRM sees none of it. It is a lock on delivery, not a leak-prevention system.

This article walks through the routes DRM leaves open, why each one works, and what to ask before you trust any platform's claim that its videos "can't be pirated".

What DRM protects, and where it stops

Follow a lecture from your servers to a student:

server → CDN → student's device → decryption → screen and speakers → the student's eyes and ears

DRM guards the steps up to the screen. The video is encrypted in storage and in transit, keys reach only approved devices, and on the best devices even the decrypted pictures travel through a protected path. The last step can't be protected. Light from the screen and sound from the speakers have to reach a person, and anything a person can see and hear, a camera and microphone can record. Security engineers call this the analogue hole.

Think about how exam papers are handled. Question papers travel in sealed packets, are kept in strongrooms and move through a documented chain of custody. That's DRM. But once the packet is opened in the exam hall, the seal can't stop a candidate memorising or copying the questions. Video works the same way: the seal matters, but most leaks happen after it has been opened.

Leak route 1: a phone camera pointed at the screen

The simplest piracy tool is a second phone on a stand, recording a laptop or TV while the lecture plays. The copy is poorer than the original, but for a lecture that hardly matters. Someone watching a leaked polity or economy class needs a readable board and a clear voice, not a perfect picture, and any mid-range phone delivers both.

No DRM system can see a separate camera, because the camera never touches the device that is playing the video. Our guide to camcording with a phone camera looks at this route in detail.

Leak route 2: screen recording where protection is weaker

On phones with hardware-backed DRM, screenshots and screen recordings of protected video usually come out black. That's a real strength, but it doesn't hold everywhere:

• Desktop browsers often use software-only DRM, where the protected display path isn't available, so a recorder can capture what's on screen.
  
  
• Mirroring and capture hardware. Screen mirroring, virtual displays and devices that capture a video output can get round protections. HDCP, the protection on HDMI connections, has well-known weaknesses; our explainer on HDCP and screen mirroring covers why.
  
  
• Platforms without real DRM. Many course platforms use only encrypted streaming, not full DRM, so any screen recorder captures everything.
  
  

Operating systems help only a little. Android lets an app keep its own screens out of screenshots and recordings, and iPhone apps can find out that the screen is being recorded but can't block it. None of these signals notices a second phone, and they only help if the app uses them.

Leak route 3: a shared or sold login

DRM answers one question: does this account hold a valid licence? It never asks whether the person watching is the person who paid. If a student shares a login with five friends, or sells it in a Telegram group, every one of them gets a perfectly valid licence, and the video plays exactly as it would for the student.

OTP logins don't settle it either. A code can be forwarded in seconds, and a student can simply sign friends in on their own phones. Why the usual fixes fall short is covered in our guide to students sharing accounts.

Leak route 4: weak security levels and compromised devices

Not all DRM is equally strong. Hardware-backed levels keep keys and decrypted video inside a protected area of the chip. Software-only levels, used by most desktop browsers, rely on hiding keys in obfuscated code on the ordinary processor, which is much easier to attack.

That weakness is not theoretical. In January 2019, a security researcher publicly showed that Widevine's software-only level, known as L3, could be broken. The hardware-backed level, L1, wasn't affected, and many streaming services already allowed only lower-resolution playback on L3. When the keys for a stream are recovered, a clean digital copy can be made without any loss of quality, which is why film studios insist on hardware-backed protection for their best streams. Our comparison of Widevine L1 and L3 explains the levels.

Compromised devices widen the gap. A rooted or jailbroken phone, an emulator or a modified copy of an app removes protections the operating system normally enforces, and some rooted phones fall back to software-only DRM. More often still, the weakness lies in the platform around the DRM: a direct video link left in an old API, a download URL that never expires, or an old app version that plays unprotected files. One open path undoes the protection on all the others.

The law is clear on this route. Under section 65A of India's Copyright Act, 1957, circumventing an effective technological measure with the intention of infringing copyright is an offence punishable with up to two years' imprisonment and a fine.

Leak route 5: everything that isn't video

PDFs, class notes, current affairs compilations, test series and answer keys often leak faster than video, because they're small and easy to forward. Video DRM does nothing for them, and a photo of a printed or on-screen page is always possible. Our guide to protecting PDF notes from copying covers why this route is so hard to close.

Leak route 6: people with legitimate access

Faculty, video editors, back-office staff and freelancers often handle the original recordings before any protection is applied. So do former staff whose access was never removed. Raw files that never pass through a protected player are outside DRM entirely, and an insider leak can be the cleanest copy of all.

Leak routes at a glance

What actually helps

Because so many leaks happen after decryption, what matters most is being able to find the source of a leak and make leaking a personal risk. A visible watermark with the viewer's name or phone number survives a camera recording, because it is part of the picture, and few students want their own number circulating on Telegram. But a visible mark can be cropped, blurred or covered, as our guide to dynamic watermarking explains.

Invisible watermarks can also be added to videos. They are extremely hard for anyone to remove, even after heavy re-encoding, compression or screen recording, so a leaked copy can still be traced back to the account it came from. Add screen- and camera-recording detection, controls on account sharing, protection for PDFs and the apps themselves, and someone whose job is to search for leaks and report Telegram channels, and the routes above become much harder to use.

No system stops every leak. The realistic goal is to make leaking difficult, risky and traceable, while making the paid experience better than any pirated copy. Deterrence works best when people know about it, so tell students at enrolment that every video and PDF is tied to their account, and that shared accounts will be blocked. Then enforce it consistently.

Key takeaways

• DRM protects video up to the screen. It can't protect what is seen and heard, a gap known as the analogue hole.
  
  
• Camera recording, shared logins, PDFs and insiders all fall outside DRM's reach.
  
  
• Screen recording is blocked only on hardware-backed setups; desktop browsers and software-only levels are weaker, and Widevine's software level was publicly broken in 2019.
  
  
• One unprotected link or old app version can undo every other protection.
  
  
• The question to ask of any platform isn't "do you use DRM?" but "what happens after decryption, and can you trace a leak to its source?"
  
  

VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. It also brings VidSafe proprietary encryption, screen- and camera-recording detection, account-sharing prevention, PDF watermarking and RASP.

Related reading: how DRM gets cracked.

Frequently asked questions

Why do lectures still leak from platforms that use DRM?

Because so many leaks happen after the video has been decrypted for a legitimate viewer. A second phone can film the screen, a desktop browser with software-only DRM may allow recording, a shared login gets a valid licence, and PDFs and raw recordings sit outside DRM altogether. DRM protects files and delivery well, but it was never designed to control what happens in front of the screen.

What is the analogue hole?

The analogue hole is the gap at the end of every protection chain. A video has to become light and sound for a person to watch it, and anything a person can see or hear can be recorded by a camera and microphone. No encryption or DRM can close it, which is why traceability and deterrence matter so much for paid lectures.

Can DRM stop screen recording?

Partly. On many phones with hardware-backed DRM, recordings of protected video come out black. On desktop browsers that use software-only DRM, through screen mirroring and with capture hardware, recordings often still work. And no form of DRM can stop a second phone filming the screen, because that camera never touches the device playing the video.

Is breaking DRM illegal in India?

Circumventing an effective technological measure, such as DRM or encryption, with the intention of infringing copyright is an offence under section 65A of the Copyright Act, 1957, punishable with up to two years' imprisonment and a fine. Sharing or selling the copies infringes copyright under section 51, and knowingly doing so is an offence under section 63. This is general information, not legal advice.