J. Garden, Review of Microsoft Information Rights Management v1.0, A Report for the E-government Unit of the State Services Commission, 87 pp., December 2003.  Available http://www.e.govt.nz/policy/trust-security/irm-200202/irm-report.pdf, July 2006.

Executive Summary.

This report discusses the set of technologies known as Microsoft Information Rights Management (IRM), an application of Microsoft’s Rights Management Services concepts, products and protocols. IRM is information protection technology that allows documents to be shared and sent in e-mail messages while maintaining control over who can view or edit the document. Once a document or e-mail message is protected with this technology, the access and usage restrictions are enforced no matter where the information goes, even if the file is sent outside the network or saved to CD or floppy disk.

The project involved installing and using the MS IRM v1.0 server and client technologies in a small test network of four computers. A series of example transactions were carried out between three users in order to better understand what IRM users would see and well as to document the underlying architecture and processes.

The project indicated that Information Rights Management is a new and interesting technology that breaks away from the traditional storage-location based access control solutions. There are many possibilities with it that could allow much greater sharing of sensitive or valuable information resources with a much wider audience. It appears to be Microsoft’s first step into a largely untapped market, that of providing the technology for consumers to process commercial content such as movies, music and electronic books.

However, the findings of the project also reinforce the E-Government’s warning that the limitations and risks of using the technology need to be carefully considered before it is adopted into mainstream use in Government. The current implementation is still unproven and may have significant flaws or vulnerabilities; the IRM technology solution highly integrates the adopting organisation into the Microsoft technology and operational frameworks; and it appears to be generally limited to sharing documents within the content-producer’s organisation.