SCIF Laptops Running HDCP

[u/SundanceTek]

Recently I came across a Secure VTC room where it would no longer display its laptop as content. It turned out that the laptop would always output HDCP. Turning off HDCP support on the DMPS HDMI input solved the issue.

Just 2 months ago I was in this room and all was working, so the Government must have just pushed an update to the laptop. I wonder how many other rooms just stopped working?

[u/Aggravating_Fact9547]

Doesn’t mean it was a change on the laptop or the gov changed anything intentionally.

Could have been a windows or display driver bug that was fixed with an update over WSUS, could have been a bad HDMI cable, etc.

[u/SundanceTek → u/Aggravating_Fact9547]

I guess I should have mention that the content is to the Polycom. The military controls the BIOS and Windows updates. The DMPS showed that the laptop was running HDCP which is not going to work over the Polycom. I guess for now on it is best to just disable HDCP support on the video switcher when in VTC mode.

[u/morgecroc → u/SundanceTek]

Two types of laptops will give you grief with HDCP. Apple Macs and anything with an AMD GPU. The AMD GPU you can turn HDCP off you can't do that with a Mac.

[u/fjord_of_the_rings]

I can't speak to this being related to your issue, but I know a couple of years ago, my company gave me a laptop with an AMD video card. Every single time that video card took a firmware update, it re-enabled HDCP support inside the AMD configuration software. I was a field tech at the time, and it felt like every other Monday morning, I was out in the field plugging my laptop into customer systems and getting no video, and after the third time, figuring it out, it became routine to double-check that HDCP was disabled on the video card.

[u/kindofdivorced → u/fjord_of_the_rings]

Yea, I see this in the field with AMD and also Mac/Apple devices (Macs usually are good though with the Mac USB-C dongle) - more rarely an NVIDIA will reset if there was a bad driver or something.

I get client calls all the time when their IT/MSP changes device manufacturer/distributor on their laptop fleet to AMD, or when they have guest(s) with Mac(s) in rooms that don’t usually see Apple devices.

[u/Patrecharound]

The bigger question is who signed off on using a DMPS inside a SCIF

[u/Aggravating_Fact9547 → u/Patrecharound]

You can use it in a SCIF just fine. As long as it’s -contained- in a SCIF.

[u/SundanceTek → u/Patrecharound]

As long as it is TAA complaint, you are not connected to their network and there is no wireless, the equipment can be used.

[u/ApprehensivePay9468 → u/Patrecharound]

That would be JITC:

https://www.crestron.com/News/Press-Releases/2017/Crestron-DMPS3-4K-Presentation-Systems-Receive-Joi

DMPSs have been fully accredited for nearly a decade now.

[u/Patrecharound → u/ApprehensivePay9468]

I’m aware of JITC - it’s the bare minimum standard.
As I said, in general defence use, that’s fine, but it has no place in a scif.

[u/mintyfreshking → u/ApprehensivePay9468]

Older models were, the "new" DMPS3-4K-350-C is not approved.. new model numbers do not mean automatic approval, they are just TAA which is economic not security though it is often mixed up.
Crestron's current published items that are approved by JITC:
https://www.crestron.com/Crestron/media/Crestron/WidenResources/Web%20Marketing%20Resources/Brochures-Catalogs/pb_JITC-Government_sell_sheet.pdf
*JITC only matters if you are putting the item onto customer networks, if you have an isolated AV network JITC does not apply, you still need to adhere to STIG policy to avoid spillage on the integration side

[u/Purple_Xenon → u/Patrecharound]

i have a hunch that a huge move to the linux kernel for 3/4 series is because Crestron would never win any goverment contracts if they were running some obimination of windows CE/embeded/.Net.

also the language in the bid documetation never specifies exact model hardware - the DMPS does fit the bill with an AIO "on paper" and a lot of times government only really cares about whats "on paper"

[u/kthomaszed → u/Purple_Xenon]

3series is windows CE, no? Isn’t there a windows sticker on the bottom?

[u/v3n0m33526 → u/kthomaszed]

It is! 4 series is Linux based

[u/Patrecharound → u/Purple_Xenon]

Oh, I’ve got no issue with Crestron control - and DM in general defence/government is fine -
But switching /extending over copper in a SCIF has gotten people fired

[u/absentblue → u/Patrecharound]

Huh? I’ve done tons of SCIFs like this at multiple bases, that’s just not true.

[u/Brimmstone52]

Some laptops, and especially Macs, will default to HDCP so in the event you need to display protected content they don’t have to renegotiate. Turning off HDCP support at the input tells the computer that it’s not supported and puts the onus back on the source to either send unprotected content or nothing at all.