Who is responsible to fix leaking device implementations?
Each CMLA licensee has the ability to respond to allegations of non-compliant implementations which they have brought to market. CMLA’s role in this correction process is to help expedite these corrections or to take other remedial action as permitted under the CMLA License Agreements. •  Explain the CMLA device revocation procedure. The CMLA revocation process is defined in the Agreements (Section 9). The revocation process is initiated when/if the revocation criteria have been met and CMLA is made aware of the problem. At a high level, the revocation criteria require that a private key (device or rights issuer) has been disclosed in a manner not permitted under the CMLA License Agreement. A licensee is notified that one or more of its CMLA implementations has been compromised such that a private key has been disclosed and either (i) the licensee agrees to revoke the private key; or (ii) the licensee can dispute the allegations in which case the matter is referred to expedited arb
