A method of authorising conditional access to an encrypted digital data product, includes storing at least one set of entitlements in a secure device, each entitlement including a product identifier and expiry information, receiving entitlement control messages from a decoder system including a device for decrypting encrypted digital data products using control words, each entitlement control message including a product identifier, and in a first mode, returning at least one control word in response to an entitlement control message including a product identifier if the product identifier corresponds to a product identifier in a stored entitlement including expiry information indicating the entitlement to be valid, and, in a second mode, progressively adjusting a counter to a pre-determined value and returning at least one control word in response also to entitlement control messages including a product identifier if the product identifier corresponds to a product identifier in a stored entitlement including expiry information indicating expiry of the entitlement and if the counter is at a value between an initial value and the pre-determined value. The counter is set to an initial value to commence operation in the second mode upon receiving an entitlement control message including a product identifier corresponding to a product identifier in a stored entitlement that includes expiry information indicating expiry of the entitlement.