Digital Noise: Music and Tech

If you've followed the RIAA's antipiracy efforts, perhaps you've wondered how they find suspected pirates. Yesterday, the The Chronicle for Higher Education published an article in which an RIAA spokesperson--anonymous for fear of hate mail--outlined the organization's surprisingly low-tech methods.

Do you use LimeWire? So does the RIAA.

The RIAA hires an organization called MediaSentry, which has developed an automated program that scans LimeWire for song titles that match titles of copyrighted material in an RIAA database, collects the IP addresses of the computers where these songs have been made available, then reports this information back to the RIAA. The article doesn't reveal how the RIAA picks among these IP addresses to decide where to focus but I'm guessing that volume of pirated material plays a large part.

If the RIAA sees a lot of piracy happening on a university's network, it might issue a takedown letter to the university asking it to remove copyrighted songs. In this case, MediaSentry will gather more specific information about the songs being offered, including checking them against a digital fingerprint to make sure they actually represent a real copyrighted song, or having real people listen to them if the digital fingerprints don't quite match. There's more detail in the piece.

Notably, the RIAA only checks to see which songs are being offered. It doesn't check--and it appears like it has no way to check--if anybody's downloading them. This is why the RIAA has to argue that making a file available is copyright infringement. And the so-called "making available" argument is very much in a legal gray area--some judges have allowed it to stand, but an Apr. 29 judgment in Atlantic v. Howell rejected that argument.

If "making available" is rejected once and for all, the RIAA will have to come up with some new methods to prove users are actually downloading pirated files. I'm not sure how they can do that, short of subpoenaing ISPs (an expensive legal tussle) or putting tracking software on users' PCs (a public relations nightmare waiting to happen).

You know those movies where you think they've killed the last zombie and then the hero turns a corner and here comes a whole new crop of them sprung fresh from the graveyard? That's how it feels with DRM in the last couple of days. First, the New York Times' Bits blog leads with a questionable assertion from an NBC exec that Microsoft is considering building some sort of content-filtering into the Zune which would block transfer of non-approved video. (I know, this isn't quite the same as DRM, but bear with me.) Then RIAA exec David Hughes claims that new forms of music distribution will create a comeback for good ol' DRM.

Want...technical...solution...to...piracy...NOW!

(Credit: Joel Friesen via Wikimedia Commons)

Let's start with Hughes first. He says he made a list of 22 ways to sell music, and that 20 of them required DRM. OK, but are those 20 plans wishful thinking or actual business models with demonstrated success or at least a fighting chance? I mean, I could sell my last band's CD at $100 a pop and quickly cover my recording costs, but nobody would buy it. Subscription services haven't taken the world by storm, and I can't imagine consumers buying lots of play-per-view songs or ad-supported songs either. Why not?

Let's go over it one more time.

1. Horse, meet barn door. Free unrestricted downloads are already broadly and easily available. Any time you ask a consumer to buy something, you have to give them more than what they can already get for free--more convenience, more quality, something. iTunes is more convenient than file-sharing networks for what people generally want--to get a particular song or album to play on their iPod. The software comes with the player, the store's built into the player. Boom. That's why iTunes succeeded where other download stores...not so much. Subscription services are convenient only for that subset of music fans who like to listen to lots of different songs a few times, but don't care about long-term ownership (or don't mind paying in perpetuity). Pay-per-play? Advertisements? Those sound even less convenient--enough less-convenient for users to skip them or, if they really want the song, taking the trouble of learning how to use LimeWire.

2. The thieves have the key. Good old-fashioned DRM has a fundamental technical flaw. With computer security systems, data's encrypted with some sort of key. Unless you have the key, you can't access the data. This is all well and good when you're trying to protect the data against a "man in the middle" to whom you'll never give the key. But DRM tries to protect the data against the very people who need to access it. You have to give end-users the key to decrypt the data--the song or movie or TV show--that they have paid for, otherwise you have no business. And if you have to give them that key, somebody's going to figure out how to duplicate it. The race gets more complicated with hardware-based encryption and revocable keys, but the fundamental problem is the same: security by obscurity can't work forever.

The EFF's Cory Doctorow spoke to Microsoft Research about this four years ago (a transcript is here). That gets me to my second point. Microsoft is well aware of this fundamental security problem thanks to its years of trying to combat software piracy. While the company continues to add technical hurdles against piracy, like product activation, it knows that these are just stumbling blocks. The real progress comes when you convince the national government of a country where piracy is rampant that cracking down on it is in their interest--usually because they've got a fledgling software industry they're trying to support. In talks with analysts, Microsoft has mentioned South Korea and Taiwan as countries where this precise chain of events happened, and I think its investments in China are partly geared toward the same end.

So before building a "copy cop" into the Zune, Microsoft would have to consider the following factors. First, how many potential buyers would they lose? (In this case, many.) Second, is the content they're getting worth alienating that number of users? (In this case, I don't think so.) Finally, what's the ongoing cost of patching the technology whenever the scheme is broken? (Higher than you might think--ask the team that used to work on Windows Media DRM.)

That's why, when Microsoft says it's not planning to build new anti-piracy technology into the Zune, I believe it. More generally, Microsoft's whole digital media business has been moving away from this kind of content protection at a pretty rapid pace--there's not even a Windows Media product group any more, much less a DRM team in that product group, and the Zune Marketplace is adding DRM-less MP3s as fast as the content owners are making them available. Sure, Zune has to offer DRM on a subscription service, and Microsoft doesn't seem to be ready to give up on suscriptions because it's white space where the iPod isn't playing. But overall, I think Microsoft is much more sober and rational about content copy-protection than it was about even two or three years ago. (Here's hoping they prove me right.)

And before the angry commenters on my last DRM post get into it again, let me state really clearly that I believe musicians and all their designated agents--managers, producers, manufacturers, distributors, band psychiatrists--have a right to make a living. But DRM's the wrong way to go about it, for the reasons I listed before--it asks consumers to pay more for less, and it doesn't work.

A recent NPD survey cited by the New York Times' Bits blog confirms what I've suspected for a long time: the record industry's campaign against file-sharing sites is not only ineffective, but misguided. According to the survey, 19 percent of the music in consumers' collections comes from file-sharing networks. That's up 5 percent from last year--in other words, lawsuits and education campaigns have so far been ineffective.

But 38 percent of music listeners' collections come from CDs that they borrowed, then ripped to their hard drive or burned to a CD-R. (I'm not sure why NPD made the distinction between ripped and burned. I suppose it's academically interesting--ripped CDs are presumably listened to on MP3 players or computers, while burned CDs can be listened to in CD players.) In other words, file-sharing networks aren't the primary cause of declining CD sales--copied CDs are. That behavior's impossible to stamp out, and adding copy-protection software to CDs is not a viable solution--it's either ineffective or exercises too much control over the user's computer, leading to potential PR nightmares and even legal liability.

85% of the music on my Zune was recorded from a CD or LP that I legitimately own. Most of the rest comes from CDs I borrowed and ripped.

Just to satisfy my own curiosity, I took a quick look through my Zune 30, which is my primary personal MP3 player (the iPod has more family stuff on it), and catalogued my own digital music collection by origin. Here's how it stacked up:
• 2,714 songs (85 percent) from a CD or LP purchased by me or given to me as a gift.
• 439 songs (14 percent) acquired from somebody else without payment--a CD I borrowed and ripped, or that was burned for me by a friend, or given to me as digital files on a flash drive.
• 47 songs (1 percent) downloaded from an approved Internet source, such as the Zune Marketplace.
• 10 songs (<1 percent) downloaded for free from non-industry-approved Internet sources.

Obviously, I'm not a normal music consumer. I'm almost 40 years old, so much of my collection stems from the pre-Internet days, when the only real way to get music was to buy it. The question is, how does the industry make the average user look more like me? I don't know the answer, although lowering prices on CDs or promoting vinyl (which is harder to rip) with codes for one-time digital downloads might help. One area where I don't look like the ideal consumer is with digital downloads: I'm at far less than the average 10 percent. I might buy more music online if (a.) it were in a format that could be used on both my iPod and my Zune (b.) online catalogs were deeper, with more obscurities, no black-outs for long songs, and so on.

On Sunday, the Washington Post published a story which suggested the RIAA is expanding its copyright-infringement lawsuits against end-users to encompass files ripped from an audio CD to a user's hard drive. In other words, most of the files on the 100+million iPods sold, not to mention the countless files on computer hard drives and other devices. A lot of readers took the story at face value, and expressed dismay that the RIAA would target such copying for personal use. Isn't that fair use?

Turns out that the story's wrong: as the Patry Copyright Blog (and others) point out, if you read the full legal brief, you'll see that the RIAA's objecting to two things in combination: the fact that the user converted the CD audio to MP3 files, AND the fact that the user put these files in a folder to make them available to a file-trading service. So this actually appears to be the "making available" argument, which the RIAA used successfully in the only file-trading case it's won against an individual (so far).

But even if the story were correct, why is everybody so quick to assume that making a copy of an audio CD onto a hard drive is fair use? The doctrine of fair use is far from clear-cut. For example, there's been enough case law on parody that it's generally deemed to be covered by fair use. But the issue of making personal backups of digital data is still the subject of significant debate. And the recording industry has been fairly consistent in arguing that ripping MP3s is making an unauthorized copy.

The point: just because something's technically easy, widely accepted, and seems "right," that doesn't mean it's legal. That said, I believe the RIAA's tactic of suing customers is heavy-handed and will do more harm than good to the long-term health of the recording industry.

For more about fair use, Stanford University has an excellent overview.

The recording industry has won its first victory against a user of a file-sharing network. Late yesterday, a jury in Minnesota determined that Jammie Thomas had in fact used Kazaa to share music files. Finding her guilty of "willful" copyright infringement, he jury ordered her to pay the copyright owners (six labels) $9,250 for each of the 24 songs that were at issue, for a total of $220,000.

Reading the coverage of the closing arguments on Ars Technica and Wired, I can see why the jury reached its decision. Somebody using the screen name "Tereastarr" posted certain music files to Kazaa. Thomas uses that screen name in many different places, including e-mail and her PC log-on. The same songs were found on her hard drive. Her PC is password-protected, so it's hard to argue that somebody else snuck on and did the dastardly deeds. Some of the alternate theories from the defense sound like they're ripped from the headlines of every scary security story you've read in the last five years. (Her computer was pwned by zombies!)

Even so--and I'm not a lawyer by any stretch of the imagination--a lot of the evidence seems indirect. That is, despite all the fingers pointing in her direction, I don't think it's possible to prove beyond a shadow of a doubt that the individual Jammie Thomas uploaded these songs to Kazaa. I'm not sure if there's enough for an appeal, but jury verdicts are notorious for being overturned. (Old adage: if you're innocent, ask for a judge; if you're guilty, ask for a jury trial.) Also, the judge found that the RIAA didn't have to prove that anybody actually downloaded the songs that Thomas posted, only that she posted them in an attempt to violate copyright. According to the site The Recording Industry vs. the People, which is run by a pair of lawyers who've represented some plaintiffs against the RIAA, the decision establishing that precedent was actually vacated the week before the trial.

If the RIAA pursues--and wins--other trials, it could cut down on illegal file-trading. But I tend to think that file-trading software or networks will continue to evolve to make it harder to track who's doing what. I imagine there could be a way of masking IP or MAC addresses, or a way to encrypt the sharing folders on the user's PC so that they're invisible to everybody but the user (who'd need a password even to see them).

Not that it's any justification for copyright violation, but I can see why Ms. Thomas didn't want to pay for the tracks at issue. Richard Marx? Vanessa Williams? Then again, maybe I'm just pretentious and out of touch.

I'm about three months late, but I finally got around to reading Andrew Keen's The Cult of the Amateur, in which he blames the current crop of Internet sites and users for eliminating the concept of expert knowledge, destroying the concept of intellectual property, and breaking down hundreds of years of Western culture. He even trots out the old "save the children" argument that we've been hearing since 1995--pornography, predators, and pedophiles, oh my! (People always seem to miss that fourth "p"--parental oversight.)

Keen has some valid points, unfortunately they're buried in a lazy book full of lazy arguments--Lawrence Lessig eviscerates it far more efficiently than I could hope to. But the part that particularly got to me was Keen's insistence that piracy is solely responsible for the woes faced by the music industry.

Here's the nut of his argument: "According to a joint 2006 report by the European (IFPI) and American (RIAA) researchers, forty songs are actually downloaded for every legal music download. That adds up to 20 billion songs illegally downloaded in 2005....At the iTunes price of 99 cents a song, the 20 billion songs stolen in a single year adds up to an annual bill of $19.99 billion, one and a half times more than the entire $12.27 billion revenue of the U.S. sound recording industry in 2005. That's $19.99 billion stolen annually from artists, labels, distributors, and record stores."

Ignoring Lessig's rebuttal that even the RIAA doesn't count the retail sales value when calculating the loss from piracy, there's another problem here. Keen assumes that all of those downloads represent a lost sale, as if downloads are replacing CD purchases. But I'd argue that they're not--downloads are replacing the process of music discovery that used to be filled by radio and, for a little while, MTV. But over the last ten years, as the radio industry has consolidated, playlists have become much more predictable and less varied, even from city to city, and the barely-disguised payola that dominated the late 1990s and early part of this decade made things worse. (This was well-documented by Salon's Eric Boehlert and eventually led New York's then-Attorney General Eliot Spitzer to file a series of lawsuits against record companies and radio conglomerates.) And MTV hasn't been about music for a long, long time.

So how do music fans find out about new acts? Same as ever, from their friends. And here's where technology comes into play. Before the Internet, my musical friends would come over with a bunch of LPs or CDs to play. I might like one or two of them, which I'd then buy. Now, they can just send me an e-mail with a link. That may get me a 30-second sample, but if I want to hear the whole song, several times, at my leisure, on any device I own, there's only one easy way to do it--download unprotected MP3s.

I have no doubt that some conversion from sample to buy is lost thanks to this technological change: my friends might lend me the CD for a day or week or month, but they wouldn't let me keep it, which means if I really loved it I'd have to buy it. Not so with a download. Still, to assume that every single download represents a lost purchase is plainly ridiculous.

At the end of the book, Keen offers some reasonable ideas to help the record industry cope with the digital world, including giving up on DRM (which doesn't work and drives users to file-trading networks) and lowering prices, in hopes that consumers will finally turn to legal downloads in place of illegal ones. Good points, but I still think the celestial jukebox has the best chance of revitalizing the industry.

Last Friday, a judge found that making music available through a file-trading network does constitute copyright infringement, even if that music is ripped from a CD that you bought. (Here's a link to the PDF of the summary judgment.)

According to the Web site Recording Industry vs. The People, which is run by two lawyers representing some defendants in infringment cases brought by the RIAA, this is the second time a judge has made this point, although last time it was included only as a footnote.

Without this legal precedent, the RIAA would have a very hard time suing file-traders. Now, this finding was part of a summary judgment, so it doesn't necessarily count as precedent, but the RIAA has used it to bolster its argument in two other cases. If judges in those cases rule similarly, then the precedent could be established.

Lime Wire is best known as the latest in a long chain of software that makes it easy to find and download music for free, replacing Napster, Grokster, eDonkey, Kazaa, and all the other applications and networks that shut down or cracked down on the sharing of copyrighted material.

Lime Wire LLP, the company that makes the Lime Wire software application, has also been sued by the Recording Industry Association of America (RIAA), but has so far refused to cave, saying that it only manufactures the software and has no control over how users choose to employ it. Moreover, it filed a countersuit in September 2006 on antitrust grounds, calling the RIAA an illegal cartel that conspires to destroy any distribution channel that the recording industry doesn't control.

(Credit: Lime Wire)

A couple of days ago, the company announced that it would begin to offer approved downloads for sale from directly within the Lime Wire application. Unsurprisingly given their ongoing legal dispute with the RIAA, Lime Wire's distribution partners, IRIS and Nettwerk, represent small independent labels and artists rather than the majors. The files will be MP3s, and unprotected by DRM, meaning users won't ever face the problem that former Google Video downloaders now face. (DRM-protected files + cancelled service = the content you paid for can no longer be played.)

So does this mean that LimeWire is eventually going to follow Napster's path of trying to negotiate and build an industry-approved service? I would guess not--we all know how well that worked out for Napster. (The new Napster is merely the name, which Roxio bought for $5 million; Roxio changed its name to Napster when it sold off its other software busineses.) In fact, in a recent interview, anonymous LimeWire staffers told Slyck News that the company is improving its existing Lime Wire application, adding a technology that improves the ability to search for files on Gnutella (the P2P network on which LimeWire operates) and is adding support for the BitTorrent protocol, which supports swapping of much larger files (like video). For the time being, the business model will remain the same: offer a free version of the LimeWire application and hope to upsell consumers to a version with more features.

Still, this could be the beginning of an exit strategy in case the courts force Lime Wire to stop distributing its software in its current form.

In 2004, the Recording Industry Association of America (RIAA) filed suit against Deborah Foster, an Oklahoma resident, alleging that her computer and her ISP account had been used to download and trade copyrighted recordings illegally. As usual in these suits, the RIAA offered to settle the case for a few thousand dollars.

Except that Deborah Foster knew she hadn't done anything wrong, and refused to pay up. After some initial discovery, the RIAA began to suspect that Deborah's adult daughter, Amanda, was responsible for the alleged downloads, and it added Amanda's name to the suit. But Deborah continued to press the RIAA, asking them to provide details of what was downloaded when. Seeing that this wouldn't be an easy case, the RIAA dropped the suit.

Deborah then sued the RIAA for attorneys' fees and won. After about a year of back and forth over the precise amount, today the judge ordered the RIAA to pay her $68,685.23. (A PDF of the order is available here.)

This judgment changes the calculations involved in the RIAA's strategy of suing alleged file-traders. It doesn't cost much to send an accusatory letter demanding a few thousand dollars. But if the defendant actually puts up a fight, the legal costs for the RIAA quickly mount. In that situation, the RIAA has to believe that it has enough evidence to win, and that the defendant will be able to pay a fine that's large enough to cover the RIAA's costs.

All this means the RIAA has to be extra careful about who it sues--as this case demonstrated, it may not be enough to trace file-trading back to a particular IP address, and work with (or sue) the ISP to figure out who's paying for Internet access at that adress. And taking extra care might raise the RIAA's initial costs enough to make this whole strategy too expensive to continue with.

That would actually be a good thing for the recording industry: the strategy of suing file-traders is error-prone, ineffective, and has created a blizzard of bad p.r. A better option would be to create and promote legal alternatives that still compensate copyright owners, such as ad-funded music-sharing services. Another possibility would be to press legislation forcing ISPs, PC hardware makers, and/or music software makers to chip a few cents per sale into a kitty to compensate content owners for the loss of revenue from file-sharing--something that's already done with the sale of certain blank media in the U.S. and elsewhere.