Randy Picker has an interesting post on the Chicago Law Faculty blog, describing what he calls “mistrust-based DRM”. The idea is that when an online music store gives you a song, it embeds into the song a watermark that contains your credit card number, or some other information that would let a (dishonest) person spend your money. This gives you an incentive not to distribute the song.
This is an instructive idea, but not a practical one.
In analyzing this idea, it’s helpful to divide it into two pieces: (1) embed a watermark that identifies the user, and (2) make that watermark a secret of the user and readable by the anyone who gets the file. Piece (1), taken alone, is a widely discussed DRM strategy which has not been used much in practice, for reasons I plan to discuss tomorrow. Today, I want to focus on the second piece.
Specifically, I want to compare two systems. In the more traditional system, the watermark is secret – it can be read only by the copyright owner or its agents – and users fear being sued for infringement if their files end up on P2P. In Randy’s system, the watermark is public – anybody can read it – and users fear being victimized by fraud if their files end up on P2P. I’ll call these two alternatives “secret-watermark” and “public-watermark”.
How do they compare? For starters, a secret watermark is much harder for an adversary to find and remove. If a watermark is public, everybody knows exactly where in the music it is stored. Common sense, and experience too, says that if you know where in a file information is stored, you can modify that part of the file and obliterate the information. But if the watermark is secret, then an adversary isn’t told where to look for it or how to change the file to remove it. Robustness of the watermark is an important issue that has been the downfall of past watermark systems.
A bigger problem with the public-watermark design, I think, are the forces unleashed when your design principle is to enable fraud. For example, the system will lose its force if unrelated anti-fraud measures become more effective, or if the financial system acts to protect users from fraud. Today, a consumer’s liability for fraudulent credit card transactions is capped at $50, and credit card companies often forgive even that $50. (You could use some other account information instead of the credit card number, but similar issues would still apply.) Copyright owners would be the only online merchants who wanted a higher level of fraud on the Net.
Worse yet, even law-abiding consumers would face a higher risk of fraud, because any loss or theft of their music or movie files would expose their financial information. Spyware programs could collect this information from users’ computers – and studies show that at least half of end-user PCs are infected with spyware. Law-abiding users would have a strong incentive to scrub the information out of their files, even if they had no intention of infringing. Alert anti-virus or anti-spyware vendors would be eager to provide this service.
Given the disadvantages of a public-watermark scheme, what are the arguments for it? Randy Picker argues that it gives end users an incentive to distrust fly-by-night purveyors of ripping software, worrying that they might steal the user’s information from the files and commit fraud. This isn’t entirely convincing: some such tools already contain heinous spyware that could cause users lots of harm, and reputable security suppliers are likely to provide watermark-scrubbing tools anyway. I think the threat of secret watermarks hidden in files, which fly-by-night vendors have no incentive to remove, would probably scare users enough.
On the whole, then, I think a secret-watermark scheme is better than a public-watermark one. But it should be noted that secret-watermark schemes themselves aren’t looking too good. They have mostly failed in the market, for reasons I’ll start digging into tomorrow.
I like your stuff, even though i came here by accident!
I like the idea of embedding purchaser information into the file.
But nothing personally identifiable in the file itself. More like a hash key that can be linked to the original purchase transaction. If this file is found being distributed illegally the company who “licensed” the file to the user can report this breach of agreement to the original purchaser.
If you want to then “sell” or give the file to a friend, you upload it to the distribution site and identify the person that the rights should be granted to. The embedded hash data is overwritten with the new user’s information and the file can then be downloaded by the new user with correct license information in the file.
This allows the copyright holder to enforce the copy right and end users to do what they want with the music they have purchased.
This can all be done with a fairly simple web service. And with mp3, ogg, etc… you would never know the difference if a few “random” bits were used to hide this hash data.
Paul: Revocation only works when it’s done before the first illegitimate revelation.
I recall suggesting a similar scheme to you over dinner many months ago. I remember that you and I and Christian shot it down pretty quickly after some careful thought.
However my idea was halfway between public and secret. I recommended that company using the watermarking provide a website (or other mechanism) to which anyone can upload a watermarked file to have the contents of that watermark revealed. So anyone can find out what the watermark says, but only the company using the watermark need know how to find the mark.
This scheme gives the additional advantage of a “revocation” mechanism; if the company using the watermark decides that a particular user had his files leaked by some understandable mechanism (i.e. his laptop was stolen), then the company can decide not to make public the watermark information for that user’s files.
It’s still not very good, but I think it’s better than either the straight-up secret or public approaches.
There is software out there that already does this – for example Steve Gibson’s Spinrite software includes your credit card number in the downloaded executable.
Oops, put the subject in the “name” field. Sorry about that.
Google on the composite key…
“single use” “credit card”
See http://www.usatoday.com/tech/news/internetprivacy/2004-05-10-single-use-credit_x.htm for an article about “single-use” credit cards. Oops.
That’s assuming, of course, that the “purchaser” actually used their own card number, rather than a stolen credit card number. There’s probably a bunch of lawyers salivating at the thought of a contingency-fee lawsuit against a deep-pockets music company that distributes an innocent victim’s card number. Maybe even a few states’ Attorney Generals will join in the fun.
What were they smoking/drinking/injecting when they came up with that idea?
Great, now all the Internet Worms out there will have a chance to rape and pillage just by rifeling throught all your MP3’s and posting what it finds to the Internet just prior to it replicating to the next victoms machine. Oh, and just wait until the RIAA figure out they can earn money by paying hackers a bounty to write worms! Yea right, sounds like a good solution to me…..
Paul,
oops, I see that you said that the current systems aren’t really trustworthy.
My apologies.
Armagon
Paul,
my problem with “trusted computing” is not unlike my problem with “digital rights management.” It is that big companies can trust my computer — but I can’t; just as big companies “rights” are protected, while mine are ignored.
Oh, the joys of living in an age of double-speak.
This idea has been around since the 80s in one form or another, and is very attractive in theory because of the economics: every time you give away a copy of the DRM’d work, you are also giving away something of value to you (as opposed to the usual version where you lose nothing of value by giving a copy of the work away, and may even gain some kind of credit for doing so.) So in theory it reforms the incentives involved in file-sharing.
In practice, of course, it’s pretty much the worst of both worlds, because it doesn’t stop people from munging files to distribute unwatermarked versions, and it doesn’t protect legitimate users whose property is stolen.
What it does do for me is act as a reminder of how attractive a real trusted computing platform (as opposed to the untrusted-user platforms that have the name these days) would be. In such a utopia, it would be easy and common, say, for incoming files to be encrypted with a key belonging to the user, and outgoing files to be signed. And so on and so forth.
Your attacks on SunnComm and MediaMax have been in vain. Another deal signed with prestigious NY firm.
InMOD Solutions Announces Joint Venture With MediaMax Technology
http://biz.yahoo.com/iw/060223/0110817.html
DriveThruRPG uses watermarked PDF files for many downloads, which they can tie into a users account, and they note they can trace it back to you if it was found being distributed on a p2p service.
The best of all possible worlds would be one in which files came in packages that overtly included copy serial numbers, and details of the source copy, and identification details of the parties involved.
The problem we have today is the myth that only a tiny percentage of people engage in file-sharing, thus if they were identified these reprobates could be stamped out.
Let’s spill the can of worms out into the open and demonstrate that copyright law is an anachronism in the digital age.
The last thing the IP maximalism industry would want to see is evidence that 99% of people engaged in copyright infringement and found it wholesome and natural.
Thanks for the post (as always). I have had more thoughts since giving the talk on this idea Sunday and will post again this week but I am most eager to read your general thoughts on watermarking and will probably wait to read those before doing another post.
What if car companies tried to made it illegal to re-sell their cars? What if furniture companies made it illegal to re-sell their furniture?
Next thing you know the music companies are going to make selling music illegal by anyone but them. That would definately put a few artists out.
Daruku Says:
“Should everything we buy not be sellable ever again?”
Assuming that you are speaking of physical media holding content… it depends on whom you ask.
If you ask the media companies then the answer is “NO!”.
It’s kinda like asking hyenas if they really want more carrion… or if they’d rather go on a diet instead.
V makes a good point. Once we buy the music, don’t we own that copy? Watermarking the file, makes it so we can’t ever sell our wealth. Remember, wealth is not money. Should everything we buy not be sellable ever again?
Not to mention the fact that it’s common for people to sell their old tangible music. Look on Amazon for used CD’s, somehow I don’t think those people would be too happy to find their credit card stored in their music. (Yes, I assume that tangible and digital content are one and the same, and believe the ability should arrive soon if it hasn’t already.)
But then, the RIAA will probably try to stop that practice too in the near future.
See this followed by this for another similar story involving e-books.
The short of it: a company actually implemented this form of DRM, but then scaled it back from a fear-based system to a shame-based system at the urging of the EFF.
C. Scott Ananian hath writ:
“Of course, the legit purchaser of the clip may want to allow, say, his children to play his music without giving them access to his credit card number. But that sounds suspiciously like that “fair use†thing we keep hearing about — “
Hell no! The kids can have their own copies, each copy imprinted with the kid’s social security number!
Hmmm… do the media companies have deep enough pockets to buy National I.D. into existence? I mean, it’s overreaching, unsuitable to the desired purpose, easily abused, technologically complex yet bypassed with little effort by the actual perps… seems like it’d be a match made in heaven…
The problem is that you’d be able to figure out how the watermark works by disassembling the music player.
A more benign way of doing this would be to distribute a branded music player which displayed an “about this clip” info box (as Adobe Reader does for PDFs). Among the information displayed in the info box would be the full name and secret information of the purchaser of the clip.
Then the music company isn’t handing it over to the “bad guys” — the secret is just shown to the guy who provided it in the first place, right? But all the bad guys would know how to extract the secret.
Of course, the legit purchaser of the clip may want to allow, say, his children to play his music without giving them access to his credit card number. But that sounds suspiciously like that “fair use” thing we keep hearing about — honest people want no truck with that, surely.
@ MikeB
What you say is true, from a technology standpoint. In this case, though, I doubt that copyright owners would want to provide the site that actually handed over people’s credit card numbers to the bad guys.
“If a watermark is public, everybody knows exactly where in the music it is stored.”
I agree with your post. Just a nitpick about the particular remark quoted above, since I believe there are ways around it. For instance, the music vendor could set up an “oracle”, essentially a web site where one could upload a music file, and it would return the “secret” embedded within it, i.e. the owner’s credit card number. Since the oracle program is secret, in principle it would be hard to disassemble.
Of course this is not enough to make the scheme workable.