November 28, 2024

Recording Industry Publishing Infected P2P Files?

The recording industry may be publishing spyware-infested copies of their songs on P2P networks, according to a PC World story by Andrew Brandt and Eric Dahl.

The files are encoded in a Microsoft file format. When the user plays such a file, the user’s browser is forced to visit a URL contained in the file. For the files at issue here, the page at that URL uses various spyware-insertion tricks to try to infect the user’s machine with standard spyware programs. Ben Edelman reports that when he clicked on one such page, “My computer quickly became contaminated with the most spyware programs I have ever received in a single sitting, including at least the following 31 programs…” Ed Bott notes that fully patched systems won’t catch spyware from this file unless the user foolishly accepts downloads; but Ben Edelman argues that the files try to mislead the user into accepting the downloads, and in any case we know that users often are fooled by such tricks.

Even more interesting, PC World reports that, for at least one such file, the spyware-distribution page is hosted by Overpeer, a company that does lots of business with the recording industry. (It’s not clear whether the particular file Ben Edelman studied had any relation to Overpeer.) Overpeer, for example, is paid by the recording industry to spread spoofed files on P2P networks, in the hope that P2P users will download the fake files rather than real (infringing) ones.

The really interesting angle here, to me at least, is who approved the release of these spyware-bearing audio files onto P2P nets. It sure looks like Overpeer created the files. Did Overpeer release them? That would seem likely.

If Overpeer did release these copyrighted songs onto P2P nets, did they have the permission of the record companies that own the copyrights on the songs? If not, then Overpeer is a P2P infringer. It seems unlikely that Overpeer would take this risk, especially since the files contain a URL that points right back to Overpeer.

So it seems more likely that the record companies gave permission. If so, is it fair to say that these particular files, which contain copyrighted music, are circulating on P2P nets with the copyright owners’ permission? And what does this say about the record industry’s incessant argument that P2P nets distribute spyware?

All of this is speculation, of course. We don’t know for sure who did or didn’t participate in the files’ release. But it’s hard to see a scenario that makes both Overpeer and the record industry look good. There’s a nice investigative reporting opportunity here.

[Updated at 1:40 PM to clarify that the file tested by Ben Edelman might not be one of the files related to Overpeer. Thanks to Ben for his comment pointing this out.]

[Read the comments on this post – they’re particularly good.]

Clip Blog

I now have a clip blog, at http://www.freedom-to-tinker.com/clips. There I’ll post quick links to things that I find interesting, with little or no commentary.

Holiday Hiatus

I’m taking a holiday break from blogging. I’ll be back in early January.

When Is a "Network" Not a Network?

Last week, in response to the MPAA lawsuits against BitTorrent trackers, I wrote that it’s impossible to sue BitTorrent itself, because it is nothing but a communications protocol. Michael Madison was skeptical, which was a fair response given what little I had written on the subject. Let me say a bit more, to clarify.

Opponents of P2P technologies often make the rhetorical move of calling the thing they oppose a “network.” The word carries connotations – especially for nonexperts – of a physical contrivance that is operated by some organization. Think of the old phone system, or the electrical power grid. Somebody has to build and manage all that equipment. The implication is that there is somebody in charge who can supervise the use of the network. Read the plaintiffs’ briefs in the Grokster case and you’ll see many references to a “network” that is “operated” by the defendants.

Computer scientists sometimes use the word “network” to refer to something more virtual. Others are now using “network” in this sense, as when people talk about the social network of friendships among the residents of a small town. Nobody owns and operates the social network. There is nobody you can sue to shut it down, because it’s not a network in the same sense the power grid is.

A communications protocol is an agreement or convention about how computer systems can cooperate to accomplish some task. It isn’t owned or operated by anybody. (People might own copyrights or patents relating to a protocol, but let’s set aside that possibility for now.) There’s a sense in which English or any other human language is a kind of protocol that people use to cooperate with each other. Again: nobody owns, operates or controls the English language, and there is nobody you can sue to shut it down. This isn’t to say that you can’t punish misuses of English, such as fraud or criminal conspiracies that use the language; but punishing misuse is not the same as attacking the language itself.

Given a lawsuit about a particular technology, how can we tell whether that network is more like the power grid or more like a social network? Here I think the Grokster courts have gotten it right. Rather than arguing over what is a “network,” or what “network” means anyway, they looked at the nature of the technology and the defendant’s control or influence over it. That is, as lawyers say, a fact-intensive inquiry.

The MPAA, in suing the operators of BitTorrent trackers rather than trying to attack the BitTorrent protocol itself, seems to be recognizing this distinction. That in itself good news.

P2P in 15 Lines of Code

TinyP2P is a functional peer-to-peer file sharing application, written in fifteen lines of code, in the Python programming language. I wrote TinyP2P to illustrate the difficulty of regulating peer-to-peer applications. Peer-to-peer apps can be very simple, and any moderately skilled programmer can write one, so attempts to ban their creation would be fruitless.

For more information about TinyP2P, see http://www.freedom-to-tinker.com/tinyp2p.html.