November 27, 2024

Improving the PIRATE Act

Senators Orrin Hatch and Patrick Leahy have introduced a new bill, the PIRATE Act, that would authorize the U.S. government to bring civil lawsuits against copyright infringers, and would create a $2 million fund to pay for such suits. (Copyfight has the details.) Rather than doing this, it would be more efficient simply to give copyright owners the $2 million in cash, and let them decide whom to sue, or not to file suits at all.

If spending $2 million on lawsuits will deter enough infringement to increase (the present value of) future copyright revenues by more than $2 million, then copyright owners will find it in their interest to file the suits themselves. If not, then the government has no business filing the suits, since doing so would burn $2 million of government money to create a benefit of less than $2 million. So let’s save ourselves the trouble, and just give the cash to the RIAA and MPAA.

Criminal enforcement by the government might make sense, since private parties can’t bring criminal actions. But civil suits brought by the government, on the same terms those suits could be brought by copyright owners, can only be inefficient.

Worst of all, asking the Department of Justice to spend its valuable time and attention on small-fry copyright suits carries a high opportunity cost. The DoJ has much more important things to do. Copyright infringement is bad, but it’s hardly the greatest threat we face.

Witty Worm Analysis

Peter Harsha at CRA points to an interesting analysis, by Colleen Shannon and David Moore of CAIDA, of the recent Witty worm.

Light Weight

Derek Slater discusses Fraunhofer’s new Light Weight DRM system. Derek is skeptical but states his opinion cautiously, not being a technologist. In any case, Derek gets it right.

It’s hard to see much that’s new in this proposal. If we ignore the newly coined LWDRM buzzword and the accompanying marketing spin, we’re left with a fairly standard looking DRM scheme, of the type I call mark-and-trace.

Mark-and-trace DRM schemes try to put a unique, indelible mark on each legitimate copy of a work, so that any infringing copies found later can be traced, with the aid of the mark, back to the legitimate copy from which they originated. Such schemes have fallen out of favor recently, because of two problems.

First, the mark must really be indelible. If an adversary can remove the mark, the resulting “scrubbed” copy can be redistributed with impunity. Nobody has figured out how to make marks that can’t be removed from music or video. Past attempts to create indelible marks have failed miserably. A notable example is the SDMI watermarks that my colleagues and I showed were easily removed.

Second, blaming the buyer of an original for all copies (and copies of copies, etc.) made from it just isn’t practical. To see why, suppose Alice has a big collection of music on her laptop. Then her laptop is stolen, or somebody breaks into it electronically, and all of her songs end up on millions of computers all over the Net. What then? Do you take all of Alice’s earthly possessions to compensate for the millions of infringements that occurred? (And if that’s the policy, what sane person will buy music in the first place?) Or do you let Alice off the hook, and allow burglars to defeat your entire DRM scheme? Nobody has a plausible answer to this question; and the Fraunhofer people don’t offer one.

Utah Anti-Spyware Bill Becomes Law

Ben Edelman reports that Utah’s governor signed HB323 into law yesterday. That’s the anti-spyware law I discussed two weeks ago. I guess we’ll find out whether the bill’s opponents were right about its supposed burden on legitimate software businesses.

Used Hard Disks Packed with Confidential Information

Simson Garfinkel has an eye-opening piece in CSO magazine about the contents of used hard drives. Simson bought a pile of used hard drives and systematically examined them to see what could be recovered from them.

I took the drives home and started my own forensic analysis. Several of the drives had source code from high-tech companies. One drive had a confidential memorandum describing a biotech project; another had internal spreadsheets belonging to an international shipping company.

Since then, I have repeatedly indulged my habit for procuring and then analyzing secondhand hard drives. I bought recycled drives in Bellevue, Wash., that had internal Microsoft e-mail (somebody who was working from home, apparently). Drives that I found at an MIT swap meet had financial information on them from a Boston-area investment firm.

One of the drives once lived in an ATM. It contained a year’s worth of financial transactions