The iTunes User Mark: Dangerous for File-Sharers?

It's been recently discovered, though, that each song sold through iTunes Plus --the section of iTunes that sells the higher-quality, DRM-free music -- is marked with the name and e-mail address of the user who bought it.

Apple (Nasdaq: AAPL) hasn't hidden the practice or attempted to keep it a secret, nor has the company tried to encrypt the information. Apple also hasn't said why the information is built into its iTunes songs, and the company didn't respond to requests for clarification.

What do the marks mean for file-sharers? If such a file is found on an illicit file-sharing network , will the Recording Industry Association of America (RIAA) have a case against the user to whom the information points? Would such a case fly in court? Would the information contained in the user mark be enough info to track a user down and sue him or her?

You're Busted, Baby

At first glance, the issue seems pretty clear: What happens if you post a copyrighted song on an illicit file-sharing network?

First someone has to notice. In this case, Apple or the RIAA that would be the parties most likely to act, although it could be a recording artist as well.

"What will happen? They'll trace it back to you and they'll sue your butt," Rob Enderle, principal analyst for the Enderle Group, told MacNewsWorld.

Those bent on sharing music, however, may figure out ways to cover their tracks.

Apple hasn't yet shown any interest in suing its customers for illegally sharing any iTunes music. Converting regular, non-premium iTunes music to shareable MP3s has always been possible using a well-known work-around, which basically involves burning the songs to a CD and then reloading them onto the computer.

A customer with a common name could easily use a relatively non-traceable e-mail address, which would make it harder for the RIAA to track the person down. Of course, there are plenty of consumer-related databases that make it possible to find Internet users, and the RIAA has the funds to utilize them.

There's also the chance that Apple would either cooperate with the RIAA -- since Apple's end user agreement would essentially be broken as well -- or simply comply to a legal subpoena request to provide the customer details.

Smoking Gun?

Either way, the name and e-mail address is very much like a smoking gun.

"It's certainly enough evidence to proceed with a lawsuit," Ken Dreifach, a partner with the law firm Sonnenschein Nath & Rosenthal, told MacNewsWorld. "Lawsuits proceed on less evidence, and they can even proceed on good-faith belief."

While the legality of posting a copyrighted or intellectual property file on the Web isn't "one-hundred percent decided," Dreifach noted, there's been a lot of case law that would make it hard for a file-sharer to fight successfully in court.

Furthermore, a file-sharer might try to muddy the water by citing consumer rights to privacy; however, Dreifach noted that he doesn't believe this falls into any category of a general right to privacy. "A privacy group would have to establish that, by building this feature in, users are getting a materially different functionality to the product than they reasonably expected," he explained. "Does it act in a way that a reasonable person would be surprised and harmed by?"

The topic of iTunes' user-branded songs has been widely reported, and a file-sharing user may have a hard time arguing that the mark is a fundamentally problematic feature that changes the functionality of the product. Besides, Michael Gartenberg, a vice president and research director for JupiterResearch, told MacNewsWorld, "The very fact that people are concerned about this indicates they understand the consequences of it."

In the Courtroom

Legal arguments aside, will the RIAA actually bring lawsuits against people?

"The RIAA has a clear tendency to sue music fans, so we'd advise people to be careful about what they do with these files," Peter Eckersley, a staff technologist for the Electronic Frontier Foundation , told MacNewsWorld.

"The RIAA would be in a very strong position to get settlement payments, regardless of the significance of the iTunes tracking evidence itself," Eckersley explained. "Once a lawsuit is in progress, the RIAA could use the civil discovery process to examine the defendant's computers and depose the user to answer questions under oath about any music they might have copied."

Most Americans with an iTunes account, Eckersley said, would find it easier to settle a lawsuit with the RIAA for a few thousand dollars than attempt to fight a court battle all the way through.

'But My Buddy Did It!'

Few experts believe that Apple is interested in actively tracking its customers for copyright violations -- for example, creating applications that check iTunes accounts for songs and reporting that information back to Apple. While Apple certainly could, the resulting public relations nightmare could end up hurting the music industry, resulting in fewer online music sales. Besides, Steve Jobs has consistently noted his personal disinterest in DRM, and he appears to believe that making music easy for people to enjoy is a vitally important sales driver.

"The risk to a user, which is typically a kid, is they give a song to their buddy Bill, and then Bill puts it up on the Web," Enderle said. "The person who bought the song is going to be held accountable, if giving it to the friend was the crime."

Working Around It

While many reports have been calling the information in the iTunes songs "watermarks," the information is not even a true watermark, which makes losing the details fairy easy.

"I wouldn't call the information embedded in the iTunes Plus files a 'watermark'", Eckersley said. "Watermarks are modifications to the underlying media itself. There are three or four identifying MPEG fields in these files, but no watermarks."

So it seems as if a file-sharer can simply convert the iTunes song to an MP3 format to lose the name and e-mail data, and certainly burning the songs to a CD can do the same thing. There might be some loss of audio quality, but file-sharers typically haven't seemed to be overly concerned with audio degradation.

"For the pros, they will just buy the CD, because the cost of the CD, to get relatively clean music to resell or distribute, it's relatively minor," Enderle noted. "The easier music source is always going to be the CD, which has no inherent records attached to it."

Innocents No Longer Pay the Price

Despite the initial outcry from bloggers and some users upset with the tagging, user marks may be the best solution to DRM.

"It's actually a superior path than the typical DRM path that we're on because, with the DRM stuff, the innocent people pay the price in terms of restricted use," Enderle explained. "With watermarking, the guilty people pay the price -- folks that are doing things that are not allowed by the license. You're perfectly free to copy the songs to devices that remain in your control."

The New Industry Standard?

"Most others [online music stores] are using a variant of Microsoft's (Nasdaq: MSFT) DRM, which provides for both subscription and the purchase of music, but as far as I know, none of them have gone to watermarking," Gartenberg noted. "But once iTunes has done it, it won't be long before others pick this up as well."

Similarly, the Electronic Frontier Foundation isn't aware of any DRM-free music sources that embed tracking information in their files, Eckersley said. "eMusic, the second largest download store after iTunes, does not use DRM and does not embed any identifying information in their songs. There are many smaller DRM-free stores that do not embed identifying information either," he said.

"In contrast, most, if not all, of the DRMed music stores do include directly or indirectly identifying information in their tracks," he added.

"You want to reduce collateral damage in how DRM is used. The most folks that are hurt are legitimate purchasers of the media," Enderle said. "Whether it's movies or music, it's generally better to have a program that primarily focuses on penalizing the criminals as opposed to a program that penalizes everybody in the hope that you also hit the criminals."