The RIAA, Fair Use, and Your Music · 270 words posted 02/16/2006 02:30 PM

Midway through last month’s iTunes privacy dust-up, several readers asked (reasonably): what’s the harm? What does it matter if Apple sends your listening information to third parties? I answered with a hypothetical:

I admit that this instance of data mining appears to be innocuous. But is it? How hard would it be for Apple to check whether my music comes from an RIAA approved source and, if not, simply disable it within iTMS? Is that really such a paranoid fantasy after the Sony rootkit fiasco? I don’t have an answer, but I know this: the more you push back now against apparently harmless invasions of privacy, the less likely Apple will be to breach your privacy substantively later.

Cue the scoffing. Said one representative respondent:

Anyone thinking that Apple is working with the RIAA on a system that will detect pirated tunes on your computer should buy themselves a better tinfoil hat.

Ripping your CD’s to MP3’s or unDRMed AAC is perfectly legal.

Err, except for when the RIAA says it isn’t. As noticed by the Electronic Frontier Foundation and picked up by Slashdot and BoingBoing, the RIAA does not acknowledge that ripping CDs constitutes fair use:

Nor does the fact that permission to make a copy in particular circumstances is often or even routinely granted, necessarily establish that the copying is a fair use when the copyright owner withholds that authorization. In this regard, the statement attributed to counsel for copyright owners in the MGM v. Grokster case is simply a statement about authorization, not about fair use.

Put that in your tinfoil hat and smoke it.

Comment

* * *

iTunes: Apple Releases a Privacy Fix · 269 words posted 01/18/2006 10:43 AM

As Kirk McElhearn noticed this morning, Apple has partially fixed the privacy issue in iTunes 6.0.2.

Now, when you attempt to open the iTune MiniStore you are prompted with the following language:

The iTunes MiniStore allows you to discover new music and videos right from your iTunes Library. As you select items in your Library, information about that item is sent to Apple and the MiniStore will show you related songs or videos. Apple does not keep any information related to the contents of your music Library. Would you like to turn on the MiniStore now?

You don’t need to download any additional software to see the new Privacy language. Thus, Apple has addressed two of my primary concerns:

Apple should be commended for updating iTunes within a week of my original article.

Packet inspection with Ethereal indicates that—assuming you use iTunes on a Mac—iTunes still includes your Apple ID in the header of an HTTP GET sent to Omniture, a third party marketing, data collection, and web analytics firm. It’s up to Apple’s customers to decide whether Apple should update the licenses governing iTunes and iTMS to disclose its use of third party software and services as it does with GraceNote and Kerbango.

While the fix may not be complete, it’s clear that Apple listened to its customers and responded to our concerns.

Comment [1]

* * *

Apple's Non-Denial Denial · 678 words posted 01/12/2006 02:38 PM

According to Rob Griffiths at macosxints, Apple has denied collecting data via the MiniStore. I’ll quote at length because I don’t want to take anything out of context:

I have just received confirmation from Apple directly (from a confirmed source I trust implicitly) that absolutely no information is being collected from the MiniStore (though clearly data is sent to make the feature work). Therefore, the following article is now simply a hint about an obvious feature (disabling the MiniStore), which I wouldn’t typically run. However, in the interest of not rewriting history to avoid my mistakes, I have not changed any of the original text, though I did change the hint’s title, and move the rest of the story ‘below the break.’

Apparently, Rob considers the issue closed. Full disclosure: Rob and I corresponded yesterday about the iTunes MiniStore and my complaints; he originally posted his article on macosxhints based on my reporting and he later issued the retraction/clarification based on his inside Apple source.

Cory Doctorow at boingboing reports that the reliable source is Steve Jobs (Cory also posts many more updates on the issue from various sources; the link is worth following).

Moreover, slashdot notes that Apple has a knowledge base article covering the MiniStore, and that the article was available on the day the MiniStore debuted.

Finally, many since1968 readers have pointed out that the iTunes page prominently advertises the new MiniStore as a feature.

Case closed right? Apple told us they were going to send our song data to the MiniStore, and Steve Jobs tells us that they don’t hang on to that data. What’s the big worry, you pinko commie privacy-hound?

Not so fast.

Let’s read the relevant portion of the Knowledge Base article:

iTunes sends data about the song selected in your library to the iTunes Music Store to provide relevant recommendations. When the MiniStore is hidden, this data is not sent to the iTunes Music Store.

And that’s it. The knowledge base article clearly doesn’t cover the issue of iTunes sending data to Omniture. Once again: there is no way to know that Apple is sending some data from your computer to a third party marketing firm unless you sniff outbound traffic on your machine.

And, while reasonable people can disagree, I believe a plain-language reading of the various documents governing Apple’s relationship with third-party marketers indicates that Apple should have disclosed its relationship with Omniture, if not in the interface of iTunes then at least within the EULA language. See, e.g., Apple’s properly disclosed relationship with GraceNote.

Here’s what we know:

I have contacted both Apple and Omniture to give them a chance to tell their side of the story, but they have not responded. In fairness to both companies, I had to use public email addresses so my emails might be sitting at the bottom of a very large pile and I don’t expect an immediate response.

I’d like to know the answers to the following questions:

I’m not so vain to think Steve Jobs actually reads my blog, but I know someone at Apple does (or they do now, at any rate). So Steve, or anyone at Apple or Omniture who cares to respond, I’ll post unedited any correspondence you send to me, and I’ll even let you post directly to my blog.

Comment [12]

* * *

Omniture, Apple, iTunes, and Privacy · 529 words posted 01/11/2006 01:17 PM

More fun with iTunes and Apple’s Privacy Policy, updating earlier posts here and here:

Merlin has posted a screenshot of iTunes contacting 207.net (thanks to Cory Doctorow at BoingBoing for publicizing this).

I’ve installed Little Snitch and can confirm this behavior: if you launch iTunes on a Mac with the new MiniStore open (and it’s open by default), iTunes attempts to contact 207.net, otherwise known as Omniture. See the screenshot above. And why on earth does a third party need to bury its IP address behind a string that looks like an intranet (local) address?

Should we care? You decide. Here’s the relevant language from Apple’s Customer Privacy Statement. I apologize for quoting at such length, but I don’t want to take their language out of context:

Apple takes your privacy very seriously. Be assured that Apple does not sell or rent your contact information to other marketers. To help us provide superior service, your personal information may be shared with legal entities within the Apple group globally who will safeguard it in accordance with Apple’s privacy policy. There are also times when it may be advantageous for Apple to make certain personal information about you available to companies that Apple has a strategic relationship with or that perform work for Apple to provide products and services to you on our behalf. These companies may help us process information, extend credit, fulfill customer orders, deliver products to you, manage and enhance customer data, provide customer service, assess your interest in our products and services, or conduct customer research or satisfaction surveys. These companies are also obligated to protect your personal information in accordance with Apple’s policies. Without such information being made available, it would be difficult for you to purchase products, have products delivered to you, receive customer service, provide us feedback to improve our products and services, or access certain services, offers, and content on the Apple website.

Leave aside for the moment the plain meaning of Apple’s privacy language, which seems to say, “We won’t share your information with marketers, but we’ll share your information with people who do pretty much everything that marketers do.”

Let’s look at Omniture. Here’s their privacy policy, again quoting at length to avoid distorting their words:

Omniture knows that privacy is a critical part of a positive online experience—and that you need to feel confident your privacy is always being protected.

Omniture gives you every assurance that while you are on this Web site or using its products and services, your information is secure.

Omniture’s measurement tools are used to improve Web site design, to help market products and services more effectively, and to generally improve your user experience.

Omniture is committed to monitoring, adopting, and following the highest standards of privacy in the industry.

I’ve also attached a screenshot of Omniture’s privacy page. It’s unclear why the gentleman is so happy; possibly he’s just found out that his privacy is safe with Omniture and Apple, or maybe he’s happy to have received YOUR iTunes data—mmmm, now that’s some good marketin’! We just don’t know.

Either way, by its own admission Overture appears to be a marketing firm.

Comment [21]

* * *

iTunes: An Update About the Update · 1653 words posted 01/11/2006 10:41 AM

An update on my article about iTunes and the information Apple collects: the comments are running overwhelmingly against my position and in favor of Apple’s practices. Honestly, this surprises me, but them’s the breaks. Some of the comments are fatuous (“scandalmongering?”—please) but some are pretty compelling, so I’ve distilled them here.

My position, in summary: iTunes collects data about the music I’m currently playing and sends it to the iTunes Music Store without my knowledge or consent. Apple says nothing about this practice in any of the relevant licenses. Apple should be clear about its information gathering practices.

Arguments in favor of Apple:

Note: And when I say “tertiary,” by golly I mean tertiary! You won’t come across the Privacy Statement unless you read the iTMS TOS, and you won’t find the iTMS TOS unless you read the iTunes Software License.

The core issues are trust and transparency: I want to do business with companies that respect my privacy; I want them to tell me clearly when they’re collecting my data; and I’d prefer to opt-in to data collection programs rather than opt-out. Is that so much to ask?

UPDATE 1:

A few more arguments have come in and again, some of them are pretty sound. Instead of letting my responses get lost in the comments I’ll continue posting them here.

Here’s the relevant language:

This application contains software from Gracenote, Inc. of Berkeley, California (“Gracenote”). The software from Gracenote (the “Gracenote CDDB Clientȁd;) enables this application to do online disc identification and obtain music-related information, including name, artist, track, and title information (“Gracenote Data”) from online servers (“Gracenote CDDB Servers”) and to perform other functions. You may use Gracenote Data only by means of the intended End User functions of this application software.

As of this writing (01/11/06 3:30pm EST), no publicly available Apple EULA mentions Omniture. According to Google, the only mention of Omniture on Apple’s web site is a couple job openings and a copyright notice for the King Kong trailer. Apple clearly felt bound to include GraceNote in its iTunes EULA. Why not Omniture? Why one standard of transparency for Company A and a different standard for Company B?

And saving best for last, my favorite:

Bonus irony round: The majority of posters who have argued most vociferously in favor of Apple’s position have done so with fake email addresses. I can appreciate that: we all value our privacy, no?

UPDATE 2:

More reader arguments in bold, followed by my counterarguments:

What I do assert is that sending a packet of your information, however innocuous that information may be, to a third party without your consent or knowledge is foot-in-the-door behavior: if customers don’t make it clear that it’s got to be disclosed now, companies will take the lack of opposition as assent. It’s not evil; it’s just what corporations do.

So, back to the argument on technical feasibility: whether one likes it or not, Apple can already change the way DRM is handled in iTunes unilaterally. For example, with the release of iTunes 4.5 Apple changed the number of permissible burns of DRM’ed songs from ten to seven. There is no technical obstacle preventing Apple from changing DRM management again. If Apple wished to update iTunes tomorrow so that it only played DRM’ed music, it could easily do so.

Comment [60]

* * *

iTunes Update: Apple's Looking Over Your Shoulder · 740 words posted 01/11/2006 07:33 AM

As noted at TUAW, iTunes 6.0.2 contains a new feature: the MiniStore. It’s neat, at first. Sort of.

But not really.

Each time you play click a different song, the MiniStore features information about the artist currently playing, as well as “Listeners Also Bought…” Here’s a full size capture of Apple marketing in action: as you can see, I’m playing Mary J. Blige covering U2’s “One”, and the MiniStore shows other albums from Mary J. Blige and U2.

This means, of course, that every single time I play click a song the information is sent back to Apple. You can turn off the MiniStore at the click of a button, but it’s not clear whether turning off the MiniStore is the same as turning off the flow of data (one doubts it). And don’t bother looking for a way to turn this “feature” off in the Preference pane: it’s not there.

In fairness to Apple, I didn’t read the iTunes software license when I updated. So let’s have a look. I’ll be waiting here when you’re done.

Back so soon? Did you read the whole thing? OK, I didn’t either. But the music store receives scant mention:

This software enables access to Apple’s online music store which offers downloads of music for sale. This store is open in the United States and may be open in other select territories. Use of this store requires Internet access and requires you to accept additional terms of service which will be presented to you before you can use the store.

The iTunes software license doesn’t actually provide a link to the Music Store Terms of Service, but I do: read it here.

Here’s what Apple says about my information (emphasis mine):

Your Information. You agree to provide accurate, current, and complete information required to register with the Service and at other points as may be required in the course of using the Service (“Registration Data”). You further agree to maintain and update your Registration Data as required to keep it accurate, current, and complete. Apple may terminate your rights to any or all of the Service if any information you provide is false, inaccurate or incomplete. You agree that Apple may store and use the Registration Data you provide (including credit card and PayPal account information) for use in maintaining your accounts and billing fees to your credit card or PayPal account.

That’s it. Apple doesn’t say that it can transmit or store information about the songs I play back to the iTunes Store. In fact, the Music Store TOS expressly incorporates the Apple Customer Privacy Statement.

The Privacy Statement contains the following language:

We also collect information regarding customer activities on our website, .Mac, the iTunes Music Store, and on related websites. This helps us to determine how best to provide useful information to customers and to understand which parts of our websites and Internet services are of most interest to them.

But this caveat is cited specifically in the context of collecting billing information (such as address, phone number, and credit card).

Either the privacy statement means something, or it doesn’t. My sense is that it doesn’t: the general exceptions Apple carves out for itself in the Privacy Policy are large enough to drive a truck through, making the specific exceptions in the iTunes TOS meaningless.

What’s to be done? Probably not much, other than steal your music from file-sharing services and play it with open source players (presumably the sort of behavior Apple wishes to discourage). Either that or acquiesce as yet another corporation takes, without asking, just a bit more of your privacy.

Update 1: Thanks for all the comments. Rather than reply to each argument I’ll try to distill them in a separate post: An Update About the Update.

Update 2: I’ve also added an entry about Apple and Omniture, the third party marketing company to which iTunes 6.0.2 sends TCP and HTTP GET packets.

Update 3 (1/12/05): Several readers have contacted me to point out that iTunes sends the data in question only when you click a song, and not when any new song plays. I have corrected the language in two places to accurately describe the behavior. My original sentences read “Each time you play a different song” and “every single time I play a song.” I have now substituted the word click for play, and left the original language intact so the correction is obvious. Thanks for the feedback.

Comment [47]

* * *

Dubious Piracy Numbers from the MPAA · 347 words posted 07/09/2004 10:22 AM

The Motion Picture Association of America (MPAA) has released a study (PDF) claiming one in four internet users has illegally downloaded a movie. According to the MPAA, 24% of US internet users have stolen a movie, and an incredible 58% of Korean users reported stealing a movie. Here’s the chart provided by the MPAA:

MPAA Piracy Chart

The MPAA includes very little detail on the study’s methodology, but what’s included is suspcious:

The study concludes:

The top means of preventing piracy in the future revolves around educating consumers that this activity is illegal. There is also strong interest in discovering means of legally obtaining movies.

That sounds reassuring—an acknowledgement that piracy is in part a cultural issue, responsive to consumer education and access to legal means of downloading—until you remember that the MPAA is behind the ART Act, the Pirate Act (see also here), and many other means of expanding government intrusion in the name of protecting intellectual property.

Piracy is a real problem, but numbers like this—flaky, alarmist claptrap—don’t advance anybody’s understanding of the issues.

Comment

* * *

How to Bittorrent Fahrenheit 9/11 on a Windows 2003 home network · 364 words posted 07/08/2004 10:15 PM

I plan to see “Fahrenheit 9/11,” but it’s a movie for which I am utterly unwilling to pay. Luckily, BoingBoing has posted a link to several torrents, along with download instructions.

For the uninitiated, BitTorrent is a free program for downloading very large files via distributed networks. Sort of like the old Napster on steroids. The only real catch is that BitTorrent enforces share and share alike rules: your torrents will download much more quickly if you allow incoming connections. This isn’t always easy for a non-technical user to configure if you’re on a home network behind a firewall.

My setup: a home network, connected to the Internet via cable modem, with a Windows 2003 server. BitTorrent is installed on a Windows laptop, which gets its connection to the internet via the Windows 2003 server. I use NAT to allocate the IP addresses of my client machines.

To download torrents quickly with this setup:

  1. Open “Routing and Remote Access” (All Programs > Administrative Tools > Routing and Remote Access).
  2. Expand your server node.
  3. Expand IP Routing.
  4. In the NAT/Basic Firewall node, find your connection to the internet. This is probably something like “Local Area Connection.”
  5. Right click on that connection and then select Properties.
  6. Select the “Services and Ports” tab.
  7. Add TCP services on port 6881. This part is critical for fast downloads: in the “private address” field, enter the IP address of the client machine on which you installed BitTorrent.
  8. Repeat the previous step for ports 6881-6889.

Obviously, this isn’t an ideal way to handle your port forwarding if you let your IP leases expire frequently, but if you’re on a home network you probably don’t.

Let me know if this works for you. Popcorn and soft drinks at my place tonight.

Links:

Update: It looks like the torrent linked by BoingBoing was pirated Thai-style—someone sat in a theater and taped it. I’ll post a new torrent link if I come across a better copy.

Comment

* * *

Sun and Localized Pricing · 170 words posted 06/01/2004 05:47 AM

In January, I made the following prediction:

2004 is the year that Western (i.e., Western European and North American) software companies finally understand that they either adopt strategies to make their products more affordable in developing countries, or irrevocably lose the fight against software piracy.

According to the International Herald Tribune (via John Dowdell), Sun has taken a major step in that direction with plans to localize pricing based on population and degree of industrialization:

The software will be sold to governments for between 33 cents and $1.95 a citizen annually, depending on each nation’s development status as measured by the United Nations.

Disparities in the ability to purchase software are shocking (see, .e.g., this interactive graph comparing the price of Macromedia Studio MX 2004 to GDP per capita in 10 different countries). It’s in the interest of Western software vendors to make their products affordable in developing countries—without affordable options, developing country programmers will either (a) pirate Western software and weaken intellectual property over the long run, or (b) write their own.

* * *

GDP per capita and Software Piracy, part II: How much is that software in the window? · 284 words posted 01/12/2004 01:14 PM

As Rishab Ghosh and others have pointed out, the cost of licensing software is often several times the per capita GDP in many developing countries; for example, the typical worker in Sierra Leone would have to work for 4 years to pay for Microsoft Windows and Office. I thought it would be interesting to plot the cost of a popular piece of web design software compared to the per capita GDP in 10 countries: the five countries with the worst rates of software piracy (China, Indonesia, Russia, Ukraine, and Vietnam) and the best (Denmark, Finland, New Zealand, UK, and the United States).

To compare the GDP per capita to the cost of Macromedia Studio MX 2004, select a country from the dropdown list in the Flash chart below. The blue circle represents the size of the GDP per capita in US dollars, and the yellow circle represents the cost of the software suite in US dollars. In other words, the larger the blue circle, the easier it is to afford the software.

View the graph (link opens in new window)

As you can see, the differences are striking: the Macromedia software suite costs slightly less than 3% of GDP per capita in the United States; in Vietnam, on the other hand, the cost of the software is double that of per capita GDP.

The cost of the software was obtained from the Macromedia Worldwide Store. The GDP and piracy information came from the Economist and the BSA (see my previous post for citations). All figures were converted into US dollars in mid-December when I collected the data. Finally, I don’t intend to pick on Macromedia; I selected their software suite because it’s the industry leader in its category.

Comment

* * *