Technology’s Toll on the Record Label

It seems harmless enough. You buy a new album on compact disc, slip it into your computer’s CD drive for a listen, and instead of hearing music right away, a message pops up on the screen. It’s one of those long user agreements riddled with lawyer-speak. You scroll through it quickly and click “accept,” impatient to hear your new purchase. Meanwhile, the innocent looking CD begins to install a secret string of computer code onto your system. Your computer has been infiltrated by a rootkit.

A firewall won’t block it, and virus-detection software won’t recognize it. It’s not a computer virus, but like many viruses, a rootkit hides itself in the computer’s inner systems, executes operations without notifying the user, and is difficult to uninstall. And, like computer-controlling spyware, the software that accompanies the rootkit discretely transmits information about the user’s music listening and copying habits back to the record label. In addition, should the user discover and attempt to remove the software, the jagged hole in code left from the removal process leaves the computer vulnerable to attack from malicious software.

While such a scenario sounds like the plot of the latest technology-gone-bad, corporate spy thriller, it actually took place last year. In October of 2005, the scandal hit the newsstands: computer scientists had discovered that Sony BMG, a major record company, had been distributing music CDs that contained surreptitious software that inadvertently created a serious security risk for consumers’ computers. Under pressure from consumer groups, Sony BMG recalled the affected CDs. However, as more and more information about the secretive new technology rose to the surface, the public began to question Sony BMG’s and other record companies’ intent in applying destructive copy protection technology to their products. The record labels’ answer: the same leaps in technology that have made music easy to sell and distribute also make music easy to share and steal. Consumers are computer savvy, and the music industry tries to be savvier by developing sophisticated anti-piracy technology. But the fact is, record labels struggle to stay one step ahead of a society that craves easy access to inexpensive tunes.

The history of the music business is fraught with controversies concerning reproduction of its products. Every time a new technology arises, promising cheaper, faster, more convenient, or higher quality distribution of music, consumers and music industry moguls clash. In the 1920s, sheet music publishers cried foul when radio became readily available, allowing the public a free listen to proprietary tunes. When audio cassette tape recording became popular in the 1980s, record companies issued warnings to customers, decrying the criminality of making tapes of record albums to sell or share with friends. With the advent of CDs, which offered the portability of cassette tapes and the sound quality of the unwieldy long play (LP) record albums, record companies could once again provide a product that consumers preferred over the available pirated version.

The reduced sound quality of pirated music and the difficulty of its distribution soon became the greatest limitations to the extent that music pirates could affect record label profits. Recorded tapes of LPs or CDs were audibly poorer than the originals. And tapes of copied tapes were even less crisp. When digital recording technology finally allowed consumers to make high-quality copies of audio using their computers to burn CDs, even rampant pirates were limited by the costs of purchasing the blank CDs and delivering the physical copies to friends or customers. It was simply impractical and expensive to make and distribute many high-quality illegal copies.

Only with the increasing popularity of digital music, has the music industry experienced an exponential change in how piracy affects profits. The MPEG Audio Layer 3 (or mp3) is a computer file type that allows users to make digital copies of songs that take up very little space on a portable mp3 player, a CD, or a hard drive. They are therefore easy to email to large lists of people, post on online forums with massive numbers of participants, and even copy onto CDs that contain hundreds of songs. The traditional CD has a new application. Not only do consumers purchase a CD with the intent of listing to it in a traditional CD player, but they also intend to make mp3 copies to listen on their mp3 players, in their car stereos, and on their computers at work and at home (all legal practices). But, just one copy of a song illegally posted online can cost the record label millions of sales. “Digital copies are perfect copies,” says Barton Carter, Professor of Communication and Law at Boston University. “You can now make cheap, fast, perfect copies that can be distributed around the world in seconds.” And, as computers become faster and internet systems become better able to transmit large amounts of information, the record labels lose further ground.

When faced with the problem of technology providing easy access to illegal copying, record companies have tried fighting technology with technology. Software companies offer record labels software that controls how consumers use music CDs in their computers. Sony BMG’s infamous CDs contained such software from SunnComm in Phoenix, Arizona (developers of MediaMax) and First 4 Internet in the United Kingdom (developers of XCP). And, Sony BMG is not the only company to resort to this solution. In the aftermath of the Sony BMG debacle, SunnComm has revealed that other record labels also use their MediaMax product and has posted a list of affected CDs on their website.

The software developers have added new-fangled locking mechanisms to the relatively old technology of a CD. The CDs with the copy protection software contain applications that, upon installing themselves into the computer’s system, cause the computer to digitally frisk any CD that it reads. If the consumer later inserts a music CD that contains a digital watermark, a series of inaudible sound blips signaling the record label’s desire for copy protection, the software allows the computer to play the music files but prevents it from copying them or uploading them into an mp3 player. And, except for a cryptic message in tiny print on the CD case, users don’t know when they’ve purchased an affected CD until it’s already too late.

Despite the technical success of SunnComm’s MediaMax software, the music industry’s highest profile use of this technology has resulted in a widely publicized failure to sell functional and copy-protected CDs to music fans. Sony BMG’s first mistake was not in distributing music CDs that contained software — it was in deceiving the consumer. With ordinary computer software, users accept the terms of an end user license agreement (EULA), a written contract that displays itself before a software program installs. The EULA outlines the understanding that the user will use the software only within the rules laid out by the developer, and the developer divulges what type of software they are providing. While Sony BMG’s EULA does warn the consumer that the software will install, Princeton University computer science graduate student Alex Halderman says “they don’t disclose fully what their software is going to do” and that is deceptive. Also, the Sony BMG software installed before the user agreed to the EULA, and it did not reveal the extent to which the user’s computer would be at risk with the installation.

The second major failure of Sony BMG’s attempt at using software to control pirating hinged on an important characteristic required of anti-piracy software: It must be difficult to disable. Not only must the software developers make the software well hidden, but it needed to be so well integrated into the computer’s system that attackers of copy protection would have trouble removing it. They were so successful in preventing a clean removal that even their own removal patch, developed in response to consumer outcry, left pieces of code that made computers even more vulnerable to malicious attack. And, pirates have easily found ways to bypass the software without removing it. Not only have they found ways of copying music before the software installs, but they also use fairly low-tech methods of disabling it. For example, by simply masking the location on the disc that contains the code with tape or ink, the computer will read the music files without ever detecting the software.

The problem with digital rights management (DRM) in all arenas, not just in Sony-BMG’s case, is that it is too easy to overcome. “How do you come up with something that is so strong that no one can get past it?” says Barton Carter. “Copyright is going to die because of technology. Ultimately, it becomes unenforceable.” Justin Bankston, a computer programmer in Austin, Texas and the owner of an independent record label, agrees. “There’s no way that DRM can work because the kids are always smarter than the suits,” he says. “It will stymie the occasional non-technical user but most kids can get around it.”

Alex Halderman, who recently published a paper describing how to detect copy protection software, says that Sony BMG very likely never intended the software to stop all pirates. “Instead of wasting energy on making it completely impossible, they’ve wasted their energy on making it barely impossible,” he says. In fact, because their software is not compatible with popular mp3 loading platforms such as Apple’s iTunes, they’ve even published instructions for how to get past the copy protection. In effect, they’ve saved pirates from the trouble of finding their own way to break in. “It’s a staggeringly low bar to circumvention,” says Halderman, so low that he suspects that it was meant only to deter the very impatient or the very uninformed.

Whether or not record sales benefit from strong copy protection really comes down to a numbers game: how much money will record labels get back from the money they invest in theft prevention? Jeff Rougvie, Vice President of Artists and Repertoire at Rykodisc, an independent record label in Beverly, Massachusetts, says his company does little to prevent illegal copying because the technology available is expensive and does not really increase profits. “It’s all crackable,” he says. And oddly enough, with many independent records, illegal downloading can actually increase profits in the long run. People that download illegal copies and share them often generate sales by spreading the word that an album is good. Losing some profits to a bit of illegal downloading can be cheaper than the high-cost marketing campaigns used by the major record labels to promote sales. “Where you really get hurt by piracy is on the top end of the sellers — the hit records take the worst hit,” he says. While sharing music freely to generate a following makes sense with smaller bands that attract serious music fans, it doesn’t generally help bands that already have a larger audience — an audience that might include dilettante music lovers, who are more likely to prefer free over high quality. Until DRM becomes foolproof, Rougvie says that it doesn’t make sense for a smaller company like his to consider making the financial investment to protect so few sales. The major record labels, on the other hand, see a direct link between even modest attempts at DRM and huge profits from popular album sales.

While technology may have gotten the music industry into this mess, it is not providing a foolproof way out. Record labels are losing the digital rights management struggle, and to come out on top, they will likely have to revise their marketing and sales strategies. With the development of each new anti-copying technology, consumers find ways to circumvent its purpose. When DRM systems fail, record companies are no longer competing with each other for the lowest prices. Halderman says, “In reality, they are competing with free.” To make money in this new era, the record label’s new business model may become more about selling — not the music — but profitable live performances and lucrative marketing merchandize. For many genres of music aimed at tech-savvy listeners, the mp3 will likely evolve into the means for promoting these more tangible commodities. Then perhaps music could again be about the magic of the recital and not about its recreation.

by Molly F. Wetterschneider (March 21, 2006)