Q&A: Fighting online music piracy

Promotional copies of Michael Jackson's single You Rock My World were released with anti-PC technology. Computer security expert Dan Wallach, of Rice University in Houston, US, explains how record companies are turning to technology to try to stop online piracy.

---

How have Sony managed to protect this Michael Jackson CD?

There is some hypothesising on the internet that they have somehow corrupted the table of contents of the CD. It is an index just like the table of contents of a book. Audio CDs have a very similar table of contents that says where to go look for the beginning of each track.

Other technologies along the same lines as key2audio have focused on installing deliberate errors on the CD media, such that a traditional CD player will try to fix the errors whereas a CD ROM would say, "oh no, there are errors, I must stop right now".

So, by corrupting those files, they can stop the computer reading it but an ordinary CD should go on reading it. How easy would this be to crack?

It's a consumer inconvenience but it's not a security mechanism in any meaningful sense

Dan Wallach

It is quite simple to crack. The idea of these systems is somehow that they wish to be perfectly playable on standard consumer audio CD players, yet unplayable on CD ROMs in a computer.

But that means you just need a standard audio CD player with a digital output - so-called SPDIF, which is the Sony Phillips Digital Interface. You can run a SPDIF output from your consumer audio player to your PC soundcard, which will then happily let you record the original digital bits to disc. You can then use your favourite MP3 compression tool. In so doing, you have eliminated all the protection.

It's more of a pain but you end up with precisely the same result. You could then e-mail the track or could share it with anyone of a number of tools such as Gnutella, Kazaa or AudioGalaxy.

In a sense, it's only a temporary break on people trying to copy this. This isn't a secure system at all?

Wallach: Anti-piracy technology "quite simple to crack"

It's a consumer inconvenience but it's not a security mechanism in any meaningful sense. I mostly see it as a tool that will largely backfire against the record companies.

Rather than keeping people from copying it, somebody will stick the CD in their CDRom, which they perhaps have been using to listen to all their music and will find that it doesn't work and in frustration will say, "well, since I have paid money for this, I will go and look on the internet and try to copy it there".

This technology could eventually have the effect of convincing people to forego buying CDs since they can't play them anyway and just go get them on the internet.

If the record companies were to introduce secure CDs, would they also be cracked?

There are a number of companies that are trying to sell various kinds of audio protection technologies. And none of them work

Dan Wallach

Were they to deploy this system, a normal hacker, as you say, would have a lot more information than we had. In particular, a normal hacker would have existing CD players that worked and then could tear those apart and figure out how they worked and could learn the exact algorithm that was being used.

Where is this technology leading?

There are a number of companies that are trying to sell various kinds of audio and video protection technologies. And none of them work. They are selling products that are simply flawed. It's simply a matter of time. One protection technology will be broken, then the next one, and the next one - and so on.

At some point they will realise that this is not the way the world is going to work and they are going to be forced to design a business model in which they can still make money in the presence of people being able to easily copy their music. If they don't redesign how the industry makes money then they have got deep problems.