Putting an End to the RIAA
(using buggy code)

  February 11th, 2004

I'll preface this saying that I do not condone pirating of copyrighted materials. However, I do have a serious issue with the RIAA, their tactics and ways, their illegal and unethical interpretation and abuse of the DMCA (among other laws and amendments), and their attempts to invade the privacy of individuals. I am a proponent of P2P networking. I think BitTorrent is one of the best P2P technologies of the last few years. And in terms of MP3's and P2P networks, I believe in a person's freedom to do what he/she likes with property they have purchased legally. More than anything else, though, I believe that the RIAA is in some ways attempting to hold us back from technological progress. As an example, many Judeo-Christians believe the Book of Revelation from the Bible and its references to a "one world currency". A recent discussion posted on Slashdot exemplifies this need as the world becomes more and more digital. In a similar regard, I believe that current and forthcoming technologies will continue to hurdle us into a more digital era and that in the future items such as music CDs and DVDs will be distributed digitally in their entirety with a less restrictive license that allows us to make a few copies for use in our homes, vehicles, at work, and via devices such as MP3 players (this is similar to how Lindows licenses its Linux distribution - you get one copy and one account for the Click N Run Warehouse, then use it on as many systems at your home as you desire. Lindows doesn't care if you, your wife, your two kids, your car, and your home entertainment system are all installed from the same CD and updated using the same CNR account).

So with the preface and reason(s) out of the way, let me move on to the jist of this article; namely how to squash the RIAA in their tracks and allow digital technology to move forward. But before I explain my ideas, allow me to clarify exactly what the RIAA considers to be illegal:

1) It is illegal to distribute (share) copyrighted materials. Have you ever read the warnings at the beginnings of VHS and DVD movies? They caution against public display, copying, and re-distribution without permission from the copyright holder. NOTE: it is not illegal to provide the means for distribution of copyrighted materials, which is why softwares like LimeWire and Kazaa are allowed to exist.

2) It is illegal to receive (download) copyrighted materials from an unapproved source (meaning that the source providing the materials must have the permission of the copyright holder). This is comparable to possessing stolen property. Law enforcement doesn't care that you didn't know it was stolen. Possession of stolen property is either a misdemeanor or a felony depending on the circumstances and estimated value.

I admit that I download MP3 songs over P2P networks. For the record, I never download entire CDs, I just download the songs I hear on the radio and think are kewl. But I also, shamefacedly, admit that I'm a P2P abuser. No, not an abuser in the sense that I download gigabytes of music a month. Rather, I download my music, but I don't share any of it. If I like more than 2 or 3 tracks on a CD, then I usually buy the CD. I always burn a copy, so I have one for my home entertainment system and another for my car. I also rip them to MP3s and store them for playing from my laptop and my Sony MP3 player. I use LimeWire Pro as my P2P network client. I recently installed the newest version and went through all the configuration options and had some ideas.

One of the options in LimeWire Pro is to choose where to download new files to. In my case, its C:\incoming. However, I don't leave them there because any song downloaded to that directory is automatically shared. Once downloaded, I immediately move the file(s) to C:\mp3s. I guess this makes me a freeloader. But at least it means I'm only guilty of possession of stolen property and not also guilty of distribution (bear in mind something the RIAA hasn't brought up in court as of yet: possession of stolen property is a relatively minor offense. But distribution of copyrighted materials has the potential to cross international lines via the internet which means that Interpol, the FBI, ATF, and other international law enforcement bodies can get involved and it means that prosecution and sentencing don't necessarily fall under U.S. jurisdiction even if you reside in the U.S. - remember the American kid that was caned a few years ago? He was tried and sentenced according to the laws of the country he was in at the time).

So back to stopping the RIAA... what if the latest version of LimeWire Pro had a simple check box in its configuration that allowed you to not share any music on your system, but still download songs? Better yet, what if all P2P softwares had that option? And what if they all enabled it by default? Well that would break P2P file sharing, right? Everyone could download, but there'd be no source to get it from since no one was sharing anything, right? But wait... what if that checkmark in the checkbox didn't actually work? What if some stupid programmer wrote some bad code and, gosh darn it, even with the box checked, all your songs were still shared? What would this do for us? Well, for one thing, no one using the software could ever be charged with distribution of copyrighted materials. After all, we all see the "Don't Share Any Files" checkbox with a checkmark in it. And what if the same software that had the sharing bug also had a bug in its search options? What if when you searched for something on a P2P network, if your mouse accidentally hovered over it for more than 3 seconds, it just started downloading the file? Heck, its not illegal to search for files. And if you don't have any control over the "auto download" bug, who can prosecute you? Of course, this bug would save the file(s) to the same directory that isn't supposed to be sharing files. So for all intents and purposes you'd be completely innocent and could even become incredulous when charged with a crime by the RIAA. After all, you thought you were doing the right thing. You thought the software was protecting you. Its not your fault its buggy software.

Courts have already ruled that P2P softwares cannot be held liable for providing the means to share files illegally anymore than a car manufacturer can be sued if a drunk driver kills someone. It is ultimately the end-users responsibility to use the software legally. However, in our "what if" scenario above, you can be sure that the RIAA would find a way to legally force the P2P software makers to patch their softwares. And they would comply. LimeWire, for example, would release a patch 6 months after. Unfortunately, the patch wouldn't actually fix the problem, or in fixing it, it would open up a new bug that basically did the same thing. We've seen this with Microsoft many times (they have on more than one occasion released patches that didn't fix the problem in full and recently we all found out that MS took 6 months to release a patch for a vulnerability that Eeye Digital Security discovered). In fact, this could actually be used as precedent. All the legal team at LimeWire would have to say is something to the effect of, "if a company the size of MS with their thousands of programmers can make these kind of mistakes, how can our little company with only tens of programmers be held to a higher standard"? Related, there was recent speculation on the internet that MS could be sued for waiting six months to release a patch for a known vulnerability. If MS won that yet-to-be-filed suit, precedent would be set for other companies to wait similar amounts of time. On the flip side, if the RIAA went after the P2P network providers and charged them with "gross negligence" for waiting so long, and then not actually fixing the problem, precedent would be set for a class action suit against MS, which would help the entire world by forcing MS to A) write better, more secure code and B) patch their holes more quickly.

Most interestingly, and I'm not sure why someone hasn't done it already, but why don't we have something like p2panonymizer.com? Rather than pay iTunes or Napster or some other site for music downloads, what if we all paid $5 a year to p2panonymizer.com. Their service could let us share all the files we wanted, all without traceable IP addresses. This would definitely squash the RIAA recent court actions of trying to force ISPs to yield the users behind the IP addresses. And as with the P2P softwares, they'd only be providing a service. It would be up to the user(s) to use it illegally. Of course, the mix of an anonymizing service for accessing P2P networks combined with the kind of buggy P2P code mentioned above would probably bankrupt the RIAA and MPAA in legal expenses. Wouldn't that suck?!?