There’s a fresh report featured on PaidContent that features a glowing new scheme to monetize existing P2P.
Note: This is an article I wrote that was published elsewhere first. It has been republished here for archival purposes
The problem is that there’s no technology available today that is actually up to the test.
ArsTechnica highlighted the story and correctly notes that there “are a number of reasons to be skeptical of the report”, but there are a few points that we’d like to clarify. First, though, what is the buzz on this?
PaidContent:UK says that there is a new system about to be launched on Virgin Media that would pay copyright holders money for unauthorized content being downloaded. The system involves Deep Packet Inspection (DPI) The report goes as far as to say this:
Subscribers to the music package will even be allowed to share tunes amongst themselves because every transfer is anonymously tracked using Audible Magic, but proliferation to non-subscribers will be blocked.
The system would be opt in where internet subscribers would simply pay a flat fee for unlimited downloads and those who don’t opt-in would be blocked from downloading the content.
It’s hard to figure out where to begin on the flaws of this grand scheme, but it’s pretty safe to conclude that this new scheme little more than a pipe dream today.
Technically speaking, there are two ways of identifying content on a file-sharing network. The less secure way is by the file-name (which any searchable p2p protocol uses to find content) The more secure way is the hash value which points to a specific file on a network.
From an anti-piracy standpoint, neither methods are nowhere near a foolproof way to identify what the content in the file is. A file-name can simply be edited by anyone at any time on a network (which is why fake files have been an issue for years) A hash value can be completely different if anything from the coding is remotely different to a simply meta-data modification is made. For a time, some suggested that one could figure out what is in the file simply by looking at the hashcode, but that has long ago been dis-proven because even certain kinds of ED2K links (which can show a file-name) can have the file-name edited by anyone and have the has value changed accordingly.
Fast-forward a few years and there was the rise of Deep Packet Inspection which essentially is a technology that analyzes the packets flowing through a network. Many in the copyright industry were hopeful that this would be the be-all and end-all solution for it’s advertised ability to identify the protocol of each packet, thus allegedly making the job of ISPs to police their networks easier. Was it the be-all and end-all technology?
Not really. We reported on the Internet Evolution tests conducted and only two vendors actually had the courage to publish their results. Arstechnica commented that, “Initial tests [conducted by Internet Evolution] of deep packet inspection equipment indicated that the devices that were put forward for testing had difficulty identifying the protocol being used if simple encryption techniques were used” To further clarify, the tests were conducted to see if filters could identify and block p2p traffic. The tests found that the filters, even unencrypted, had a hard time identifying all the traffic – it just depends on what protocol one was using. The test, for instance, showed that one vendor couldn’t even detect iMesh traffic while the other couldn’t detect WinMX traffic. Significant considering the popularity of the protocols? Very likely considering it proved that the vendors shown only went after popular protocols, leaving the rest of the protocols as an afterthought.
If there was a major migration of users (like what happened with Kazaa when file pollution became a major issue) to another protocol or a handful of protocols, then the years of research to get deep packet inspection to detect that particular protocol would have been for nothing.
It’s worth pointing out that Arstechnica rightly notes that when protocol encryption is brought into the picture, the DPI software had a difficult time actually identifying the protocol as well. In fact, they had a far more difficult time then without encryption. When using eMule, protocol obfuscation is generally standard practice on the ED2K network and the chart shows a pair of zero’s for detection. It’s highly doubtful DPI has had time to adapt to eMule’s latest encryption methods which is essentially protocol obfuscation for Kademlia (Kademlia has been often cited as a replacement to the ED2K servers should they finally all go offline)
Arstechnica also rightly notes after, “that’s a far cry from being able to identify the contents with sufficient resolution to pick out the artist and label. The system would also have to avoid red-carding legitimate song purchases and noninfringing snippets of copyrighted works.”
Unfortunately, Arstechnica missed a more recent test done on filtering technology which plainly stated that today’s ISP-level filtering technology couldn’t tell the difference between a legitimate file and a copyright infringing file on a P2P network. The study basically backs up the previous study, confirming that Deep Packet Inspection isn’t up to the task of separating legitimate and unauthorized traffic.
So essentially speaking, the report from PaidContent:UK is saying that Virgin hopes to cash in using technically broken technology to somehow solve their problems. It sounds good in theory to simply get a flat fee from ISPs and just let P2P do what P2P does best, but the idea of separating legitimate content from illegitimate content is little more than a stretch of the imagination. Some digital rights advocates like EFF, on the other hand, might like the idea of simply putting a blanket levy on ISPs so the lawsuits can finally stop.
Perhaps the one thing that is unclear at this time is whether or not such a move from ISPs can even attempt this legally. eMule is released under a GNU/GPL License which is the same thing as numerous other clients. For one, is it legal to charge money for a service based on open source software? Secondly, would the code used for Deep Packet Inspection need to also be open source? Additionally, what about AltNet’s TrueNames Patent (which effectively is a patent on the hash values of a file)? If there is going to be monetary gain from P2P and P2P uses hash values of a value which is patented, would such actions run afoul of patent laws?
Arstechnica raises a slightly different concern about the topic which is a more straightforward way of looking at it:
Another reason for skepticism is the fact that playlouder doesn’t actually appear to be running a system that fits the description in the PaidContent:UK piece. It’s difficult to discern precisely what they offer without signing up, but everything available on their site and elsewhere indicates that it’s a DRM-free subscription service that offers its subscribers content in an MP3 format that contains a digital fingerprint. That fingerprint might make it possible for DPI equipment to track these songs, but that’s a far cry from being able to track all the pirated music flowing across a network.
This point may make our concern about the legalities of such a system more of an issue as well considering it is definitely possible to be simply using existing protocols for a closed network of files. If it’s simply dropping a large number of copy protected files onto a network, the lure of subscribing would probably be greatly diminished.
In any case, the chances of such a scheme catching on is unlikely considering few “walled garden” approaches, as it’s often put, don’t often work. To our knowledge, a walled garden model over top of an open p2p network is very rarely successful beyond an internet novelty.
Drew Wilson on Twitter: @icecube85 and Google+.
