This has been quite the week for the web. First we had the whole Facebook fiasco (which seems to have motivated Facebook to do the right thing and revert back the terms of service, leaving unanswered questions about how binding terms of service are in these sorts of circumstances), then our attentions turned to the Pirate Bay trial – where the old “making available” issue has come up again, this time in an international law context – and yesterday TechCrunch dropped this bombshell:
That leaked U2 album is causing all sorts of trouble. The unreleased album, which is due out on March 3, found its way onto BitTorrent and was downloaded hundreds of thousands of times. That, apparently, sent music industry lawyers over at the Recording Industry Association of America into a fit. As a result, word is going around that the RIAA asked social music service Last.fm for data about its user’s listening habits to find people with unreleased tracks on their computers. And Last.fm, which is owned by CBS, actually handed the data over to the RIAA. According to a tip we received:
I heard from an irate friend who works at CBS that last.fm recently provided the RIAA with a giant dump of user data to track down people who are scrobbling unreleased tracks. As word spread numerous employees at last.fm were up in arms because the data collected (a) can be used to identify individuals and (b) will likely be shared with 3rd parties that have relationships with the RIAA.
(The U2 leak they’re referring to, we know now, stems from an accidental posting of the album on Universal Music Group’s Australian website.)
Last.fm, for those unfamiliar, is a service whereby users download a program which synchronizes with your iTunes or other MP3 player on your computer and posts on the website what you’ve been listening to recently. Users visiting my profile, for example, will see that I’ve been listening to the Mountain Goats’ All Hail West Texas for about an hour or so. Here, like Facebook, you can friend users, join groups, and write to each other, building little networks and communities around the music. Last.fm adds the perk (which cost them a fortune in negotiation and legal fees) to stream songs either in full or in brief snippets. So if I see a song on someone’s playlist that I don’t know I can click on it and hear what the song sounds like. This leads to endless music discovery, which Last.fm buttresses by applying its own algorithms to recommend music. It’s also a handy tool to look through my own past and track my own changes in listening habits. I find this especially fascinating, for a variety of reasons.
I’ve been using the service for almost four years (technically, I started on Audioscrobbler, which merged with Last.fm shortly after I joined). I’ve recorded over 40,000 plays. When CBS bought Last.fm in 2007 I worried as to what would happen to the service, but nothing to date shook my loyalty to the service like the announcement yesterday. Naturally, I was relieved when my friend Brian posted this link to a Last.Fm user forum, where website developer Russ Garrett categorically denied the TechCrunch story:
I’d like to issue a full and categorical denial of this. We’ve never had any request for such data by anyone, and if we did we wouldn’t consent to it.
Of course we work with the major labels and provide them with broad statistics, as we would with any other label, but we’d never personally identify our users to a third party – that goes against everything we stand for.
As far as I’m concerned Techcrunch have made this whole story up.
I am inclined to believe this denial over the friend-of-a-tipster story. There’s no feasible way for the RIAA to base a claim on this sort of data alone. The best it provides is some intelligence as to how the leak spread across the world. For one, you simply cannot base a claim against a user for playing an unpublished song in the privacy of his or her own home. This is not a cognizable right under copyright. Last.fm does not stream a song unless the record company uploads it directly to Last.fm, so there’s no way by which the user’s playing it will somehow create a “public performance” of the work. Nor has a claim of “distribution” garnered much success when all the rightsholder is alleging is that the Last.fm user downloaded the song; generally, the holder has to allege that the user distributed the song to others. (This does become a bit easier, in theory, when you can show that the song was downloaded through BitTorrent, which by nature uploads at the same time as it downloads. However, this is much harder, in practice, as the way BitTorrent shares files makes tracking any given user nearly impossible.)
Even if we assumed that Last.fm was going to release IP addresses and names (which they may or may not have), this would require the RIAA to get a search warrant and bring a criminal claim against the user, which would require a showing of probable cause of distribution, which I don’t believe a judge could give in this context. In the alternative, the RIAA can do what they’ve done with the other P2P filesharing lawsuits and sue the user in civil court, and later over the course of discovery try and “discover” that they distributed the song. This seems unlikely for a few reasons. The RIAA has declared that they no longer plan to use lawsuits as an anti-filesharing tactic. Given the nature of BitTorrent, it is almost impossible to track users, much less prove under any burden that the user distributed the U2 album. Nor would this fare any better than the traditional P2P lawsuits to dissuade users. If anything, it will cause users to leave Last.fm – which directly hurts CBS, whose CBS Records is member to the RIAA. This would be directly detrimental to a RIAA member.
I do think this is valuable, and I do think it was smart for the RIAA to look here, if they did, but all they will find or could hope to find is aggregate estimate of the size and the scope of the leak. I’d suspect a breach of contract claim or a firing of an employee at the website that accidentally posted the album long before I expect to see a Last.fm-based lawsuit coming out of this incident.
Update (22 Feb): Paid Content has a few more denials from Last.fm, including comments from Last.fm co-founder Richard Jones, and Jonty Wareing (a developer, though the name is suspect) adding, “you could also expect most of the Last.fm staff to walk out of the office door and never return,” were they to give out the data as alleged.
Update 2 (23 Feb): The Last.fm blog does a thorough, thorough denial. This is all over Digg today, too. Thanks to Ryan for pointing this out.
Update 3 (6 April): To be clear, I don’t doubt the existence or programming skills of one Jonty Wareing. I just think having a programmer named “Ware-ing” is like having a pastry chef named “Johnny Baker” or having a farmer name “Sue Growscropswell.” Sorry if I offended the delicate sensibilities of UK programmers.
