eKarma: Have a little Virus, Pirates

Third Ring Road East
Breathing deep the inversion layer
1022 hrs.

Steven Schwankert of Village Grouch fame wrote an excellent piece for IDG (picked up here in The Washington Post) describing how Chinese fans seeking to download illegal copies of Ang Lee's excellent film "Lust, Caution" are finding on their hard drives not a copy of the film, but with software that pops a nasty little trojan virus into their systems.

There are several interesting aspects to this story.

Virus? What Virus?

First, it was apparently found and addressed by Kaspersky Lab and Rising Software well before it came up on the collective radar screens of Symantec, McAfee, and TrendMicro. One wonders why this is the case, particularly given that Symantec and McAfee tout the value of their software in part based on their global scanning for viral threats. I am especially concerned about TrendMicro, who have a huge presence in China and who make a great deal about their expertise as an "Asian" security company.

It also suggests that the malware threat in China is growing and diversifying. From dorm rooms filled with budding software engineers, to the challenges facing the country's law enforcement teams, to the quiet but rapid growth of China's cyberwar military-industrial complex, the country has become as much a haven and spawning ground for creators and distributors of Malware as the United States or any other country. This would seem to argue for greater investment by the computer security vendors in local labs who can not only find but anticipate new threats.

As an aside, it would also seem that companies like Symantec are destined to become major defense contractors. But we digress.

The Empire Strikes Back

Second, it seems that Hollywood (including the music and TV people as well as the film side of the business) and the software industry may have inadvertently discovered a way to slow online piracy and perhaps even the growth of downloaded content. All the studios - or, better yet, the MPA and the Business Software Alliance - need to do is hire a few good hackers to come up with some particularly nasty viruses and spread them around online disguised as illegitimate digital copies of random applications, movies, and music files.

Sure, the viruses would not deter the most determined or careful downloaders, and the anti-virus companies would inevitably come up with fixes. But imagine, for a moment, the fear, uncertainty, and doubt this would wreak among the less-expert. The mere possibility that these files would include viruses would be enough to drive a lot of marginal downloaders away from illegitimate downloading (and probably a few away from legit downloads as well).

Naturally I would expect clearer heads in the PR and legal departments of these organizations to prevail, ensuring that neither Hollywood nor the software industry would ever actually subsidize - or even publicly condone such practices. But you can easily imagine how such an option must tempt some people in places like Redmond and in the Black Tower.

Indeed, if the matter of digital rights management has proven anything, it has proven that Hollywood and many large software concerns believe that extremism in the defense of intellectual property is no vice, and that goodwill is readily sacrificed in that battle. If anything will keep hackers from high-powered lunches at the Ivy or the Fulton Fish market, it is the fear of court costs.

Nonetheless, it is fascinating, if not a bit disconcerting, to think that there is a commonality of interest between the creators of malware and the creators of movies.

Engineer, Engage the FUD Pump

What I do expect is that the IPR-driven industries will kick into gear a semi-coordinated propaganda effort to ensure that stories like the "Lust, Caution" become as widely known as possible, so that the threat is seen as being far larger and more serious than it really is. This costs them little, supports their goals magnificently, and enables the studios and developers to position themselves as defenders of the public interest.

Which, frankly, is the smarter way to handle it. You steal, you pay. Or, you pay, we protect.

For all the failings implicit in Hollywood's approaches to the IPR issue and digital entertainment, let's not lose sight of the most important fact - downloading illegal files is theft, theft is wrong, and anyone who does so willfully probably deserves a hard drive filled with malware.

Comments

[antonymous]

Great post, I have so many things to say I don't know where to start! They're less of comments and more of an idea-springboard, so bear with me.

First off, I'd have to say that "name-brand" anti-virus packages are usually among the worst for detecting new threats. What they are good at is selling product and getting bundled in with OEMs like Dell. I trust my personal Windows boxes to the free stuff - usually Antivir or ClamAV.

Second, infecting P2P networks with viruses is not a viable long-term solution - there are just so many ways to get around them, whether its switching operating systems, only trusting certain uploaders, etc. Yes, it will deter the non-technical users, but the "geeks" will simply find a better way to propagate infringing IP. In addition, the attack vector is limited - I think most users are (or will become) smart enough to recognize the difference between an executable and a movie file.

Obviously, I fall into the Black Hat camp - DRM will continue to be defeated, and the best option is either to turn the internet into a legit distribution medium, or put faith in ISPs changing their business model to "accommodate" (read: charge) excessive users of upstream bandwidth.

Of course I'd like to offer the perfect solution, but I think it starts with a blanket-license model. Check out the EFF's site for more details. And while I respect your ideas (and don't want a flamewar), I'd like to point out that copyright infringement is not the same as stealing, as infringers are not depriving anyone of their right to sell.

[David]

Antonymous:

Thanks for a superb comment.

I largely agree with you on your assessments. I think open source anti-virus stuff is better than the packaged variety, and in fact that intelligent settings and "anti-septic" surfing habits play an important role as well.

I agree that infecting P2P networks will not eliminate the problem. It might shrink it, though, and that's why I suggest the guys in Hollywood might be tempted.

From a factual standpoint, I have no doubt that people will continue to find ways to defeat DRM, and that the answer is for the industry to change their business model.

I agree that the creators of intellectual property are facing major changes in their businesses.

As to the issue of theft, I suppose this depends on where you derive your code of behavior. Personally, I turn to rabbinic authorities on this issue, and those whom I have consulted are emphatic that such behavior is theft, and have provided what I feel is adequate proof of that.

If ecclesiastic authorities don't cut it for you, the law is pretty emphatic as well.

If you disagree with the law and the system of laws, that's another story. But if that's the case, work to change the laws and the thinking around them.

I respect your opinions on this, and I am certain you hold them for legitimate reasons. I have, unfortunately, run across too many people who take an ideological stance (in both directions) on intellectual property based not on morals or convictions, but out of pure self-interest.

If your desire is to get something for nothing, or to squeeze the public for every bleeding penny, you are wrong, full stop. And you're going to get what you deserve.

My personal opinion is that electronic distribution forces all of us to rethink what we are selling. I like the Creative Commons approach, and I think that's a good start, but I believe we need more intelligent discussion about what the industries of the future look like, and creating ways to ensure that artists, developers, and others can continue to reap the benefits of their creativity.

Thanks again.

[antonymous]

Thanks for the response - as an agnostic, I'd definitely be interested to hear what rabbinic teachings have to say on the topic (especially regarding moral relativism in this age).

If my comment above wasn't clear enough, I obviously disagree with the law on many issues - namely copyright, infringement, etc. There are several reasons behind this.

I believe a "greater good" can be accomplished by opening up creative works to a wider audience. I strongly advocate an expiration date on copyright, rather than the system of perpetual extensions granted by the United States Congress. These works are meant to be built upon and to teach - if Shakespeare's work were copyrighted, do you think it would be performed as widely today?

Tracking down copyright owners to get clearance is a pain as well. There's no central repository of copyright owners for works, and no common rate for clearing samples of movies, music, etc. As long as this continues, people such as mash-up artists will continue to break "the law" despite creating new creative works built on old ones (IMO).

I completely agree that most people want something for nothing. Industry players want to keep making the same profits, consumers want to access those products freely (or at least cheaply). And the digital age already serves people with more choices than they know what to do with. But from purely anecdotal evidence, most people I know who download gigs of music also buy more music and go to more concerts - they just avoid the music they don't like. People who download movies are movie buffs - they see more movies in theaters than I could possibly stand.

I guess my broader point is that some aspects of industries are going to be steamrolled soon. Not to sound like Thomas Friedman, but globalization and the internet are changing the way we think about all industries, and are now going up against America's last great export (IP).

So what does the creative industry of the future look like? I think all things that can be digitally reproduced are out of the question. It feels like a downer, but I think the money is going to be in experiences and tangible items - concerts, movie theaters, merch, product placement, etc.

Love to write more, but I'm late for lunch! Interested to hear your thoughts,

[David]

As you are by your own admission agnostic, I hope you won't mind if we don't delve too much into the ecclesiastic. I am a student, not a scholar, of Jewish law, so you and I debating this issue on such grounds would do little justice either to ourselves or to the subject. I only brought it up as an illustration that most people are guided by their own moral code - or lack thereof - in their dealings with intellectual property.

You and I are best suited to discuss this as a matter of both civics and business.

As to civics, my point is simply this: if you disagree with the laws, fight to change them. If you break the laws before they change, prepare to suffer the full consequences. Rejection of that simple principle sets us all on the road to anarchy and chaos, and I for one would prefer not to go there.

The argument about "greater good" sounds noble, but that line of thinking is also fraught with great hazard. Go down that road, and suddenly all property ownership comes into question. If copyright falls to such arguments, so does home ownership, car ownership, laptop ownership, and money. Our system of laws are designed to ensure the protection of private property and the rights of the individual against the capricious desires of state or mob.

If you want to argue that this is a case where the public good is harmed by individual rights, the issue belongs before the highest court in the land, as it is a constitutional matter. It is not, however, an issue to be decided at random by an individual acting on his or her own.

Personally, I think the business case against IPR is far more powerful than the legal one. As you quite correctly point out, experiences, affiliation, merchandise, and the like are once again where artists and their representatives are most likely to earn their keep in the future.

What you must keep in mind, however, that while the big bad music companies will suffer from the abandonment of IPR, they are by no means alone.

How do we protect book authors when their works can be digitally reproduced?

How do we protect independent filmmakers, whose only product is the film itself?

How do we protect any creator of a work who is unable to find compensation from performance or ancillary revenue streams?

The Grateful Dead model is compelling, but let's not think this is the answer for every band that ever struck a chord. Indeed, what happens to those acts who can only exist in studio?

The technological genie is out of the bottle, and all of us who create must change to accept it. But we must also think about how to make this transition as smooth as possible for all who create to live as well as those who live to create.