RIAA Tracking Songs by MD5 Hashes

aSiTiC writes "Apparently RIAA has obtained some technical experts in their prosecution of file swappers. Currently they are tracking traded mp3 files from the Napster network by matching MD5 hashes. This seems quite interesting but I was under the assumption that identical hashes could be created with identical rips and id3v2 tagging. Now may be the time to update your illegal mp3 file MD5 hash sums."

Comments

gee?

[Comsn]

The RIAA, the trade group for the largest record labels, said it also found other hidden evidence inside the woman's music files suggesting the songs were recorded by other people and distributed across the Internet.

ya think? and here i thought it was the magical mp3 fairy who put mp3s on my hd...

Re:gee?

[squiggleslash]

To put this in context, the RIAA was responding to the impression "Jane Doe" gave that the MP3s were rips of her own CDs:

The disclosures were included in court papers filed against a Brooklyn woman fighting efforts to identify her for allegedly sharing nearly 1,000 songs over the Internet. The recording industry disputed her defense that songs on her family's computer were from compact discs she had legally purchased.

Of course, the wording of the latter is ambiguous - it could mean nycfashiongirl meant she had downloaded MP3s of pieces of music that were also on CDs in her possession. A lot of amateur lawyers on Slashdot (ahem) claim this is fair use, and given it's non-commercial and wouldn't have an impact on the ability of the artist to make a sale, that may well be true.

(This wouldn't, though, be a defense for the central problem that she made all of these MP3s available for download by millions of anonymous strangers without the consent of the copyright holders. And assuming her identity is revealed and she is sued, if the "ambiguous" claim's alternative interpretation is correct, she'll be able to show the CDs to the Judge.)

Re:gee?

[laird]

It's true that two different people could generate RIP's of the same track with the same MD5 hash, but the odds are low: they'd have to use exactly the same encoding settings, and enter exactly the same ID3 tags with exactly the same values. (Counterpoints: they could be default settings, and CDDB/Gracenote metadata, which would improve the odds a bit) And since we're talking about large music collections, the exact matching would have to have to happen across hundreds of tracks. And if the ID3 tags had notes like "ripped by so-and-so" that'd kinda blow the case. So while it's certainly true that MD5 hashes don't completely uniquely identify a particular RIP of a track, I think that when compared for large numbers of files, it'd be a pretty good indicator of file copying.

Re:gee?

[nearlygod]

About this interpretation of Fair Use: I agree that downloading mp3's of CDs that you have purchased should be fair use. I am in a similar situation. A couple of years ago I lost 90% of my CD collection in an apartment fire. I had about 20 of these CDs ripped at the time and since then, I have downloaded many of the others to replace what I had paid for. In some cases, I re-purchased the CD because I wanted to have an original for some of my favorite artists but I didn't mind the mp3 mastered replacements for many of the CDs. Would this fall under Fair Use? I would think that it does since the RIAA seems to think that we are only purchasing a license to listen to the music. However, if I had to present the original CDs to a judge to prove that I do/did own the physical CD, I would be SOL.

Re:gee?

[Anonym0us Cow Herd]

It would still be possible for her to have music with an md5 hash the same as a file on the Napster network. If they were ripped with the same encoder/bitrate/id3 tag as the Napster version, it's possible for md5 to be the same.

It is also possible that, as someone else suggested, the magical mp3 fairy left those files behind on her hard drive. In fact, I would propose that the mp3 fairy theory is even more likely.

The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit.

It is not possible (okay, unlikely, but unlikely enough for me to say not possible) to have two different files with the same MD5 hash. And definitely not likely by accident.

If even one single bit of the file is changed, then approximately 50 % of the bits of the MD5 hash will change. What cryptographers call "good diffusion properties". Good enough to trust for digital signatures, secrets, etc. You sign the MD5 hash of a document, because nobody else will have a document with the same hash.



To preempt one of the inevitible replies let me state: yes I know that you could have two different files, in theory that have the same MD5 hash. After all the files are much larger than the MD5 hash of 128 bits. Multiple files hash to the same value.

But the whole point of the design of MD5 is such that you can never create or discover any two such different files that hash to the same value.

If you were to examine 2^127 different files, then you would have a 50% chance of one of them giving you the desired MD5 hash. Do you know how large 2^127 is?

I would say that there is better than a 2^127 chance that the mp3's were left behind by the magical mp3 fairy.

Re:gee?

[arth1]

This wouldn't, though, be a defense for the central problem that she made all of these MP3s available for download by millions of anonymous strangers without the consent of the copyright holders.

Unless she had an OC-48 or two going into her home, she didn't make the files available for download by *millions* of strangers. When the resource is limited, the magnitude of the crime is likewise limited. If you offer a stolen watch on the streets of New York, you can't be charged with trying to sell it to MILLIONS of people, cause there's only one watch. Likewise, in this case there's only enough bandwidth for a certain number of potential downloads, and speaking of millions here is plain misleading.
If the people who downloaded files from her spread them further, that's THEIR crime and not hers, much as the guy who sold a stolen watch won't be found guilty for the watch buyer illegaly selling it to someone else.

And in this case, it's even less severe, as it's not a theft, but a copyright violation.

Regards,
--
*Art

Re:gee?

[Anonym0us Cow Herd]

what's stopping people from simply changing a letter in the mp3 info tag (the trivial approach) or a bit or byte somewhere in the file? Good luck matching my file to anything.

Well there are several things that could stop you. You could get the latest MISD (Microsoft Internet Social Disease), etc.

But if you don't, then short of other things stopping you, such as getting run over by a truck, you merely need to change one single bit in the file to have a very different MD5. That bit does NOT need to be in the ID tag. You could just decode one single mp3 frame, randomly selected from the file, alter one bit of the sound, and then re-code that single mp3 frame.

It is even possible that someone might be inspired to write a tool to do this. It would defeat a lot of the previous Slashdot discussions about using MD5 to indicate "good" downloads before you download them. But maybe trust relationships of the P2P swappers themselves, using private keys, is a better idea than trusting the download file.

Re:gee?

[gozar]

This is pretty common at least with iTunes. Most of the people will not change the default settings, so each cd rip will be identical, all using the same id3 tags.

Re:gee?

[Anonym0us Cow Herd]

Why on earth would you destroy the quality of your mp3 by decoding/re-encoding the music when all you have to do is change something in the IDv.x tags? Someone could, more easily, write a program that adds a random letter to the "Comments" field of IDv3.

I didn't say to destroy the quality of your mp3.

Decode one single 11 byte frame. Alter one bit. Re-encode it. In fact, as I understand things, the sound is stored as the sums of frequencies (FFT) or something like that. (Not an expert on this.) You could probably just alter one bit in the correct frame such that you add a new blip of a frequency at an imperceptably low amplitude.

Another possibilty is that there may be "zero" or "unused" bits in some header fields. Hypothetical example, in some bit field, 3 bits are not yet defined. Simply define tham as RIAA bits. But this gives limited possibilities to obscure the hash.

Another possibility is to alter or add one frame of "silence" at the beginning or end. If there is already a frame of silence, then alter that in an imperceptable way.

There may be other kinds of imperceptable alterations that can be made to mp3's.

Two consecutive frames may indicate the same set of frequencies being played at this moment in time, but at slightly different amplitudes. Swap the two frames. Or alter by one bit the amplitude of one of the frequencies that is least audible, such as deep bass. Or alter the start time of when a particular frequency starts or ends by an iimperceptable amount.

I'm talking about changes such that even if you have a 10th generation copy that has had 10 random alterations done, each by one person in the chain of handoffs from the person who originally ripped it, you have a "perfect" quality mp3, as far as mp3 "quality" goes.

Re:gee?

[3terrabyte]

Excellent point. The "magic number" system the RIAA uses is astounding. 52X burners count as 3 cd burners? $750 to $150,000 damages PER song is crazy.

I thought I remembered seeing something about how you have to have a certain $$ amount before getting a felony. $2000? ANyway, they then said each song was worth about $200. I think it was something like $20 per song, times 10 people. 10 people being the gestimate of people you magically distributed it to, because obviously more than one person can download a song from you. Anyway, 10 songs and you're a felon.

Anyway, these numbers don't add up. The RIAA likes to paint a screen of terror by saying that your one song you shared, can then be shared exponentially after that. Sure, it's true. You share it to 2 people. They share it to 2. By the end of the day, 1,000,000 people have it. But why would you be responsible for the 2nd thru 20th level of distribution? You only gave it to 2 people. And if it's "worth" $1 on iTunes, why isn't the damage $1 per song per download?

It's this magic number system the RIAA counts by that causes them to sue 4 students for 47 billion dollars. It would have taken the RIAA 5 years of GROSS profits to hit 47 billion dollars. How can a search engine running for a couple months on a campus amount to 5 years of GROSS profits?? It doesn't...make...sense.. you must acquit.

Re:gee?

[anthonyrcalgary]

>> "It is also possible that, as someone else suggested, the magical mp3 fairy left those files behind on her hard drive. In fact, I would propose that the mp3 fairy theory is even more likely."

For loose definitions of "fairy", yes. eg child, friend, etc

>> "The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit."

Try the following: Install some CD ripping/encoding software. Leave it at the defaults. Use CDDB to generate the ID3 tags. Unless something gets corrupted, that *will* produce an identical file, down to the last bit.

Re:gee?

[Anonym0us Cow Herd]

You point out a very real danger.

If you just alter the ID3 tags without altering the mp3 content, then they can nail you. If simply altering id3 tags becomes commonplace because everything thinks it is the easy, trivial implementation, then they will nail you by checking the hash of the content. Identical content with trivially altered ID3 tags is a very good argument that you got this file from the thousands of other people who have the same hashed file with trivially altered ID3 tags.

I'm proposing a non-trivial, but not that conceptually complex alteration to the content that alters it in an imperceptable way. In fact, whether the alteration seems complex to you is irrelevant. After all, it is just a command line tool to you anyway, just like altering ID3 tags. You don't care how it is done. Run this tool on your mp3 file, it randomly affects an imperceptable alteration to one of the gazillions of 11-byte frames in the file.


However I doubt that they will go to such trouble -- if they have access to your files you're pretty much caught red-handed. A different MD5 checksum won't get you off of the hook here.

They might have access to your files if you are sharing them.

I think the original argument is that Jane Doe was sharing files. Jane claims the sharing is unintentional. Jane claims that the mp3's on her hard drive are her own rips of CD's she owns. The MD5 hash proves otherwise. This sub-discussion is about altering mp3's so that hashing is now useless at tracking the source of where you got an mp3 from. In the Jane Doe scenerio, a comples mp3 alteration to foil the MD5 hash would actually be useful.

Merely altering the ID3 tag such that the RIAA can also alter the ID3 tag back to what it is in the wild, and get identical MD5 hashes is a very strong argument against Jane Doe.

Re:gee?

[Anonym0us Cow Herd]

Try the following: Install some CD ripping/encoding software. Leave it at the defaults. Use CDDB to generate the ID3 tags. Unless something gets corrupted, that *will* produce an identical file, down to the last bit.

You may be right. I'm not sure. I have some doubts about the ripping process being as exact as you say. I agree that the mp3 encoding process is exact. Same input file, same settings, ---> same output file.

Re:gee?

[AJWM]

I have some doubts about the ripping process being as exact as you say.

So did I, so I just ran the experiment:

al% cdparanoia -d /dev/hdd 1 pf.wav
cdparanoia III release 9.8 (March 23, 2001)
(C) 2001 Monty <monty@xiph.org> and Xiphophorus

Report bugs to paranoia@xiph.org
http://www.xiph.org/paranoia/

Ripping from sector 0 (track 1 [0:00.00])
to sector 17511 (track 1 [3:53.36])

outputting to pf.wav
(--stuff omitted due to lameness filter--)

al% cdparanoia -d /dev/hdd 1 pf2.wav
cdparanoia III release 9.8 (March 23, 2001)
(C) 2001 Monty <monty@xiph.org> and Xiphophorus

Report bugs to paranoia@xiph.org
http://www.xiph.org/paranoia/

Ripping from sector 0 (track 1 [0:00.00])
to sector 17511 (track 1 [3:53.36])

outputting to pf2.wav

(-- stuff omitted due to lameness filter--)

al% md5sum pf*wav
fd8ddaf41fd482a6aa1a492915a3e788 pf.wav
fd8ddaf41fd482a6aa1a492915a3e788 pf2.wav
al%

Looks like under identical conditions (same drive) it'll rip consistently. Ripping off a different drive might give different results, that's more hassle than I want to try right now. If anyone wants to compare, the disc/track I ripped is Pink Floyd's Dark Side of the Moon, Capitol's catalog # CDP 7 46001 2, DIDX 226. (Different recordings will almost certainly give different results.)

Oh, and to make RIAA happy:

al% rm pf*wav
al%

;-)

Re:gee?

[geekoid]

al% rm pf*wav
al%

ha nice try, we know the only way to delete something is to highlight it and click delete, and then empty the trashcan!

You can't fool us!

Re:gee?

[Zigg]

Scratches on CDs don't affect the audio. They can make the audio skip because part of it is unreadable, but if that happened you would get an error while ripping the track. So a flaw on the CD would not affect a rip.

Well, except that most decent rippers these days use paranoia or something similar, using algorithms to interpolate the corrupt stuff. The interpolation is going to sound good but it's almost certainly not going to be the same bit-for-bit. And bit-for-bit is what matters.

Re:gee?

[Anonymous Coward]

i don't know anything about your setup, so i can only speculate, but what you've just described is EXCEEDINGLY unlikely to occur in general. take a look at the cdparanoia FAQ on this subject for an explanation. on any of the three linux boxes i've used (one brand-new compaq and two older dells with yamaha and toshiba drives), i get different MD5 hashes from successive rips of the same track on the same drive. your drive must be extraordinarily consistent compared to the vast majority of drives out there if what you describe happens regularly. as many posters on this thread have pointed out, the "bit spread" in hashes such as MD5 is designed to be very, very large -- that is, if even one bit in the source file flips, about half (64?) of the bits in the hash will flip and the result will be totally different.

-fp

Re:gee?

[Zigg]

Different drives, with the same disc, and identical software, certainly do give different results. Just tested. Identical versions of cdparanoia live on both systems.

I also ran lame with default settings (makes a 128K CBR) on both WAVs and got different sums there as well.

No tags involved.

Re:gee?

[Anonym0us Cow Herd]

I also ran lame with default settings (makes a 128K CBR) on both WAVs and got different sums there as well.

This part is not at all surprising. Even one single bit difference in two files would give radically different MD5 hashes.


Different drives, with the same disc, and identical software, certainly do give different results. Just tested. Identical versions of cdparanoia live on both systems.

This part is the really interesting result. Two different rips, same software, same CD, give different results on different drives. I think cd paranoia says something about "digital jitter" whatever the heck that means?

Re:gee?

[Zigg]

This part is not at all surprising. Even one single bit difference in two files would give radically different MD5 hashes.

Right, but I figured, maybe the bit differences might disappear in the encoding, some wacky things you can only determine empirically :-)

Two different rips, same software, same CD, give different results on different drives. I think cd paranoia says something about "digital jitter" whatever the heck that means?

Not sure about "digital jitter" myself, but I do know that pretty much all discs have errors all over the place (I backup my audio CDs with cdrdao, which tells me just how many CRC errors it had -- not seen a disc with less than a hundred yet), and the difference probably lies mostly in error correction strategies employed by the drives themselves. I don't know this for sure though.

Re:gee?

[Anonym0us Cow Herd]

Right, but I figured, maybe the bit differences might disappear in the encoding, some wacky things you can only determine empirically

I wouldn't expect two different WAV's that sound exactly the same to give the same mp3. But I wouldn't have bothered to test it either.

As I think about it, your theory is interesting. Since mp3 compression is based on the perception of audio, or getting rid of everything that you don't perceive, then there is some argument that two very similar WAV bit patterns that sound identical might actually be closer after encoding to mp3 than you might think. Of course an MD5 hash of the two mp3's is not a good indicator of this, as one single bit difference in two files radically alters the MD5 hash.

Re:gee?

[MattRog]

They might have access to your files if you are sharing them.

That's true, they could download a sampling of your files and then generate the hashes. I don't see the RIAA doing that, though. The checksums are only interesting in this isolated case - namely that the defendant is claiming that the MP3s were legally obtained (and could, presumably, provide the source media).

Going through thousands of MP3s and changing the data to change the checksum is the simplest way to make this claim - however since the MP3 process (rip-n-compress) is inherently lossy (given all the posts on this thread so far indicating that it is difficult to produce identical MP3s from the *same source*) you would need to prove that your file's flaws are only coincidentally identical to the commonly-stolen one (since you obtained it from a P2P source, after all).

So, you'd need to change enough of the data to remove ripping/encoding flaws that someone else made. Can you still do that and not destroy the MP3?

In short, I don't see that modifying the checksum is of any use. If you are sharing MP3s you are stupid and most likely will get caught and find yourself in court. People seem to think that they can get off on a 'technicality'. Are you even thinking that the RIAA isn't going to still file a subpoena because your hash doesn't match theirs? The RIAA smells blood - the best advice is to steer clear and not steal MP3s.

MD5-hashes

[Code-Cheetah]

As far as I know, you will get indentical hashes from identical files with the same ID3. How can they track files with the help of MD5-hashes?

Re:MD5-hashes

[whaley]

I'm not sure what you mean, but they don't track mp3s by generations, they just look at the mp3 hash and compare it to the known hashes of files they found on the internet, so they 'know' you didn't rip the mp3 yourself.

Re:MD5-hashes

[Gherald]

> This proof of RIAA is as good as the SCO evidences of greek language or bsd firewall code against linux

Uh, actually this is irrefutable proof. It will miss a lot of songs, but it is virtually guaranteed to not give false positives. This is much more solid proof than SCO had.

To think a month or two ago when SCO was insisting on an NDA many on /. were clamoring for some MD5 sums instead...

Obviously the RIAA's technical experts know what they are doing... its time to alter a few ID3 tags like the story suggested.

Re:MD5-hashes

[nolife]

I just did some consecutive rips of an audio track and compared the md5 checksums.

I did the same song three times. The first two times, all things were equal including all settings. The MD5 checksums were the same.

I swapped out my DVD/CD player for a different model. Reripped the track on the same computer with the same exact settings and the MD5 was different.

I am using Exact Audio Copy in secure mode and Lame for the encoding. The ID tags were recieved the first time and the same tags used for all three attempts (EAC remembers the disk).

I'm sure I could try many things like changing the read speed, comparing the wav files and not just the resulting mp3 etc.. but I do not have the time for more analysis.

Re:MD5-hashes

[henele]

If you read places like CDFreaks you'll see that extracting CD Audio is a mix of science and voodoo.

Theres issues of offset values (as with CD audio it is difficult to hit an *exact* location on the disk), plus the way the reader deals with C1 and C2 error correction, as well as how different extracting software interfaces with the hardware.

It would almost be safe to say two mp3s with the the same MD5 are one file copied twice (as opposed to two individually created mp3s), but that doesn't mean they are illegal...

Re:MD5-hashes

[Anonymous Coward]

Well let me point you to the most likely problem:

The "offest".

If you use EAC you will see there is a tab where you can correct your drive's offset value.

Now if you do that (or atleast 'sync' them) you should get the same result on both drives if the disc is good enough. (Ofcourse all your other settings should be set properly too) (If your disc is bad, EAC can correct those errors by re-reading a dozen times and then using the most often occuring result, but if your disc is a little too bad on a specific part, EAC won't be able to return the same result each read)).

I know this because I have ripped discs on *three* diffrent cd-roms one 2x old HP burner, one el cheapo 36x drive and a toshiba laptop drive (also a burner).
Granted I compared wave files, but I guess that if you feed the same wave file to the same encoder with the same settings you should get the exact same result.

note:
Offset: When your cd-rom reads a position on the disc in audio mode it often misreads, ie say you tell it to read position 0, then it will read position 4. Normally this doesn't matter since offsets are measured in milliseconds so you won't hear a diffrence, but for ripping bit-perfect rips, it does matter.
You ccorrect it by finding out what offset your particular cd-drive has (every particular model number has a particular offset, few drives that are of the same brand and model have diffrent offsets)

What I mean by 'syncing' is not correcting the offset but making it the same between drives.
For example, burn a offset cd in EAC (use a cd-rw if you must). this disc will have the same offset of your cd-WRITER.
Now 'correct' the offset in all your drives (including your burner, 'cause burners have a diffrent offset when writing than reading) with this disc.
It won't be perfect, since now all your drives have the same offset, namely the write offset of your cd-burner.
BUT now the rips will be identical, since they will all have the same offset.

NOTE: I think the RIAA doesn't hash the ID3 tags, only the music.
That way the same mp3 with diffrent ID3 tags will still be identified as being the same.
Thats btw what Kazaa does if i'm not mistaken.

What if...

[moehoward]

What if I own the CD but got files off the Internet because I was too lazy to rip them? Would I still be expecting to be sent to the prison camp?

In other news, all songs produced by RIAA artists in the last 10 years all have the same MD5 hash anyway, because they're all the same.

Re:What if...

[DrEldarion]

Yes, because for them to know that you have the MP3s, you have to be sharing them, which is the illegal part.

-- Dr. Eldarion --

Re:What if...

[Anonymous Coward]

In all seriousness, just the other day I wanted to rip an old CD of mine, but could not due to media damage. So, I went the net and got myself an mp3 of the track.
Is that illegal? Am I a fellon?

-- A.C.

Re:What if...

[91degrees]

Yes.

Just like if I decide to borrow your car to drive home because I'm too lazy to walk to the other side of the carpark.

Re:What if...

[Asprin]

OK, well met, it's called the "lameness filter" for a reason, but you have to admit that there are occasions where stuff like ASCII art and all caps are useful, don't you? Besides, my original version wasn't even all-caps, it was only, like 50% caps at best.

A while back, somebody suggested changing the karma system to allow you to circumvent the lameness filter for individual comments at a cost of karma. Something like my all-caps infraction would cost, say 2 points if I still wanted to post it. If I wanted to post a ASCII-art map of Canada or maybe some math equations to make a point in some discussion, that would cost me 10 or 15 karma. Maybe this feature is disallowed altogether for people who have less than 25 karma. I think the prices should be high, but still give you some breathing room.

I mean, hey, I'm not using my karma for anything. Once it's maxed out, it's pretty useless, right?

Re:What if...

[IpalindromeI]

you have to be sharing them, which is the illegal part

Actually that's not true. They only care about the sharing because it leads to what they really care about: people listening to music that they didn't pay for. If everyone who shared mp3s had bought every CD of the songs they downloaded, no one would care because they would have already paid to listen to those songs. The problem is that most people don't own all of the CDs for the songs they download, and the RIAA doesn't like it when you try to wriggle out of their money trap. If the actual sharing was the problem, the distribution itself, then we wouldn't have radio stations playing music either, because that also lets people listen to music they didn't pay for, but it's a bit different because you don't really get a choice of what you hear. But now if you go and start recording songs you hear on the radio, so you could listen to them whenever you wanted, you're getting into that grey area. Of course the RIAA doesn't really care about that because they know that radio quality is shit, so there won't be widespread radio recording anyway.

Re:What if...

[NixLuver]

ROTFLMAO!!! That's funny!

But seriously, folks ...

Come on; this is at the heart of the entire issue, isn't it? Whether or not IP can *really* be compared reasonably to ... ("Real Properties"? "Physical Properties", whatever you choose to call them.)

Here's the difference. When you purchased your car, you purchased a unique item with a physical presense and value; if I 'borrow your car and drive home', I have deprived you of its use, i.e, its value. If I download your MP3 file, I have not *taken* anything from you. I have deprived you of no value.

Whether or not the pundits and legal beagles decide that it is legal for me to possess a piece of intellectual property from a unique source other than the physical piece I purchased (i.e., a downloaded mp3 rip of a different, identical CD to the one I purchased), the distinction is pointless. You can't have it both ways; either I purchased a physical object (The CD), which I then own and can do with /that copy/ what I wish (think software non-transferrable licenses, etc), or I purchased a license to use that property. If I purchased a license to use that piece of IP, then my copy of an identical IP is legal, provided I don't use (or allow to be used) both at the same time (The backup copy argument, etc... )

Complex or not, the question is MOOT to a reasonable person who's not blinded by the rhetoric of an industry based on deception and begging the government to pass laws protecting them from obsolescense. If I have paid for a copy of the song, does it really matter where the copy I'm listening to *came* from?

Copyright was never intended to allow an individual or corporation to build a multi-million dollar industry based on a single piece of IP; it was intended to allow a creator to obtain reasonable compensation for intellectual innovation, whether it be aesthetic or technical, for a reasonable and limited time. Does the heart surgeon that repaired your father's ticker get paid every time dad's heart beats? Does the builder that constructed the house get paid again every time someone walks through the door? Are IPs at all similar to Physical Properties?

I would LOVE to see the artists get paid. Unfortunately, a ridiculously small sum of my money actually goes to the artist.

As a one time musician myself, I tell you honestly that I would rather see 100 artists making $100k/year doing something they love than 1 artist making $10,000,000/yr doing what the Marketriods push them to do and push us to buy. It's in the 'Recording Companies' best interests to limit the number of artists they distribute and sell as many cds as possible (the more unique products, the higher the average production cost per CD, the lower the profit margin); Innovation and diversified offerings are anathema to our current system, in simple economic terms.

Re:What if...

[Veldcath]

You do pay for songs on the radio.

You listen to the radio. The radio station plays songs and advertisements. Advertisers pay money to the radio station for that. The radio station pays money to the RIAA/Labels according to how big their listener base is.

You've just paid for the song. Unless you turn your radio off every time a commercial comes on, at which point you're a "pirate", listening to something you didn't pay for.

You pay with taking a few seconds off the length of your life as you listen to (or probably as likely - ignore) the advert they're playing.

Re:What if...

[Jah-Wren Ryel]

No, you are demonstrably wrong. The RIAA cares about sharing because it means loss of control for them. The RIAA is all about controlling distribution channels and sharing disintermediates their existence. Make no mistake, if they could come up with a way to sell you the same song twice, they would (ever try to get a cracked 3-year old CD replaced? They won't do it, you gotta buy a new one even though you already "own" the music.

Now here is where it gets good - the downfall of mp3.com was exactly because of sharing. They put together a system where you could buy a CD online, have it shipped to you, but also immediately have it available online as an MP3 through a password protected account that only allowed a single simultaneous user. They also provided a method to "upload" your previously purchased CDs - you stuck your CD in your cd-rom drive and ran their program that verified that the CD had the same contents as the released one (so either you had a legit copy or a perfect rip&dupe, either way you *already* had the music) and then that disc was also made available in your private mp3.com account.

The RIAA freaked and sued and won. They won on the premise that mp3.com was making copies without permission (from the RIAA) and then sharing them. Never mind that the only people who had access where those who had proven they already owned the music to begin with. They won big too, something like $25M per RIAA member company. That used up a *lot* of VC and IPO cash.

What happen if

[Anonymous Coward]

you just normalize or edit the begining or the end of the song? Does the MD5 Hashes still works?

Re:What happen if

[l1gunman]

Any modification, to ANY bit of the file covered by the hash, will change the MD5 hash (that's how hashes work). If you assume the hash includes the ID3 tag info, then simply editing the info (putting something in the notes field, for example) would change the hash.

On the other hand, if I were the RIAA attempting to identify common files in this way, I might be inclined to exclude the ID3 tag from the MD5 computation since it is so easily modified.

Any changes to the actual content, though, will ripple into the MD5 computation.

Short answer: "normalizing" the file for volume, or even chopping off a few seconds of trailing silence with something like CoolEdit will certainly change the hash and make it distinct from whatever their baseline hash value is.

Re:What happen if

[1u3hr]

Short answer: "normalizing" the file for volume, or even chopping off a few seconds of trailing silence with something like CoolEdit will certainly change the hash

If that's all you want to do, much better not to use Cooledit, which has to expand and recompress the file to MP3. Use something like MP3Trim which can chop off any given number of MP3 frames, or normalise the volume, by operating on the MP3 directly. Much much faster, and no expand/recompress quality loss.

MD5 Cannot stand up in court.

[Organized Konfusion]

The md5 hashing algorithm has been proven to contain flaws allowing two files to produce identical md5 sums.

Re:MD5 Cannot stand up in court.

[Libor Vanek]

ANY hash can produce same result on two different files since the amount of information in hash is amount of information in files.

Re:MD5 Cannot stand up in court.

[Urkki]

A bit of clarification is in order I think.

First of all it's very clear that two files can give same MD5 checksums. After all, MD5 is only 16 bytes (2^128 different possible). So if you have just 17 byte files (2^136 different possible), it's clear that on average every MD5 sum matches to 256 of all possible files.

It's just damn unlikely to get 2 files with same MD5, and if you wanted to brute force it, you would have to try average 2^64 different files before you found one with identical MD5 to another file. And this would take a long time (actually not that terribly long, a few years at most, and it parallelizes perfectly).

The page you link to implies that it's possible to "easily" fabricate a file that produces a given check sum, so instead of months of processing time, only days or hours would be needed to get a MD5 hash collision.

So all P2P users / software makers need to do to circumvent this, is to agree on a specific MD5 sum, then patch every file so that they produce this same MD5 sum :)

Of course the obivious solution for RIAA would be to use a more secure hash algorithm, with more bits. Unbroken algorithm with enough bits can't be faked, as it would take more than age of the universe to brute force it.

Though the basic problem with this RIAA method remains. If you rip with same software from identical CD digitally, and there are not bit errors at ay point, then you should end up with identical file, and therefore identical hash no matter how secure the algorithm is...

Re:MD5 Cannot stand up in court.

[Urkki]

Imagine two people using same ripper with default settings, and getting tags and stuff from same online database.

Above is not very far fetched, now is it? And result should be identical files.

Re:MD5 Cannot stand up in court.

[ComaVN]

Not to mention one hell of a (de)compression algorithm

Re:MD5 Cannot stand up in court.

[Mechanik]

So all P2P users / software makers need to do to circumvent this, is to agree on a specific MD5 sum, then patch every file so that they produce this same MD5 sum :)

That would totally pooch clients such as E-Donkey that use MD5 hashes to actually figure out which clients have a particular file (whether just a portion thereof, or in their entirety), irrespective of how each individual client may have renamed it.

And trust me, there are fringe benefits to the hashing as well, such as making it apparent when someone is trying to masquerade a file as something that it's really not.

E.g., consider the following scenario...

1. You are searching for Red Hat ISOs.

2. You find a match called "Red Hat.iso" shared from one user.

3. You notice that there are 50 other users sharing the same file.

3. The other 50 versions are named as "Goatse.cx guy and tubgirl together at last.mpg"

4. Therefore, something is very very rotten in Denmark... :-)


Mechanik

Re:MD5 Cannot stand up in court.

[prator]

So its possible that a Britney Spears mp3 and an mp3 of me raking my fingernails across a chalkboard might have the same md5...

Now that I think about it, those two things actually sound alike also. :P

-prator

MD5 Hash

[fruey]

This seems quite interesting but I was under the assumption that identical hashes could be created with identical rips and id3v2 tagging.

The only way for two files to have the same MD5 hash is for them to both be encoded with the same encoder, from the same WAV file, with the same bitrate and all advanced options, and to have exactly the same ID3 information, the same filesize, and to be identical to the last bit.

Otherwise, the MD5 will be nothing like the same, for two perfectly identical songs where one has a spelling error in one field of the ID3 tag. I imagine for any one song, there are many many different MD5sums out there, although perhaps one or another good quality version would exists on hundreds of different PCs...

Re:MD5 Hash

[kzinti]

The only way for two files to have the same MD5 hash is for them to both be encoded with the same encoder, from the same WAV file, with the same bitrate and all advanced options, and to have exactly the same ID3 information, the same filesize, and to be identical to the last bit.

If two people used the same ripping software set to all its default settings (as many unsophisticated users do), got a perfect rip off the CD, and relied on CDDB information for tagging the song, then it's possible that they got mp3s identical down to the last bit, and thus identical MD5 hashes. BUT to make this a plausible defense, you'd have to show that your rip was in fact perfect. In other words you'd have to be able to recreate the mp3 independently. If the old Napster mp3 had any ripping errors, then it would be hard to claim that the later rip just happened to have the same errors - assuming errors are essentially random.

Re:MD5 Hash

[szemeredy]

In other words, every lazy user that downloads lame with a frontend or some other encoder without modifying default settings and that leaves the ID3 tag alone (most use CDDB/Gracenote or freeDB to generate an ID3 tag, resulting in identical tags) will end up with the same MD5 hash when compared to someone else who did the same thing with the same CD. The only ways you're going to get a different MD5 checksum from an MP3 file is by: A) using a different encoder B) using a different version of an encoder C) modifying the ID3 tag D) deleting the ID3 tag E) changing the file name F) modifying the file in an audio editing program Don't forget that the RIAA is probably also using CRC checksums to identify specific albums, as many encoders also support inserting CRCs into MP3s by default (and these will be identical for rips coming from the same album regardless of bitrate)

Re:MD5 Hash

[IRandom]

Yes, but note that just changing the ID3 tag isnt enough since when you calculate the MD5 hash value you can just ignore it and then you will be able to find matches.

Although i wonder, if the WAV files on 2 CD of the same album are identical, the only thing you can prove from the fact that the hashes match is that you made the mp3 file using the same bitrate.
I cant say this is enough information.

BTW: A way to move around having the exact same copyit is by introducing small amount of random changes. one bit is enought the fool the hash

Re:MD5 Hash

[3terrabyte]

Many people will produce a file by ripping straight from a CD, which , given the same CD, will result in an identical source file.

No!! That's definately not true. Making a perfect rip is something you have to WORK at, which not many rippers do. Especially years ago. Check out ChrisMyDen's Uber Network on a detailed guide on how to make the 'perfect mp3'.

You need to use something like EAC's secure mode. It rips the cd twice and compares for exactness. Only then can you be assured your wav file has no errors.

Even if you can convince people to use the best mp3 encoding techniques (LAME 3.92 or LAME 3.90.2 -aps) I have still seen people refuse to use EAC, instead enjoying cdex, audiograbber, or (gasp) jukebox due to 'ease of use'. These ripper DO NOT make perfect rips, and will almost always make a different wav file each time due to the way it tries to make error corrections. Most people will not ditch their source either, even if there are errors. And everyone has a different scratch on their cd's.

Almost everyone encodes at 128kbps

This isn't true anymore either. Considering most of the lazy people out there download mp3's instead of make their mp3's, many of the rippers today do care about quality, and will rip in VBR or at 192. Release groups (where I would imagine most of the new stuff originates nowadays will rip at 192, 224, 256, or 320)

Re:MD5 Hash

[dbs_flac]

As far as I know, you would also have to use the same mp3 encoder as different encoders produce different results, therefore different files/md5sums. I'd also like to throw in flac as that uses a fingerprint, so even if the id3 tag changes, the hash doesn't.

Plumper porn

[Anonymous Coward]

I only trade plumber porn pics. Should I be worried?

but will they target aol/tw?

[Comsn]

The RIAA has said it expects to file at least several hundred lawsuits seeking financial damages as early as next month. U.S. copyright laws allow for damages of $750 to $150,000 for each song offered illegally on a person's computer, but the RIAA has said it would be open to settlement proposals from defendants.

will they start sending subpeonas to aol/tw customers this time?

from the Napster network?

[powerlord]

Gee ... I would have thought that most people had moved on from Napster to BitTorrent, KAZAA or eDonkey/Overnet

Md5 hashes are also used for....

[shione]

hmm Isn't that how k-sig, built into Kazaa Lite K++, works, by tracking MD5 hashes so ppl get exactly the file they want.

Changing MD5 hashes on songs to avoid RIAA would also lessen the effectiveness of K-SIG. Trading hashes of know working files was one of the ways ppl on P2p avoided downloading those fake RIAA files.

Condoning illegal activity???

[Kombat]

Now may be the time to update your illegal mp3 file MD5 hash sums.

I sincerely hope this is tongue-in-cheek. For all the self-righteous, pompous sabre-rattling that goes on in here about how good Slashdotters only possess MP3's that are ripped from personal collections, I would certainly hope that we wouldn't stoop so low as to blatantly and openly be trading tips on how to avoid getting caught doing illegal things.

What's next? A HOWTO on setting up an encrypted file system for our child porn?

Re:Condoning illegal activity???

[PontifexPrimus]

Well, if that's what you're interested in: try this link.
Knowledge in itself is neutral. But it can be used for good or evil purposes. You might want to try, just as an exercise, to imagine five positive and five negative uses of encrypted filesystems or altered MD5 sums.

Re:Condoning illegal activity???

[Anonymous Coward]

I would certainly hope that we wouldn't stoop so low as to blatantly and openly be trading tips on how to avoid getting caught doing illegal things.

Yea maybe its illegal. But imho its NOT ethically wrong. Its kinda like back in time when you had to pay customs for crossing bridges.
For what do we pay the RIAA again? We pay them for maintaining a huge organisation which is dedictated to copy and distribute music. But, eh, we can do this by ourself now...!?

The RIAA was needed before mp3 and there was no other way for artists to become popular blablabla.. they needed the RIAA.
They still do to some extend but only because its the only way to get into the mainstream.

<RIAA> You want to share your songs over the internet? We wont play your songs on MTV then :P

(err, tell me, who causes artists to starve again?)

So i should pay the RIAA for playing stuff in the tv i dont even watch? I dont think so.

And dont tell me all artists will starve. (Ok, Britney Spears would maybe. But I dont give a fuck.)
Artists can still get money from concerts, merchandising etc. - thats where most (non-top10-) artists get most of their money from anyway.
Most of *their* record-sales-profits go to Robbie Williams, Britney Spears & co.

The RIAA is getting obsolete - we know it and and they know it. Now they are trying to survive by all means.

P.S.: Yea, my english sucks ;)

Job opportunities

[Rosco P. Coltrane]

Apparently RIAA has obtained some technical experts in their prosecution of file swappers. Currently they are tracking traded mp3 files from the Napster network by matching MD5 hashes

After all, in these dot-bust days, it's still possible to get a nice highly paid job and be called an expert by putting the right spin to strcmp() in your resume ...

hashes are kinda pointless

[truffle]

It is generally believed amongst file traders that it is legal to download an mp3 for a song, when you own the CD. In other words, you don't need to rip and encode songs from your own CD. However, this may not be true (I am not a lawyer).

The RIAA is using MD5 hashes as a basis for proof that the individual in question downloaded the files they are sharing, instead of ripping them from their own CD collection. This is supposed to show the individual is a willing participant in stealing and distributing music, instead of someone who is just sharing what they already own. But, see above.

I think this is mostly just a FUD tactic. They can talk to the media about how their MD5 hashes prove so-and-so is a big mean pirate hacker. MD5 hash certainly sounds scary, especially when the technology is described by the media as a tool used by hackers.

Pity the RIAA

[heironymouscoward]

They are really fighting a losing battle.

Exchanging music is not about piracy, it is about exchanging culture, just like when my grandfather leant me some old Jazz records and said, "here, you might like this".

Today culture moves at the speed of light and the RIAA believes it has the right to tax this movement. It cannot succeed except by destroying the Internet.

I'm starting to believe, watching this debate evolve over many years, that the file traders are right, for the wrong reasons.

Human culture depends on exchange of ideas and information, and music and films are a large part of this in today's world. No album, no movie scene, no written text is a personal creation, they are all taken from the pool of common culture, modified, and redistributed.

Seeking all means to do this faster than ever - and ignoring the barriers, such as "ownership", that stand in the way - is the prerrogative of today's world. We simply can't put the genie back into the bottle and start exchanging pieces of paper and vinyl discs again.

The debate is huge, but the results already seem clear: any laws designed to stop the process from continuing will be further and further ignored until they are seen by a majority of people to be useless vestiges of a material-obsessed past.

HOWTO: Encrypted partition

[geeveees]

modprobe loop
modprobe cryptoloop
modprobe aes

losetup -e aes /dev/loop0 /dev/hdb1
(input password)

mke2fs -j /dev/loop0

mount -t ext3 /dev/loop0 /home/kombat/pr0n

enjoy!

Where does it say MD5?

[eddy]

Are we sure they're actually using MD5? The article doesn't even contain the string "md5" that I can see. It mentions hashes though, but there's something called Robust Hashing which can be used to identify, or at least, compare content in a "fuzzy" way.

Easy

[sprouty76]

Just take a random id3 field that you don't use for anything, and fill it with a random number. You can probably write a srcipt in a few seconds. Bingo, different md5.

The only problem is that a lot of file sharing software uses the fact that 2 files (from different sources) have the same hash in order to swarm the download from multiple sources. If everybody goes around intentionally making their mp3s have different hashes, swarming basically won't work anymore.

Re:Easy

[3terrabyte]

True. But then again swarming isn't that popular yet. Downloading from a single source is still popular. (IRC, NG's, FTP, most P2P apps)

Also, if we did use a non-used ID3v2 tag field, then the RIAA would just go ahead and ignore that field in their hashing technique, since it's located in a specific part of the file

The problem with letting the whole world know about a technique like that, is that the RIAA is part of that world.

Besides, this whole MD5 checking & database the RIAA may be assembling doesn't really amount to much. It's just an added extra. They can still (and will) go after people who are distributing files. MD5 doesn't matter here.

Give up

[Rutje]

Ok guys.. let's all give it up. Let's delete all our MP3's and start buying CD's now. The RIAA has clearly won!
Hail to the king!

Re:own rip identical to download

[Asprin]

Audio rippers aren't always perfect AFAIK.


... or even competent! How many rippers can't get the tagging right when the song and artist ARE PRINTED RIGHT THERE ON THE LOUSY CD COVERSLIP! Sheesh! Learn the difference betwenn Meat Loaf and Leo Sayer for cryin' out loud!

RIAA Propaganda

[rnd()]

I think this sums it up!

MD5?

[barcodez]

The article does not mention MD5 anywhere. So one can not assume this is the technology they are using in their proof. As the technical information in this article has more than likely gone through several iterations of "dumbing down" we can not say what technology is being used. It is quite feasible that they are comparing segments of the encoded information with files that where groked from Napster (pre 2001). Additionally as very few people change all the information contained within the ID3 tags ("meta information" from the article?) it maybe enough to show how unlikely they are to match unless the file is from the same source. For example if I insert the string "whateverbarcodezwashere" into some obscure tag with the ID3 tag of an MP3 and it arrears in an MP3 file on someone elses computer it is likely that they orginated from the same source. For the record it is conjectured that it is astronomically unlikely that two randomly choosen different byte sequences will produce the same MD5 hash.

Protection

[rf0]

Just change the ID3 tag on all the files and that will break any existing MD5 checksums. Even addiing a capital will do it

Rus

Re:Or Perhaps...

[perly-king-69]

Ummm, I paid for a CD the other day but I want to listen to it on my MP3 player. The CD is copy protected. I run linux. The only way I can listen to it via mp3 is to, yup, download an 'illegal' mp3! Whoever thought that up was a fscking genius.

Stealing means someone no longer has it?

[Lasuuco Tulkas]

Comparing the Brooklyn woman to a shoplifter, the RIAA told U.S. Magistrate John M. Facciola that she was "not an innocent or accidental infringer"

And what, pray tell, did she steal?

How About An MP3 Outguess?

[thecampbeln]

Lets see someone put together an app that flips bits here and there within MP3s to make each one it runs against unique enough to create a new MD5 hash!? (I would, but I can only program in a pseudo-language ;) It could even be as simple as adding in a trailing byte to all of your MP3s, though that could be easily filtered. Hell, if you can hide messages within compressed JPEGs without noticeably affecting their quality, why not do something similar to MP3s just to jack up this sort of tracking!?

Re:Time for a new WinAMP Plug-in

[Gaijin42]

Uh, its not like the hash is in the file. Its computed from the file. You could write something in winamp that randomly changed bits in your music, and that would change the hash, but it would also slowly corrupt your music until you had static.

If the hash is using ID3 tags, you could change some unused field in there, but there would be a much smaller number of permutations available (although probelby still enough to be useful)

MD5 sums and different encoders

[Psyborgue]

Pretty much no rip is identical.

First step: the *.wav is ripped. Using libcdparanoia, which i personally perfer, i find slight variation in size depending on the machine and cdrom drive i rip them on.
Second step: encoding on different machines, with different encoders, using different algorythms, using different levels of floating point precision, on different architectures etc... produces vastly different files.
Third step: sharing. Oftentimes an mp3 is downloaded 99.8% before the connection is broken. You keep the mp3 becuase mp3 is a sequential file format and you only lose a second or two of music. The rest of the file is intact.

Their md5 searching scheme could be circumvented quite easily by changing a comment in the id3 but they could get around that by cutting out the id3 part of the file when they make their md5sum.
The downside to this is that if you are searching for music on something like gnutella by the ***sum, the content would differ and you would not get as many results. Gnutella would not download from multiple sources becuase the file would not have the same signature.
Whatever the case, it is clear that some form of file obfuscation is now needed for safety online. Or we can wait for freenet to mature.

Re:Excuse my ignorance

[tom taylor]

Imagine, the MD5 file as a solution, and the original file as the question. The MD5 file might contain the number '5', but you wouldn't know whether the question asked was 2+3 or 4+1. You do know however that the question wasn't 3+1 or 2+2 though.

If you download the question, you can check that the solution matches the expected solution. If so, the download is good.

Note, this is a very simplified version, using a pretty poor analogy. I'm sure there's a website that explains this better.

Protection

[t_allardyce]

What good evidence destroying/hiding mechanisms are there around? Apart from deleting and overwriting the area several times? How about something that can kill the hard-drive even when the computers off? I see crime scenes on the news all the time with police carrying out computer cases for examination - it always struck me that you could fit tamper protection in your computer - any attempt to move it, open the case or anything with out proper authorisation would cause the hd to torch its-self, this could be as simple as a battery inside with enough power to boot the machine quietly and very quickly destroy the data, the police would have no time to stop it, while all this is probably illigal itself, it could be better than being sued for $50000 per song or whatever their price is?

I hope the next kazaa lite comes with file altering/deleting/anti-riaa utilities :)

Re:Now what?

[utlemming]

No, we need to create a honeypot farm. You remember that article way back when on Slashdot? It described how to implenent a whole farm. Then we strictly prohibit scanning of the networks for MD5 checksums. Since RIAA is using bots, they won't read the warning and fire off the subeona. When you get a subeona, then you slam them with a computer crime lawsuit. See, you can still get rich from RIAA. But how do you get illegal MD5 check sums with out possesing the files? If you wanna screw with RIAA you have to be damned sure that you right.

From the Napster Network??

[re-Verse]

From the NAPSTER network??? This is worse than i thought - it appears the RIAA has built a Time Machine! Next they will be going further back than napster andprosecuting free-thinking pilgrims who would share their newspapers.

Yikes.

A problem with this

[DrXym]

Hashing is used so you can download the same song simultaneously from multiple users. If everyone has different hash keys (e.g. by scewing with the ID tags), it defeats the point of most P2P.

I suppose that (if its possible) you would either want to swamp these guys with false positives, or distribute the hash keys and the files somehow to make it more difficult and protracted to discover who actually owns that file.

I suppose that one viable option in P2P would be a freenet model where downloading involves a number of encrypted hops between peers to search or get the data, and where peers cache popular data and indexes in encrypted form. It would be much, much harder to figure out who shared that file then.

Obviously there is a trade off going this route. You wouldn't want the sluglike performance of Freenet so it would not be as secure, but I'm sure you could reduce the number of hops and other measures and still make life massively more difficult for RIAA and their ilk to track down your activities.

Re:Excuse my ignorance

[jacksonyee]

You're right in that it is possible to have the same MD5 sum for multiple files, but the chances of it happening is extremely small for two reasons.

The first reason is that MD5 has 128 bits to describe the file, meaning that there is a 1 in 2^128 chance that any given random bitstream will have the same MD5 sum (Of course, MP3s aren't all that random in portions of the file format, but the basic argument still stands).

The second reason is the very process of verification. In order to verify a file, you must already have a checksum of the original file to compare it to, and you have a file which you think could be the same file, meaning file names and file sizes are already identical. If those files differ by as much as one bit, then they will produce different checksums. If you're willing to try to match a file named "ISO of Windows XP" with a file size of 650.1MB versus a file named "ISO of Mandrake" with a file size of 643.8MB then you're already sure that they're not the same file by the filesize alone.

In short, possible, but extremely unlikely.

Similar story on BBC

[SuperChuck69]

http://news.bbc.co.uk/1/hi/entertainment/music/318 7695.stm

Virus

[MikeHunt69]

Maybe someone should write an email virus that listens on the Kazza ports and reports back gigs and gigs of shared mp3's to anyone who asks.

Then, when people get busted, they can say "It was a virus".

Of course, this would make the search feature of Kazza useless...

No one knows

[jcsehak]

From the article:
Copyright lawyers said it remains unresolved whether consumers can legally download copies of songs on a CD they purchased rather than making digital copies themselves.

So it's still up in the air. But here's where I get confused:
For example, the industry disclosed its use of a library of digital fingerprints, called "hashes," that it said can uniquely identify MP3 music files that had been traded on the Napster service as far back as May 2000.

By comparing the fingerprints of music files on a person's computer against its library, the RIAA believes it can determine in some cases whether someone recorded a song from a legally purchased CD or downloaded it from someone else over the Internet.

Okay, how? Only way I can see is if they have a HUGE-ASS library of mp3s downloaded from Napster that they can check every file against. Seems unlikely that "nycfashiongirl's" copy of "Beat It" would match exactly with one in the RIAA's library.

The recording industry also disclosed that it is examining so-called "metadata" tags, hidden snippets of information embedded within many MP3 music files. In this case, lawyers wrote, they found evidence that others -- including one user who called himself "Atomic Playboy" -- had recorded the music files and that some songs had been downloaded from known pirate Web sites.

Now it's making more sense. I don't think they're using hashes at all. I think they're checking the ID3 tags for stuff like "ripped by 4t0m1c P14b0y - www.atomicplayboy.com."

So really it should read something like "Using a surprisingly astute technical procedure, the RIAA examined song files with an advanced file analysis application, iTunes, and found evidence of references to Atomic Playboy." The article of course, doesn't mention whether it was possible for them to plant the evidence, which it would've been if they were simply allowed to possess her hard drive and weren't required to make any backup copies for the judge.

Of course, if, in her defense, she counters with "well yeah, not all of them were ripped from the physical CDs, lots of times I'd want to listen to one of my CDs, and I couldn't find it, so I'd just download it -- but here is my CD collection for evidence, your honor," then there's going to be an interesting precedent set -- is it okay to download songs that you already own on CD?

Also, she's in court not so much for downloading, but for uploading, which is much more of a crime (have they even sued anyone for just downloading yet?), and it really doesn't matter where she got the songs, just that she was sharing them.

What is illegal here?

[emptybody]

If I use KaZaa to access indie artists who are
sharing their songs - as is their right - AND I
also rip my entire 1000+ CD/LP/8track collection
to the same computer AND I intellegently store
all the files in the same heirarchy.

Have any laws been broken?

KaZaa is configured to share everything in my
heirarchy so that the indie songs can continue to
be shared.

Have any laws been broken?

I go in for Jury Duty, meanwhile Another Kazaa
user downloads the indie shared files.

Have any laws been broken?

Another Kazaa user downloads the rips from my
personal collection because their 8track player
is on the fritz.

Have any laws been broken?

Another Kazaa user downloads the rips from my
personal collection because their LPs were
destroyed in a flood.

Have any laws been broken?

Another Kazaa user downloads the rips from my
collection because they want to see what the
latest Madonna single sounds like before going
out and buying the CD.

Have any laws been broken?

If any laws were broken here - who broke them?

Just because I leave the front door open does not
mean that anyone can enter and take what they
want from my house. Same as my computer.
The action of downloading is at question not
making the article available.

YMMV. Consult a lawyer.

Re:What is illegal here?

[kennylives]

Just because I leave the front door open does not mean that anyone can enter and take what they want from my house. Same as my computer. The action of downloading is at question not making the article available.

Nonsense.

To use your analogy, if you leave the front door of your house open (while you're away), you should expect that someone will come in, and if you're lucky, take something.

Your situation gets significantly worse if you have, say, a handgun under your pillow, and some random neighborhood kid comes in, finds it, and shoots himself (or someone else).

The issue here is that you've knowingly left your front door open, making you at least partially liable for the harm that occurs as a result (indirect or otherwise). Same thing if you leave the keys in your car and someone takes it and mows down a bunch of pedestrians with it. In either case, you cannot claim innocence simply because you didn't do the deed. You've made a substantial contribution in the commission of a crime, and you would be expected to pay for that crime.

Re:What is illegal here?

[jhines0042]

Lets say that you buy a book.

You then make a photocopy of the entire book.

You take that photocopy around with you to read leaving the original at home.

Now lets say that someone breaks into your house while you are home and steals your photocopy leaving you your original (it was locked up in a safe for example).

The crime in this instance is two-fold. Breaking and entering, and copyright infringement. Who is responsible for the copyright infringement? You are.

Now lets remove the breaking and entering....

You put a table out in your front yard by the sidewalk with a box of paper that happens to be photocopies of books with a sign that says "Free to a good home".

Now the crime is just copyright infringement.

If the author of the book had given you permission to copy their work, then there is no infringement.

Joe H.

Re:What is illegal here?

[retards]

Same thing if you leave the keys in your car and someone takes it and mows down a bunch of pedestrians with it.

Do you live on another planet? Those aren't laws I ever heard of.

Everywhere I ever heard of there is nothing illegal with leaving keys in a car. Perhaps someone can sue you for negligence in a civil suit, but that doesn't mean they will win.

And you can ALWAYS claim innocence, even if you shot someone through the head with a tank on national televison.

You've made a substantial contribution in the commission of a crime, and you would be expected to pay for that crime.

Idiot. What about:

Trial by jury

Innocent until proven guilty

Interpretation of law

Special circumstance

Spirit, not word, of the law

There is no black-and-white rule that specifies when a person is negligent enough to be deemed guilty by default, at least not one I heard of. Except maybe anti-terrorism laws...

Re:What is illegal here?

[IthnkImParanoid]

What are you on?

There are few people I know that lock up every door and window before they leave the house (I live in a small town). I've been to rural areas where people leave their keys in their cars. In both cases, there is no expectation of B&E or theft.

If a kid enters my house, finds a gun (that's even hidden in your example), and shoots themselves I am not liable. If someone steals my car I am not liable. Negligence is leaving a loaded gun on the front lawn. You cannot be negligent just because you didn't lock down everything you own with multiple locks, razor wire, bio-hazard signs, and 6 dozen pitbulls.

I wonder...

[assaultriflesforfree]

From the article:

By comparing the fingerprints of music files on a person's computer against its library, the RIAA believes it can determine in some cases whether someone recorded a song from a legally purchased CD or downloaded it from someone else over the Internet.
... Copyright lawyers said it remains unresolved whether consumers can legally download copies of songs on a CD they purchased rather than making digital copies themselves.

So, the RIAA has been downloading illegal copies of music for years, in fact probably has a huge library of music. Simultaneously, in their broad sword efforts to completely end p2p, they're arguing that it's illegal to download songs you've already bought. So, even if the RIAA has gone through all the hoops with this library, obtaining licenses for each song they swiped off of file traders in their investigations-- which I doubt; recall Microsoft's slip ups-- they're arguing that the methods they've been using to track down illegal file traders are actually illegal themselves! In fact, the RIAA might have the largest collection of illegal music of anyone, even larger than mine! Of course, this should come as no surprise, after all of the attempts to make it legal for them to attack suspected infringers PC's, it's pretty clear that the RIAA's privilege and property makes them above the law.

P2P modifying files..

[bobthemuse]

How long is it until a P2P client is created which appends a half second of noise to the end of everything you download, thus modifying the checksum?

I can see it now... "And in recent news, according to the RIAA there are over 10 billion songs being traded. The organization is quoted as saying 'We intend to sue individual users for having more songs than we've created...'"

How RIAA tracks downloaders

[$exyNerdie]

Revealed: How RIAA tracks downloaders


(Music industry discloses some methods used)

A failure to comunicate

[MarkusQ]

There is an interesting pattern here:

• Some one comments that the IP laws have not kept up with technolgical and social change, and that they are now impeding the cultural goals they origonally served. They may have made sense when we were limited to exchaging physical objects, but they don't make sense now.

And the responses are allong the lines of:

• But it's the law.
• I hope the RIAA gets you.
• Then I suppose an idiot like you won't mind if I take your stuff!

The respondents are completely missing the point. To see this, imagine what the discussion might have looked like if it had happened way back when:

• The rule about not eating X hasn't kept up with the times. It made sense when we didn't know about the parasites, but now that we know how to clean and cook them it doesn't makes sense.

I suspect the responses would have been along the lines of:

• But it's the law.
• I hope the gods get you.
• Then I suppose an idiot like you won't mind eating dog poop!

Every time I see this played out, my response is, "Gee, IP law really is dying, isn't it?", with the same sort of awe I had watching little bits of sand wash downstream at the bottom of the grand canyon.

-- MarkusQ

Re:A failure to comunicate

[MarkusQ]

1. You keep saying that you are interested in a "capitalistic" solution, yet your entire argument seems to be based on the communist principle of "from each according to his abilities, to each according to his needs." You even seem willing to go down the path that all communists eventually follow, arguing that the government should make stricter and stricter laws and (if needed, back them up with force) to make sure that your system "works."

2. You are assuming what you are trying to prove.

   You claim we need IP laws because... You claim without them people would stop creating because... You claim the only reason people create is to make money and... You claim that people can't make money without IP laws, which I am supposed to accept because... You claim we need IP laws.

I dispute 2 & 3; I hold that the urge to create is a fundemental part of what it means to be human, as is the urge to copy/immitate others.

I dispute 4 because people (such as game designers, cooks, fashion designers, etc.) make money off of goods (games, food, clothing) which are not covered by IP (excluding trademarks, as I did earlier).

I have worked in the game industry for over twenty years, and in all that time I have never seen IP laws successfully used to defend a company like SJG, but have seen several cases where they were successfully used to attack one.

[ As an aside, I was one of the people who wrote a letter in support of Steve when he was raided by the FBI years ago. ]

As for IP laws being the cause (rather than a consequence) of the wealth of creative output, consider. In a state of nature, man copies what he sees others doing. It is a basic part of our nature. In a creatively impoverished environment, there is the risk that there may not be enough templates to copy, because only a few people are innovating in any given area, and they may elect to hide their discoveries. So society offers a bargin: they will prevent the natual copying for a limited period of time, in exchange for the disclosure of new discoveries / inventions. This is the basis of all IP except trademarks.

As society grows larger, richer, and more diverse, the supply of templates rises rapidly. If all parties adhered to this "fair trade" and the growth arose from the IP laws (as you suggest), we should expect the price (length of IP terms, etc.) to drop as the supply increased and the demand remained relatively constant.

If, as I maintain, causality goes the other way and the natural growth of society's creative output (which has made IP increasingly lucrative is) instead driving IP laws, we should expect the price to rise--and this is in fact what we see.

-- MarkusQ

Re:Why MD5?

[naph]

i think that's the point. they can look at files on P2P networks and look at files on peoples hd's and try and match md5 sums.

they're only likely to match if they're from the same place. hence illegal copies.

It's possible

[Zog The Undeniable]

There are many different MP3 encoders, and they produce slightly different results. In addition, some shared MP3s are also imperfect in that they contain clicks and "dropouts", although this is becoming less common now that PC power has increased - my understanding is that using the PC for other activities while encoding can occasionally cause errors .

The ripping stage can also produce slightly different checksums, depending on the condition of the CD - Audiograbber actually reports "potential speed errors". Unlike data CDs, some level of read error is considered acceptable on music CDs; you don't want the player to keep re-trying a bad sector if it detects a big problem - it would ruin your listening pleasure!

Those poor lil Country Music singers

[CoryS0L0]

The same story is posted on CNN.com. Accompanying this article is one by Marci A. Hamilton, a chairman at Benjamin N. Cardozo School of Law, Yeshiva University. She states that going after students who illegally download media is not only OK, but is RIGHT. I wouldn't have a problem with this were it not for the reasons she supports it with. She says that a world without copyright laws would cater only to the rich and the government. When was the last time you heard of a government worker writing a song on the top 10 list? When was the last time a millionaire, (not a musician) created a song that made it to the hall of fame? My point is, without free music/media, many of the people who come up with the latest and greatest entertainment would never see any of the media that's out there. Marci claims to be looking out for the poor country music singers in her article. If they're as poor as she says, how are they ever going to be able to afford a CD at $15 a piece???

Musicians and music labels alike need to come to grips with the fact that their moneymaker, (CD sales) will need to take a back seat to actual performances by the artist. We need to take it back to the old days when music artists actually sang and performed and didn't just sit in a dark room behind some curtain tooling away on their synthesizer.

http://www.cnn.com/2003/LAW/08/07/findlaw.analysis .hamilton.music/index.html

Music Hashing with musicbrainz

[ramk13]

With all this hash talk going on, I thought I'd mention that Musicbrainz uses some sort of similarity hash in identifying songs. It compares the hashes of the files you have to an existing user submitted database. If the match is good, then you can use the database tag info, which is pretty handy.

I've compared albums I've ripped myself to the database and gotten "100%" matches (along with some matches of a much lower percentage) That leads me to think that if the RIAA kept its own database like that, they could do a whole lot of comparison with similarity or quasi-unique (ala MD5) hashes. I'd also venture that, with enough work at the comparison system, they could make court-valid assertions. They can hire plenty of geeks to handle the statistics necessary to call something 'beyond a reasonable doubt.' (for criminal proof)

What nobody seemed to notice.

[Awptimus Prime]

The MD5 thing isn't for tracking the same song ripped by different people. The thread on this, so far, has left me scratching my head as to why folks feel the need to restate that encoding an mp3 with different settings/software will result in a different md5. Right, this is slashdot and we all know this already.

The reason for md5 matching is so they can nail someone as the 'origin' of the ripped song, then hold them liable for all the copies of a matching md5 on P2P networks. It would be more a demonstration of "look how much damage one copy did to us!".

Re:What nobody seemed to notice.

[senzan]

Excuse me if this has already been covered but if all the rips have different MD5 hashes then all are from unique users who have the disc. So is it possible to modify each mp3 to have a unique md5 hash or as unique as possibe. Thus negating the argument and problem of all copies from one user. Just a thought.

Nowhere in that article do they mention MD5

[JPelzer]

I believe what they are referring to is a system that takes a sample of a song (let's say 30 seconds) and generates a 'hash' based on that... The thing about this system is that it is a loose hash, meaning that changing one bit does NOT necessarily change the hash. It is a sonic fingerprint (Not in the digital watermark sense), so that in theory if you had a direct CD-ripped wave, and an analog rip from a cassette as a wave (for instance), you could match the two files, even though they are FAR from bit-for-bit exact.

This is what they mean when they say hash. NOT md5. Obviously MD5 could not track an mp3, since changing even one character in the ID3 tag would change the whole hash.

So they probably have an automated downloader that then generates a fingerprint from the downloaded file and compares it to a db of fingerprints to determine if the song is copyrighted. I'd bet that's all.

Lost in a Fire?

[medscaper]

A couple of years ago I lost 90% of my CD collection in an apartment fire. I had about 20 of these CDs ripped at the time and since then, I have downloaded many of the others to replace what I had paid for.

Just out of curiosity...Did you have insurance? Did they write you a check for the CDs you lost in the fire? I doubt it, but if it had happened, would still feel you had already "paid for" the CDs, and simply thumb your nose at the RIAA and Big Insurance and download the files, as you'd already "paid for" them?

I promise, I'm not begging to be flamebait. I'm really curious.

Where does the line get drawn between physical property and intellectual property, and what rights do you have if you HAD purchased it, but it's gone now? I mean, I can't go to the lot and get another car because mine is destroyed in a fire. Of course, I could go take a picture of it...but I could do that anyway.

I'm curious.

Re:Lost in a Fire?

[nearlygod]

No, I did not have renter's insurance, so it was a complete loss for me. If I had been reimbersed, I would have likely re-purchased the CD's that I wanted most and forgotten about the ones that I seldom listen to. This brings up another question/issue. Before the fire, I could have made backup's of every CD that I had. Then after the fire, I wouldn't have lost anything audiable, just the physical packaging. However, after the fire, it was too late, but couldn't I have considered napster to be my backup. Since I could readily download a CD when ever I wanted, why make a backup of it?

Re:Lost in a Fire?

[Dirtside]

I mean, I can't go to the lot and get another car because mine is destroyed in a fire.

The obvious difference is that if you download a copy of the CD, you haven't deprived anyone the use of the data you've downloaded. If you take another car, you have deprived that car's use to anyone else. (Similarly, if you copy a song from Bob, you can still both listen to it simultaneously. If you take Bob's car, you can't both drive it at once.)

Michelangelo's David

[heironymouscoward]

An excellent example.

The statue sits there, the result of laborious work by its creator (made possible thanks to a decade of training at the hands of other masters, but that's another story).

Now the statue is in the hands of a private collector who charges people to view it. He claims he owns it, but the state decides that the statue is far too important. They buy it, and put it on public display. Now everyone can see it, be inspired by it, make rough imitations, photos, even tiny or full-scaled replicas.

Which is preferrable? Which results in a better and richer culture?

Clearly no theft occurs by looking at the statue, except that the original owner cannot claim his viewing rights any longer.

This is the best metaphor for digital culture. totally intangible, yet very important. The discussion of "rights" and "theft" and "ownership" is meaningful only insofar as the direct artist is concerned. All other parties are unavoidably biased, and finally it is the common interest that must prevail.

It is clearly impossible to restrict all creations to "pey per view". Impossible and stupid, for people will simply turn elsewhere and make their own, or steal to view. Culture does want to be free, as you know very well because you are here on Slashdot, proving that point exactly.

Comparing Kazaa users with suicide bombers, burglars, and corporate thieves is fanciful slander, and you know it.

Anyone thought of setting a honeytrap for RIAA?

[linuxbikr]

I was under the impression that MP3 (MPEG-1, Layer 3) was a lossy algorithm. Even with the same ripper settings working off the same stored raw CD audio file, will it actually produce identical output? Can the MP3 encoder drop different bits as irrelevant on different passes in time on the same data with the same settings? If this is indeed the case (I don't know, I am not familiar with the detail of the algortithm), then MD5 sums become a virtually foolproof way to identify a file since an identical sum can only be produced from the exact source MP3, not one that is close. Just a thought on that matter. And a second point, more of an idea really... Has anyone thought of trapping RIAA? Here is my proposal... 1) Go and buy 50-100 CDs from your local music stores (I know, this is abhorrent since you are lining the pockets of the people you want to fight but it is a means to an end). SAVE ALL THE RECEIPTS! You will need these. 2) Download a popular P2P program and sign on. 3) Go download crazy and download an MP3 for EVERY SINGLE SONG on the pack of CDs you just purchased. Be obviously, be a bandwidth pig, get somone's attention. 4) Take screenshots and printouts of the directories containing your "booty". This will establish the timestamps of when they were downloaded. Sign and date the screenshots, preferably with witnesses who sign them as well. 5) Wait for a supoena from RIAA. 6) Join RIAA in court and argue "fair use" by throwing up your stack of legally purchased CDs and the receipts for them clearly indicating that they were purchased PRIOR to the supposed infringement and you were simply wanting MP3s of CDs you own but lacked the knowledge/skill/time/tools to rip them. Is such a case copyright infringement? It's a dangerous game to play because the fair use doctrine has been supported, it is not a matter of law. The outcome could be undesired because it could cause a rethinking of what constitutes fair use. The fun part of such rethinking could be the broadening of what is considered infringement into areas where it was not infringement and ignite an absolute firestorm.

'Fair Use' isn't the same as 'reasonable'

[turnstyle]

The 'Fair Use' stipulated in US Copyright law has nothing to do with making copies of music.

Fair Use is about the right to quote portions of one work within another, as a means of making commentary, criticism, or parody. See Standford's explanation or Title 17, Chapter 1, Section 107 of the Copyright law.

You might argue that it's 'reasonable' to download an MP3 file that corresponds to a track from a CD that you own, but it's simply not 'Fair Use'.

RIAA Taxes

[brj]

Don't we already pay a small tax to the recording industry every time we buy blank audio CDs (but not data CDs)? I'd like to see some lawyer fight a case claiming that a P2P user has already paid the RIAA and is therefore exempt from their lawsuits when downloading the music and burning it to an audio CD. That would be an interesting lawsuit.

Re:The problem is

[nearlygod]

Although I may not have said it as well as I could have, that is the basis of my question. If the RIAA continues to make copyrighted CDs and shuts down P2P services, what am I to do when I have a damged disc. I could make a backup even though I am entitled to one and I can't grab the files off of P2P because no one will give me access to the file out of fear of being sued. Now the RIAA can start making disc more fragile and easier to scratcha and I will be forced to buy the same disc over and over during the course of my lifetime. But I just want to listen to the damn song. Isn't it great to be a consumer in America?

Hashes and Compression

[buckhead_buddy]

Hashing and compression aren't really my thing so maybe someone could clarify my understanding.

I was under the impression that hashes are not reversible like compression algorithm's are, but that they try to add as much chaos between slightly different variations of the original. (The same way the telephone company racks up money by having area codes be very distant from each other; a typo in the area code probably means big bucks for a wrong number)

My spreadsheet of 1997 budget information could produce the same hash as a RIP of Meeco's Star Wars disco theme remix, but it would be unlikely to produce a hash similar to my 1996 budget information (which is practically the same other than 1996 being 1997). None of these would ever compress to the same result using a loss-less compression scheme (or they might be in for a surprise when they uncompressed their Mecco track).

Producing a unique result for each file is what a compression algorithm does. If a hash were truly unique and reversible then you'd have a compression algorithm, right?

Now to make this relevant to this case...

Could someone make a MP3 from MD5 generator? It'd create an MP3 with the goal of having exactly the same MD5 hash as the original song. Admittedly it'd probably sound like a confusion of radio static and Husker Du. Not anyone's cup of tea to listen to probably, but it might wind up being just the sort of edge case to make MD5 hashes insufficient evidence in court (especially if the defendent had a nose ring). If this isn't possible, then perhaps it could make a JPG from MD5 generator? Visual noise is much more appealing to many than auible noise and probably easier to create.

Ripping process differs

[BestNicksRTaken]

Everyone is missing the point here with the MD5 hashes.

OK, if you use the defaults in your MP3 encoder, and the ID3 tags from CDDB the *encoding* would be the same, but not the end file. Know why?

The rippring process differs greatly - you've got things like scratches on discs that some CD-ROMs will pick up as errors and some won't, you've got pauses due to slow processor/HD on different computers etc.

The only way I'd say to get an identical file would be to rip it using the same computer, encoder and CDDB - in which case "Jane Doe" must have been the original producer of the Napster file if the KazaA one matches it (or she copied it from someone else).

She's guilty as Hell, but personally I support her as the RIAA/MPAA are scum.

What were they thinking?

[ewn]

Maybe they're speculating that the jury will immediately succumb to the magic word 'hash'.

But otherwiese, frankly, i don't see what this could be good for. Hashes (whether MD5 or SHA or some other algorithm) don't prove a thing.

Identity: The identity of the hashes of two MP3s only provey that the MP3s were encoded with identical settings from an identical CD source. If two people, one in NY the other in LA buy the latest Red Hot Chili Peppers album and rip and encode it both on Windows machines using identical versions of RealOne (or any encoder) then the resulting MP3s will have identical hashes. Whether the probability of two different files accidentally having the same hash ist 1 in 2 or 1 in 2^127 is absolutely irrelevant here. The chances of two people using the same software with the same CDDB information to rip the same track from a CD that sold a million copies is a lot higher. Everybody with a half episode of Matlock legal expertise will tear the RIAAs position apart on this ground.

Trackability: Hashes cannot be used to reliably track the path of copies across P2P networks either. Since the hash is more sensitive to minor changes than the ear doing random changes to the ID3 tags or randomly changing a bit or two somewhere in the MP3 will wipe the tracks.

So two files having the same hash doesn't prove they come from a single origin. Two files having different hashes doesn't prove they don't come from a single origin.

Hashes don't prove a thing

Missing the pragmatic point

[Mryll]

Remember that the MD5 hashes are the values used by popular P2P software to enable synchronized multi-source downloading of a file. If everybody "sharing" modifies files to affect MD5 hash values, then the P2P networks essentially fall apart into single source FTP-like downloading.

Almost, but not quite

[Fareq]

If you accepted insurance money for the CDs, then, while the license to listen to the music still exists, you have transferred it to the insurance company who paid you.

If you total a car, the insurance company will give you X dollars and TAKE AWAY YOUR CAR.

When you buy insurance, you are buying a guarantee that, in the event of loss/damage, that the insurance company will buy your stuff at a "fair" price.

Re:MD5 hash "posers"

[eric76]

Wonder if there is a utility for generating files with random content, but with the same hashes as another file?

Perhaps a reverse md5 hash generator which takes a hash and generates a file.

If that were possible, it would destroy the value of an MD5 hash immediately and everyone wouild quit using it faster than you could blink.

The purpose of CRC hashes is entirely different. They are designed to detect a burst of bit errors in a stream of data, the type of error that is most likely to occur in a network transmission. They are not meant for fingerprinting files.

I doubt that anyone with any degree of sophistication in cryptology would attempt to use CRC and MD5 hashes interchangeably.