Clay Shirky: RIAA Succeeds Where Cypherpunks Fail

scubacuda writes "Clay Shirky has an interesting take on encryption: 'The RIAA is succeeding where the Cypherpunks failed, convincing users to trade a broad but penetrable privacy for unbreakable anonymity under their personal control. In contrast to the Cypherpunks "eat your peas" approach, touting encryption as a first-order service users should work to embrace, encryption is now becoming a background feature of collaborative workspaces. Because encryption is becoming something that must run in the background, there is now an incentive to make its adoption as easy and transparent to the user as possible. It's too early to say how widely casual encryption use will spread, but it isn't too early to see that the shift is both profound and irreversible.'"

Comments

Seems obvious.

[Violet Null]

The Cypherpunks never went around suing people (that is, actually costing them money) who weren't using encryption to mask their illegal activities. The RIAA is.

Real world practicality will always be a much better motivator than abstract idealism.

Re:Seems obvious.

[jaxdahl]

Or just boycott the RIAA and be a good guy and support cheap music, not downloading music you don't own. Or learn how to make your own music.

Cypherpunk is a stupid name

[ObviousGuy]

No wonder no one was taking their advice.

Encryption is good, as long as the people using it are good. When people use encryption to hurt other people, it becomes a serious liability.

Re:Cypherpunk is a stupid name

[sqlrob]

Encryption is good, as long as the people using it are good. When people use encryption to hurt other people, it becomes a serious liability.

Well, DUH, it's a tool, nothing more.

You can say the same about cars, knives, guns and just about anything else.

Re:Cypherpunk is a stupid name

[warpSpeed]

Encryption is good, as long as the people using it are good.

Encryption, like all technology, is amoral.

Good and evil come from people. This is ultimatly where most legislation fails at stopping evil. You legislate away the technology that evil uses in the hopes of stopping it. However, evil rarely follows laws. So the laws are draconian to compensate for evil not following thems. The end result is that good does not benifit from said technology while evil thumbs thier nose at good.

Encryption will be used for evil, regardless. If you do not outlaw it then the playing field will be level.

Re:Cypherpunk is a stupid name

[Anonymous Coward]

Encryption, like all technology, is amoral.

Technologies like weaponised anthrax?

Well, yes. Anthrax in the hands of the "good guys" will be used to do research on how to prevent fatalities in the event that one of the "bad guys" tries to use it.

Get it?

Re:Cypherpunk is a stupid name

[warpSpeed]

Technologies like weaponised anthrax?

A weapon can be considered technology, and it is still amoral.

A Weapon and/or technology, can only be put to use by people for thier own purpose, good or evil.

"Outlaw guns and only outlaws will have guns", etc... Look how well outlawing guns in Washington, DC has worked.

Weaponised anthrax could be put to good use, such as using it to find an antidote to protect people from it.

Re:Cypherpunk is a stupid name

[mpickut]

Encryption will be used for evil, regardless. If you do not outlaw it then the playing field will be level. Who says we want a level playing field? We're not playing D&D here -- this is real life and there is no great balnce between Good and Evil that has to be preserved. Evil for lack of a better term is always bad and society depends on those doing evil to not be on even ground with the law in order to protect the rights we all hold dear. So yes -- encryption is amoral, but that just means that the forces of good need to be that much better at it. The problem is that evil is almost always better motivated because in our society no good deed goes unpunished. Generic Sig -- compare and save!

Re:Cypherpunk is a stupid name

[lynx_user_abroad]

Who says we want a level playing field?

Well, you do (for one), or at least you would if you thought things through.

Almost no one whom you'd consider to be "Evil" considers themselves to be evil. And they would likely tag some people as "Evil" even if you would disagree with their assessment. And almost no one would agree with you on what is good and what is evil completely. To do that, they'd have to be you.

Which means that if the world were to function by your own self-centered definition of good and evil, you'd be all alone.

Nature itself doesn't have a concept of good or evil. Which means regardless of wether we'd each want a level playing field, it's ultimately a level playing field on which we must play.

Evil for lack of a better term is always bad and society depends on those doing evil to not be on even ground with the law in order to protect the rights we all hold dear.

Now "society" is just one of the teams on this playing field; a big team, I'd admit, and one you're likely so familiar with as to believe that no others exist, but it's just a team nonetheless. As you point out, your society has created your society's laws and has it's own interest in seeing that people on any other team are placed at a disadvantage. After all, it has to protect those "rights" which your society holds so dearly.

Is it possible that members of some other society might have their own values, profess their own beliefs, and institute their own laws to protect the rights they hold so dear? Some of these might conflict with the values, beliefs, and laws of your society; does that make them "Evil"?

Only a troll would believe so.

Yet even at this point, we're making a judgment call saying that one kind of "society" can be more "good" than another in a way that a "non-society" could never approach. That's a widely held belief, but there's still a lot of time left on the clock. Maybe Douglas Adams was right and some day we'll decide that even the trees were a bad idea, and we should have all stayed in the oceans..."

If you continue to insist that the playing field be tipped selfishly in your favor, then you must admit that, over time, more and more people will become aligned against you in their own self interest. Each time you exclude someone by calling them (or their team/society) "Evil" you build a greater force which sees you the same way. And the stronger you hold your beliefs, the more motivate they are to hold theirs.

The problem is that evil is almost always better motivated because in our society no good deed goes unpunished.

I could not possibly have said it better myself.

Re:Cypherpunk is a stupid name

[mpickut]

Rather than get completly off point let me say this:

You are completly correct if good and evil are relative terms that represent no real values.

However, the very fact that you are trying to convince me that your point is more 'good' than mine tells me you don't agree with that fact. Your use of terms with values attached such as troll and selfish defeat your own argument.

Please understand that I do not mean that believing in good and evil gives one the right to crush what is considered evil by any means available. Nor may we or must we make value statements about every event and cultural norm or mores -- that is just bigotry. One cannot take the missuse of the belief of good and evil, however as an argument agianst thier existance as a real things.

With that said I do not want a level playing field: I do not want cops to be on a level playing field with criminals (I want criminals locked up and cops paid well) and I do not want to be on a level playing with theives (I will lock my doors).

My point is simply this: if we are convinced that something is right (good as opposed to evil) the only way that we will fight for our beliefs is to be better at using the tools good and evil have in common. One will never succeed by whining and complaining -- don't get mad, just get better educated.

Is it still a sig if it just says:Blah, Blah, Blah

Apple, meet Orange

[Squideye]

Before I read the article, I'll just point out that the Cypherpunks' "eat your peas" approach actually gives the users control over how their anonymity and security takes place. Sure it gives you more responsibility -- you have to buy the locks yourself -- but it also gives you control over how it happens. You basically only have to trust the person who made the lock, but you can have the blueprints so that you know it works.

RIAA-style privacy is basically a Housing Company telling you that they'll take care of everything, and that you don't need to worry because you're probably safe. Note, of course, that the RIAA companies are the types whose security has been foiled by such stunning feats of ingenuity as writing on a CD with a magic marker, or an algorithm written by a 16-year-old that can be implemented using as much space as fits on the side of a pencil.

What the RIAA gets people to adopt is the style of "no-brainer" security people are used to when they get their lockers broken into at the gym, as opposed to asking us to take some frickin' responsibility for ourselves as the Cypherpunks would urge.

changing laws

[toasted_calamari]

from the article:
to a first approximation, every PC owner under the age of 35 is now a felon.

This may or may not be an exaggeration, I have no idea, but Shirky makes a good point. When the vast majority of a society is violating a certain law, it is a sign that the law, not the society needs to change.

At this time, it seems that the RIAA is winning, and we are moving inexorably towards a world where large corporations control what people do with there computers. However, because there is so little popular respect at the moment for copyright law, it follows that eventually those laws will change.

Over the next 5-10 years, I predict that many laws will be completely rewritten to better accommodate the changes that the internet has brought upon society. Many of these changes will be for the better, and the end result will almost certainly be a more free and open society. Unfortunately, democracies are slow to act, so there will be years more of legal confusions and abuses of power before things finally straighten out.

Re:changing laws

[Jafafa Hots]

I wish I could be as optimistic as you... but personally I think we'll have a "War on Piracy" to go with our "War on Drugs" rather than more sensible laws.

Re:changing laws

[multimed]

When the vast majority of a society is violating a certain law, it is a sign that the law, not the society needs to change.

This is certainly an excellent rule of thumb and our legislators should follow popular opinion to laws or at least in theory, they won't be re-elected. Just keep in mind that this is concept should never be taken as an absolute. The Founding Fathers were concerned with what the potential for what they called "tyranny of the majority," South Africa being the typical example.

Regarding legislation to change copyright laws to make them more reasonable, it's just not going to happen for two major reasons. First, I really don't think there will ever be enough critical mass of informed, upset people. Probably 90% of the population either doesn't care or just assumes that copyright is a natural phenomena rather than an artificial constraint created as a means to an end--creation of works and the betterment of society. And second, the entertainment industries have too much money and are unified on this issue. Compare this to the do-not-call legislation. That is an example of what it takes for a grass roots movement to defeat an industry lobbyist on a big issue. The entertainment industries have tons more money than the DMA and telemarketing phone calls were in people's faces, constantly annoying them into complaining to their legislator. For the vast majority of the people they don't ever see any impact of unbalanced copyright laws on their lives.

I prefer visible encryption

[dnoyeb]

I do not like hiden encryption. I like to know everything is working and not get to confortable. Don't want to be cought ignoring that lock icon on your browser these days.

Sad, but the truth.

[Bill, Shooter of Bul]

I'll even risk my Karma on it. The Slashdot communioty needs to be able to point out ways for the /. editors to improve. Making sure that there is a link in the blurb to the story mentioned in the blurb is sorta important. Don't ya think? Perhaps mr Coward, was a bit terse in his language, but honestly there are quite a few posts already that ask for the real link. So if it takes a few sarcastic, but on topic, barbs to motivate them, so be it. There is no better motivation than sarcasam. Except perhaps for a well written piece on the need for sarcasam. ;)

Adversaries help in spite of themselves

[redelm]

This is yet another manifestation of how adversarial relations backfire. As Nietzsche said "What doesn't kill you makes you stronger". Unless you can force a total a total paradigm shift (Bush invading Iraq), lesser measures will be counterproductive (Iraq sanctions). Do not start a fight you cannot win.

The RIAA has blunders at least twice. First it shutdown Napster 'way late (because it wasn't easy), now it is harassing KaZaa users with even less success. The next incarnation will be even tougher. They ought to be putting their energies into a paradigm shift like iPod. Or maybe even running their business competantly, with decent A&R budgets and better terms for musicians and customers since their distribution monopoly has faded.

But...

[Nijika]

Abstract idealism often tells the future. The Cypherpunks can once again send up a resounding "told ya so!"

Re:But...

[mekkab]

Abstract Idealism often predicts nothing. It tells the future, but it tells a future that never happens. What about my flying car? Vacations to the moon and mars? The 5 hour work-week?

A running joke with a colleague of mine is that if this "engineering thing" doesn't work out, we'll become professional nay-sayers. Predict doom, gloom, and failure, and when something we predict happens (statistically speaking, we have a 50/50 shot)we can say "I told ya so!"

snake oil

[SuperBanana]

but it isn't too early to see that the shift is both profound and irreversible

Not really. There's been several explosions of various file/disk encryption products. Your handheld device isn't a Somebody(Something?) until it's got at least a dozen "encrypted" personal information storage widgets for it.

The problem is that encryption is 90% snake oil. Usually it's written by someone who thinks they know encrpytion- and encryption isn't, to coin the phrase, like a hand grenade; close doesn't count. Zimmerman is famous for his saying that "anyone who claims to have unbreakable encryption doesn't"(apologies for paraphrasing).

Encryption also does little when physical security can't be controlled; Dallas Semi had the right idea with their iButtons, which brought reasonably secure key storage to the masses(if opened, for example, it erased itself) but it's gone pretty much nowhere; you just don't see them in widespread use(unlike, say, a proximity card or magswipe). I suspect even USB keys now vastly outnumber iButton devices.

All the encryption in the world won't do you any good if you can't store the keys securely...and these days, all it takes is a janitor with a CDROM with linux that 'phones home' and sends back choice tidbits...or an ipod.....or a USB hard drive..or a USB memory key...or a blank CDR, since so many machines come with CD burners now...

Re:snake oil

[mitheral]

None of that stuff is going to help the RIAA or your ISP who is just sniffing the wire. Yes the alphabet soup guys will be able to get a warrant and break your system but think about the cost involved. Until copyright infringement becomes a asset forfiture crime there is no incentive for the goverment.

Right...

[Anonymous Coward]

...and Hitler actually unified many diverse nations inadvertently by forcing them to work together.

I guess it makes sense, but I'm not going to be putting the RIAA into my prayers at night because of it.

No no NO no!!!!!

[TerryAtWork]

This is not the problem!!!!

The problem is not people intercepting your mp3s - the problem is sharing an mp3 with a guy working for the RIAA or in my case the CRIA and they get your IP and then they go to your ISP in an attempt to get you booted off the net, exactly as happened to me.

For instance - on Sourceforge there is a sooperencypted IRC project for safe sharing.

Useless.

All the RIAA spies have to do is go on the net, get that software, join the queue for mp3s then rat you out exactly as specified above.

What we NEED is a way to share files in such a manner as the receiver has no idea what your IP is.

This is not going to be easy. (And please don't mention Freenet ok?)

Re:No no NO no!!!!!

[poot_rootbeer]

What we NEED is a way to share files in such a manner as the receiver has no idea what your IP is.

Unless it's email, in which case the sender ought to be fully and accurately identified.

Am I the only one who sees a problem with reaching simultaneously for More Anonymity AND More Accountability?

Re:No no NO no!!!!!

[javatips]

The problem with web of trusts is that they grow very slowly (if people are very carefull about who they trusts). So the amount of stuff availlable to one will be quite small compared to the p2p networks we have now.

It is also inevitable that at one point, someone untrusted will join the network. Then he can gatter information to build a case against sharers in the web of trusts. You probably have no way of knowing who is the stool and you'll have to scrap your web of trysts and rebuild it from scratch.

So web of trusts will never work. You'll hve better luck with stuff like freenet that can garantee anonymity.

Gotta love the irony

[Anonymous Coward]

While the RIAA is trying to make people believe P2P means "piracy 2 pornography" and if you let kids use a computer they'll be targeted by a pedophile (sp?), it's their own actions that will cause the development of secure P2P applications that will actually let pedophiles trade pix/vids safely.

I wish the major news media could be made aware of this irony... but the money says otherwise.

Encryption is good, but not the complete answer.

[Anonymous Coward]

Suppose all file sharing apps had encryption- if an individual can get on the network, then so can the individuals and robots working for the RIAA.

To defeat the RIAA all that is needed is a challenge that requires a HUMAN response. Right now they use robots- but they can't compete if they have to examine an image and type what it is (takes a real person).

A better approach than that, but harder and less efficient is something like Freenet-

but it really needs to use ed2k type links and incorporate a search for keys. And of course be written in C, so I don't have to install a bloated Java environment.

Perhaps Freenet might die if the RIAA decides to inject massive amounts of crap and download it (making their chunks popular and erasing existing files on the network.

So, freenet + human required = good, almost unbreakable.

Re:Yahoo and Hot Mail should turn on by default

[PossibleMat]

The proverbial case "the chicken or the egg"
If you don't start encrypting today, you don't contribute to reach the critical mass. If everybody thinks like that, widespread use of encryption is gonna take a long time to come.

If I decide (which I would love to) start encrypting today, many people would wonder what sort of shady business I have gotten into

If Hotmail or Yahoo starts making encryption easy to use, many people would wonder what sort of business they are encouraging/supporting.
Oh, and Microsoft would probably "enhance" their encryption with other "features", making compatibility with other services impossible anyway. ;-)

He's Right!

[teamhasnoi]

I'm going to encrypt everything! Oh wait. How is Mom going to read my emails?

Saying that using encryption is good doesn't change the fact that regular people see no use for encrypting everything.

People will send their CC numbers through regular email! How can we get people to use encryption? Transparency, transparency, transparency.

If I send, "agoij(*UOLHa^&&%alhkAHI3%&%&jdha8tFHD98ht4Fls 8" to Mom she'll delete it. If I send it, and she reads, "Buy me an iPod for Christmas", she'll still delete it, but at least she got the message with no labor on her side.

Until encryption is enabled by default, and is transparent to the user, clueless users will rule the way you communicate. Sadly, this puts much of the onus on Microsoft, which won't do anything until there is a huge! public backlash - then come out with a easily broken implementation of it. :(

Encryption use isn't about privacy, it's about necessity. When the great unwashed (wait, that's Linux users ;) - when the masses are FORCED to use it, that's when it will get used.

Apple could do what MS can't - have an 'Encrypt for OS X users' checkbox on their mail app. Then with some 'return receipt' automagically encrypt messages to other OS X users. (I'm not a programmer, can you tell?).

To sum up, users want to be safe, secure, and anonymous, but they don't want to do anything to make it happen. 'Eat what you get, and use what you have" is the pervasive attitude.

It is really SAD

[argoff]

The Cypherpunks never went around suing people (that is, actually costing them money) who weren't using encryption to mask their illegal activities. The RIAA is.

Am I the only one here who thinks that it is really sad that we are changing for the better not because of how we grow personally, but rather because we half to - to avoid having our freedoms being taken away? It just seems so wrong - I really feel sorry for those who won't be able to keep up.

Why not?

[Kjella]

What we NEED is a way to share files in such a manner as the receiver has no idea what your IP is.

This is not going to be easy. (And please don't mention Freenet ok?)

Because it's got kiddie porn? Well, sorry, but you can't pick and choose anonymity. If there are logs the police can use to tell who shared that, the RIAA can subpoena the same logs to that show you shared mp3s. You can't have your cake and eat it too.

Another thing is that Freenet is dead slow, in a CPU and memory-hungry Java-implementation, and in general not that great. But it's likely to improve...

The only other alternative I see that is pseudoanonymous is having a set of trusted friends, routing not only requests but also the data over it. That way, no part of the chain knows more than where it's coming from and where it's going

.... <-> John <-> Bob <-> Bill <-> ...

Bob simply routed a connection between John and Bill. John doesn't know about Bill, Bill doesn't know about John. Bob doesn't know if the chain starts with John or ends with Bill or anything. Of course, this would also be a lot slower than direct P2P as is the norm today.

Kjella

E-commerce did it already

[iabervon]

The RIAA isn't responsible for making encryption commonly deployed; sending credit card numbers to websites is. The pattern is essentially the same, however. The cryptographers work on stuff, the security people say you really need to use encryption, but people generally don't actually do anything about it until something of value to them is stolen, at which point encryption becomes widely used and transparent. A few years go by, and everybody forgets that what they're using is encryption.

Now people talk about how they expect encryption to get outlawed. I think Amazon's $19B market cap which depends directly on encryption and eBay's $38B which essentially requires it (not to mention all of the companies which do some of their business online) will prevent this. Then there are VPNs, telecommuting, overseas content outsourcing, and so forth. Encryption is, at this point, something the US economy depends significantly on, and it's not going to get outlawed any time soon.

Re:E-commerce did it already

[daminotaur]

But that kind of encryption only protects you aginst eavesdroppers along the line, and is not a system for anonymous communication. Ebay has a record of everything I bought, bid on, paid for, etc. As they should. All bulletproof anonymous systems are not and cannot be made transparent--they require one's grandmother to maintain key rings, certificates, illusory webs-of-trust and all kinds of wonkish things that are ridiculous to deal with if one is doing nothing wrong. And that, of course, is the bottom line and always will be.

Re:Speaking of encrypting files

[gte910h]

PGP's freeware version comes with a "Create Self Decrypting Archive" option that does exactly what you want. It wants you to use big passwords, but I think its okay with you using smaller ones as well.

--Michael

Re:Digging their own graves...

[stwrtpj]

Anybody else thinks that, if encrypted file-sharing becomes a reality, the RIAA will simply implode?

Not before they attempt to lobby Congress to pass laws banning encryption use by the masses.

errrr

[Archfeld]

without reading I see one issue, sure encryption IN the background is proceeding, especially that which you have no control over, and while it serves the surface function it leaves the user FURTHER under the control of a 'gatekeeper'.
The time for user implemented crypto came and went, PGP had potential to put the public good ahead of corporate and government interests.

Re:Unbreakable anonymity?

[Myopic]

If you route your (illegal albeit encrypted) content thru third parties, and the third parties know about it, then aren't they guilty ("guilty") of contributory copyright enfringement (the same thing Napster was smacked for)? In your example, Hillary may not be able to pounce on the person originally serving the file (if she couldn't trace that person), but she could pounce on each of the people proxying a piece of the file.

Simply not having the file on your hard drive doesn't mean that you haven't broken a part of the copyright law.

This isn't to say that I think the law is reasonable, but to say that you haven't skirted the law with your suggested protocol.

There is a meme for this

[way2trivial]

it's known as
putting the genie back in the bottle.

it's expression alone indicates the likelyhood of success.

Re:It seems to me...

[40000]

A more secure method of distributing files to unknown persons is a DVD tied to the string of a helium balloon. The balloon can be launched discreetly at night from any location without a sound.
Preferably the wind should carry it towards a suburban area so that it lands in someone's garden, then whoever finds it isn't seen acting suspiciously.

Worst write-up ever?

[Kris_J]

I had to read the /. write-up about three times to workout what it was going on about. Couldn't have just said "RIAA ativities over the last year or so may have finally brought encryption and privacy concerns to the attention of the masses. Interesting article here"? I think that's what it's trying to say.

Its a conspiracy

[Anonymous Coward]

RIAA isn't protecting the artists. They are protecting the profit making engines of corporate America, such as Sony and MGM. Artists usually owe money to the record company after a record deal. The artists make their money touring. Its a conspiracy if you ask me.

Check out http://www.negativland.com/albini.html to give you an idea of who is actually benefiting from RIAA.

All I know is that since RIAA issued a subpoena to a 12 year old girl for having 2 illeagal MP3s, I will never again pay for music, EVER!! /for my two cents

It's not about your mom

[poofyhairguy82]

Encryption and the privacy that comes from it is not a end in and of itself.

You are right in your assumption that most people don't care about encryption for day to day email and whatnot. But that is not the issue. The issue is for spreading information that might get you in trouble. If I wrote an email to my mom to get an iPod i would not care if someone intercepted it and saw it. Encryption would never find a use in this instance.

Now say I want to send my friend some email giving him insider information that we will both (illegally) make money off of. That email I WOULD want encrypted. The best argument against such encryption (that I have seen modded high in this thread) is to say that the best use for hidden information is for actions that are immoral in nature. To that I argue that the internet is formed (or not formed really) from the social codes of the world. Its immoral to you but not someone across the world in a different culture. The Chinese Government would laugh at the RIAA if it asked it to stop music downloads.

And therein lies the issue. Main stream encryption won't come from Microsoft just like mainsteam P2P didn't. Because its more likely (in a big company like MS's eyes) to be used to steal the new office software that secure a home office. Main stream encryption will spread the same way napster was. Just as geeks then told nongeeks "Hey try this napster thing, you install it and it will let you get free music," encryption will be spread by an added sentence to the geek-nongeek conversation. "Hey try this kazaa (or what ever is the next big P2P app) thing, you install it and it will let you get free music. Also install (insert encryption program here)so that you can get away with it."

Encryption prevents the powers that be from bring down the hammer for not following order. That has nothing to do with something you mom probably wants to be involved with. Yet for some reason I like it cause I hate the man (even though I do like his stuff).