A young british boffin, Jonathan Friend, and his startup company Friend Media Technology Systems is causing quite a stir these days with his claims about being able to stop film and music piracy. On September the 8th, Financial Times (Joshua Chaffin: Young gun, FT, Sep. 8th, 2006) devoted two full pages to him and his company.
The story has a dramatic lead in, blaming Universal's $80-90 million loss on Ang Lee's movie The Hulk on a single act of Internet piracy by an individual named Kerry Gonzales.
However, whether the movie flopped because of Gonzales indiscretion is debatable. An equally likely cause is that a number of prominent reviewers pronounced it a stinker. In comparison, Spider-man, a Marvel superhero movie reported to be even more heavily pirated than The Hulk, was a huge box-office success.
The FT article reports extensively from a demonstration conducted by Jonathan Friend in New York in September 2006.
Belows are some typical quotes, with my comments:
With a laptop computer hooked up to a large screen at one end of the conference room, Friend logged on to a peer-to-peer file-sharing network like the one Gonzalez had used to post The Hulk. From the library of films and television shows on offer, he selected a music video and, with a few mouse clicks, began to download it. Looking up at the screen, the assembled guests watched a Hollywood nightmare play out in miniature as the blue status bar began to extend from left to right across the monitor, indicating the computer's progress at digesting the file. Then Friend moved to a separate computer armed with his software. With a few mouse clicks, he activated a blocking measure to interrupt the download. Almost instantly, the bar's steady progress was interrupted. A task that would have taken a matter of minutes had suddenly been extended to a day or more.
What Friend is doing here, is to mount a denial of service (DOS) attack on the computers serving as sources for the pirated video. This is trivial to do, because the only thing you need to know for mounting a DOS attack on someone is their IP-address, and anyone offering a service on the Internet (in this case the service is a bittorrent) must publicize their IP-adress. DOS-attacks are acts of cyber-terrorism, illegal in most jurisdictions, and highly disruptive of network traffic, legitimate as well as illegitimate. Using a DOS-attack to hamper piracy amounts to digging up the street leading to the pusher's house to stop drugs trafficking.
As a demonstration, he typed the name of a popular television programme into his software, and soon a column of numbers and flags popped up on the screen, indicating how many illegal copies of the material were available for download in each country at that moment. The US led the field, in this case, with 126, followed by Canada, the Czech Republic and Israel. With a bit more digging, Friend was able to sift the data by city, and then to list specific internet protocol addresses (the unique number identifying a specific computer).
This is pure showmanship. The writer makes it look as if Friend is going through an elaborate process to obtain the internet protocol address (IP-address) of the perpetrator. In fact, the IP-address is his starting point. His software harvests show titles and IP-addresses from publicly available torrent trackers and possibly other peer-to-peer networks. After stuffing this information into his system, he makes a trivial WHOIS-database query to tabulate the results by city and country.
IP addresses are like unlisted phone numbers, and they change regularly throughout the day. Friend claims that he can dig up the history of downloads from particular addresses over time, creating a record of file-sharing behaviour for specific users.
To do this with static IP-addresses is trivial, but there is no way one can do this with dynamic IP-addresses (i.e. those that change regularly throughout the day) without having access to internal logs from ISPs that tells you which IP-addresses are allocated to which user at which specific points in time. I think this claim is either bogus, or that the FT-journalist has misunderstood the claim.
He can determine whether a pirate was working from a company or university - two file-sharing hotbeds because of their fast internet connections - and list their name and location.
This is more credible. Companies and universities use static addresses, so a WHOIS query will tell him the name of the institution the IP-address belongs to. But most companies and universities also have strict rules against using company/faculty resources for piracy, and most of these also monitor the use of their networks - and will dicipline employees or students enganged in piracy. So the "hotbed" bit of the claim is a bit over the top.
Besides, no sensible pirate will ever use a machine with a static IP-address for his or her activities (unless the machine is hacked and belongs to someone else).
Using route-tracing technology that tracks data in its journey across the trunks and elbows of the internet, he can even pinpoint the latitude and longitude of a downloader to within 10 miles. To illustrate this, Friend gathered the co-ordinates of an IP address that was sharing the television programme and entered them into Google Earth, a downloadable program that maps the world with satellite imagery and aerial photography. Soon a satellite picture appeared on the screen, and after a few enlargements, a patch of land along a road in Kentucky was visible.
This is showmanship with very little practical value. It is probably based upon 3rd party software such IP2Location, which may give accurate coordinates for some static IP-addresses, but is just as likely to give you a completely wrong or out of date answers for dynamic IP-addresses.
Aydin Caginalp, a partner at Alston & Bird, the law firm that represents Friend, claims that his client's technology has value that extends well beyond piracy. The data could be used as marketing intelligence for entertainment companies, who are just learning to sell products online. Or it could be applied to a whole host of customers in need of internet security, such as banks or even the military.
Oh, well. Dot-com was not dead after all. The film and music industry is wasting a lot of good money on useless and unworkable technologies these days, and unlike various DRM schemes, Friend's technology seems to be fairly harmless with respect to legitimate customers. I hope his showmanship gets him the funding he is looking for.