☆ GagaGate, DRM and How To Cripple The Cloud

I’ve been watching the music marketing stunt that Amazon have pulled today with some interest. The story is that Amazon US are selling the new Lady Gaga album Born This Way in digital-only form for $0.99 today only – the whole album for the price of a track (no luck in the UK where the album is £3.99). As the news has spread, it’s obviously being bought in huge quantities – it’s currently the purchase – and transferred straight to Cloud Drive, Amazon’s new online music locker and player.

Except it’s not. Customers have now been reporting for several hours that it’s not showing up in their accounts – only the digital booklet and in some cases one or two tracks are showing up. Amazon admits there’s a problem – their PR folk are churning out responses (clearly cut and paste from Twitter) to press inquiries saying

We’re experiencing high volume and downloads are delayed. If customers order today, they will get the full @ladygaga album for $0.99. Thanks for your patience.

That text has also replaced the bold claims about being able to listen to the album straight away on the product page. What could possibly be going wrong? After all, it’s very straightforward to add a pointer to a shared file into a directory, and I think that’s all Cloud Drive does with purchased music (which is why storing it there is free – symbolic links are virtually free). Amazon is clearly embarrassed by it – they are busily deleting customer comments from the product if they even mention the outage, regardless of the star rating.

One clue is the product details of the album. They include the text “Record Company Required Metadata: Music file contains unique purchase identifier. Learn more.”  Follow the link and you’ll find:

Embedded in the metadata of each purchased MP3 from this record company are a random number Amazon assigns to your order, the Amazon store name, the purchase date and time, codes that identify the album and song (the UPC and ISRC), Amazon’s digital signature, and an identifier that can be used to determine whether the audio has been modified.  In addition, Amazon inserts the first part of the email address associated with your Amazon.com account

I think that’s the answer. My hunch is that the GagaGate meltdown is all the fault of DRM. Rather than just adding a pointer to a shared file to the Cloud Drive, Amazon are required by the record company to create a unique copy of the file for every customer, watermarked digitally signed to show who bought it. What’s more, the unique copy includes at least one MD5 hash that has to be computed on a per-file basis. So Amazon has both an enormous computing task and potentially an enormous storage bill (assuming it doesn’t just compute the watermark signature on the fly at download, which is possible but doesn’t help with the compute bill).

All for what? Removing the metadata is unlikely to be massively challenging (albeit illegal under the DMCA). This means the record label is crippling their retailer’s business just so it can express its mistrust and low esteem for its paying customers while doing pretty much nothing to actually protect revenues –  that it already knows will be enormous – from serious criminals. Congratulations to the label, you’ve managed to turn a great example of how to compete with “free” into a bad experience for your customers.

One more observation: The Amazon UK digital download does not mention watermarking/signing. I wonder whether it’s because the record label trusts the British, or whether it’s just not disclosed?

[Updated to reflect information I received that the file has a uniquely-computed digital signature added, rather than a watermark. Lower (still significant) compute burden but even easier to remove]

☞ History Already

  • I’d heard Miguel was looking for funding to do this so I’m not surprised, but I still offer him warm congratulations and the best of luck in his new business.
  • I don’t know whether to be excited this exists, depressed that I know so many people on the “Honor Roll” or honoured to be on the Honor Roll myself. Or all of the above.
  • Mark Reinhold, formerly Sun’s and now Oracle’s head of Java engineering, has moved to a non-Oracle-hosted blog. Good move and one to watch.
  • OSI has signed as an organisational signatory. It’s important that the G8 leaders wake up and realise that the era when the only voices they needed to heed were corporate lobbyists has come to an end.