According to Edward Felton, Apple has released a “fix” to iTunes which breaks Jon Johansen’s (aka DVD Jon) and company’s PyMusique, an iTunes client which leaves off the iTMS Digital “Rights” Management system that Apple uses on iTunes files.

the security mechanisms of iTMS were, and are, well designed. A system that does what iTMS does will necessarily be unable to prevent unauthorized copying of music. That’s just a fact. Apple, to its credit, didn’t overinvest in fancy anti-copying technology that would be defeated anyway. Instead, Apple built a more modest and — here’s the key point — user-friendly system that gave users freedom to make legal use of music and provided speed bumps to steer consumer behavior, but didn’t pretend to stop determined infringers. There was no point in trying to stop determined infringers, because (a) there was nothing Apple could do to stop them from ripping iTMS content, and (b) all of the songs that might be ripped from iTMS were already available on the darknet anyway.

iTMS security is a bit like the lock on your screen door: it’s not very strong, but it doesn’t have to be, because the screen door around it is inherently vulnerable anyway. Putting an expensive lock on your screen door is a waste of money because it doesn’t make you any safer. Similarly with iTMS: spending more on copy protection would have been a waste, because it wouldn’t have reduced infringement.

Rather than owning up to its savvy engineering decision not to overinvest in fruitless copy protection, Apple apparently feels compelled to pretend publicly that iTMS is “secure” in the sense that heroic effort is required to illegally redistribute content bought from iTMS. That’s obviously untrue, but Apple is unwilling to admit that in public.

This is an interesting intersection of things I love (rational, effective risk management) and things I hate (evil technologies like DRM).

Apple is dancing with the devil here. On one hand, they had to throw a carrot to the Content Owners (aka the RIAA, legal scourge of the P2P universe) in order to get any inventory for their store. At the same time, however, I think they knew full well that DRM doesn’t actually prevent unauthorized (by the RIAA) copying of files.

They didn’t want to admit this to the RIAA, who would then pack up their content and go home. But they also had to at least suspect that anyone who believed DRM prevents unauthorized content distribution wouldn’t know the difference between DRM and a laptop box with a rock in it. Cory Doctorow, in his role as EFF representative has covered this better than I ever will, so go read his explanation if you’ve never done so or haven’t done so recently.

Apple did the Smart Thing and provided an elegant-looking DRM solution which didn’t require a ton of resources to design and implement but still provided the appearance of security. I won’t go so far as to call it Security Theater like the first commenter in in Felten’s blog, but I do think that it was designed more as a “reminder” that the correct course of action is to go buy your own copy than any real expectation it would stop a concerted effort to make unburdened/unrestricted copies.

So, applying the Three (Sometimes Four) Question Model…

1) Did they have a problem? Yes (Two problems, actually). First, they needed to provide limitations on the unrestricted copying of the content they wanted to sell or their supplier wouldn’t work with them. Second, they needed to ensure that their customers would encourage each other to each buy their own copy of the songs.

2) Did the solution actually solve the problem? Yes on both. The DRM as implemented prevented casual sharing of files, meaning that their suppliers were willing to license the music for use in iTunes and their average customer could only get their own “official” copy by buying it from the store

3) Was it cost-effective? I’ll assume the answer here is “Yes” since the solution seems to be generally appropriate to the scope of the problem. Casual or accidental sharing is minimized and the suppliers are placated, but the measures are not so draconian that they become difficult to implement or maintain (witness the rapid response to PyMystique).

4) What was the opportunity cost of doing this? A tiny bit of negative publicity and ill will from the crypto and security community. But since we probably don’t buy enough of their music constitute a rounding error, I think they were probably willing to accept that risk.

In summary, Apple did a good job of a bad thing. I’m so conflicted.

A good job of a bad thing is a worse thing than making a mess of the bad thing.

Elegantly implemented evil is still evil.