if not sooner. No CD DRM system can hope to stop this. Real systems do not appear designed to stop P2P
sharing, but seem aimed at other goals.
2
The record label's goal must therefore be to retard disc-to-disc copying and other local copying and use
of the music. Stopping local copying might increase sales of the music--if Alice cannot copy a CD to give
to Bob, Bob might buy the CD himself.
Control over local uses can translate into more revenue for the record label. For example, if the label can
control Alice's ability to download music from a CD into her iPod, the label might be able to charge Alice
an extra fee for iPod downloads. Charging for iPod downloads creates new revenue, but it also reduces the
value to users of the original CD and therefore reduces revenue from CD sales. Whether the new revenue
will outweigh the loss of CD revenue is a complex economic question whose answer depends on detailed
assumptions about users' preferences; generally, increasing the label's control over uses of the music will
tend to increase the label's profit.
Whether the label would find it more profitable to control a use, as opposed to granting it for free to
CD purchasers, is a separate question from whether copyright law gives the label the right to file lawsuits
relating to that use. Using DRM to enforce copyright law exactly as written is almost certainly not the record
label's profit-maximizing strategy.
Besides controlling use of the music, CD DRM can make money for the record label because it puts
software onto users' computers, and the label can monetize this installed platform. For example, each CD
DRM album includes a special application for listening to the protected music. This application can show
advertisements or create other promotional value for the label; or the platform can gather information about
the user's activities, which can be exploited for some business purpose. If taken too far, these become
spyware tactics; but they may be pursued more moderately, even over user objections, if the label believes
the benefits outweigh the costs.
2.2
DRM Vendor Goals
The CD DRM vendor's primary goal is to create value for the record label in order to maximize the price
the label will pay for the DRM technology. In this respect, the vendor's and label's incentives are aligned.
However, the vendor's incentives diverge from the label's in at least two ways. First, the vendor has a
higher risk tolerance than the label, because the label is a large, established business with a valuable brand
name, while the vendor (at least in the cases at issue here) is a start-up company with few assets and not
much brand equity. Start-ups face many risks already and are therefore less averse to taking on one more
risk. The record label, on the other hand, has much more capital and brand equity to lose if something goes
horribly wrong. Accordingly, we can expect the vendor to be much more willing to accept security risks
than the label.
The second incentive difference is that the vendor can monetize the installed platform in ways the record
label cannot. For example, once the vendor's DRM software is installed on a user's system, the software can
control use of other labels' CDs, so a larger installed base makes the vendor's technology more attractive
to other labels. This extra incentive to build the installed base will make the vendor more aggressive about
pushing the software onto users' computers than the label would be.
In short, incentive differences make the vendor more likely than the label to (a) cut corners and accept
security and reliability risks, and (b) push DRM software onto more user's computers. If the label had
perfect knowledge about the vendor's technology, this incentive gap would not be an issue--the label would
simply insist that the vendor protect the label's interests. But if, as seems likely in practice, the label has
imperfect knowledge of the technology, then the vendor will sometimes act against the label's interests.
2
Music industry rhetoric about DRM often focuses on P2P, and some in the industry probably still think that DRM can stop P2P
sharing. We believe that industry decision makers know otherwise. The design of the systems we studied supports this view.
3