A lot of college students are getting “pre-litigation” letters from the Recording Industry Association of America (RIAA) claiming that they have illegally downloaded music. The RIAA threatens them with enormous penalties and offers them the opportunity to settle up for only modestly large fines.

The RIAA identifies these students by their IP addresses — the numerical address of their connection to the Internet. In residential colleges, where students living arrangements are known, the IP address is arguably a reliable identifier of an individual student.

Doubtless many of the RIAA’s claims are accurate. But many are not; we give a particularly dramatic mistake in Blown to Bits.

Now three researchers at the University of Washington have demonstrated ways to spoof IP addresses — that is, to make it look to the RIAA as though a download is going to your IP address when it isn’t, and in fact no download is occurring at all. A new way to be mean to your enemies — induce the RIAA to send threatening letters to them, even though they are completely innocent!

The moral of the paper is that the RIAA’s identification methods are deeply flawed and are unreliable. That could be a very important fact, given the levels to which the RIAA has taken the war over music file sharing.

There is more on the New York Times blog or you can read the original paper here.

This entry was posted on Friday, June 6th, 2008 at 7:53 am and is filed under Owning bits—copyright. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.