Making Music Pay

Free Napster-style music sharing is on its way out. The future of digital music distribution will be determined by consumers voting with their purses for a single, or at most two, systems, just as they did with videotape formats and PC operating systems.

Napster offered immediate gratification; regaining it will cost us some privacy as well as money. As companies like Microsoft come to know all about us--not just our choices in music and films, but about our finances and even personal location--we may long for a pre-digital day.

Meanwhile, you may think you are buying the right to play a song at will. In truth, as digital music payment systems emerge, you will only be buying the right to play it on devices that recognize that right and have the software to play it.

A war on three levels

The coming battle to sell digital entertainment media over the Internet will be fought on at least three business levels. At the top are content providers fighting for the attention of the consumer. These are the movie and game makers, record producers, and book publishers.

One step down is the software that plays the content, sitting on desktops and, increasingly, inside devices such as MP3 music players. Microsoft Corp., based in Redmond, Wash., and its crosstown Seattle rival, RealNetworks Inc., are the major combatants here. The goal is to get their players on as many desktops and systems as possible, and to convince content providers to tailor their offerings to them. Other players exist as well, like Winamp, which is built into AOL Time Warner's Internet software. Most of the payoff for Microsoft, RealNetworks, and the others is control of the platform for digital media, because when consumers vote, these players will be the candidates on the ballot.

The third, and least visible, level concerns digital rights management (DRM), [ see figure] the software that will oversee your media purchases and your right to move content from device to device. Three standards have been proposed, but the winner, if there is to be one at all, will be selected in a marketplace that as yet does not exist--the first music containing DRM software, though promised for this summer, may not appear until 2002. According to at least one industry analyst, it will be 2004 at the earliest before a clear leader emerges.

Napster--and the un-copy-protected MP3 format that made it possible--has spoiled those of us who have been buying (or taking) songs and transferring them from one PC to another and to other devices at will.

But the unprotected MP3 format will soon be a thing of the past. Until the digital rights issue is settled, every device maker, and every content or service provider, will have to make its own DRM choices.

Licensed to bill

The simplest digital rights schemes will be like the one in Napster's upcoming music-for-pay service. Songs that enter the Napster network will be converted automatically to a new, copy-protected format that the service is calling .NAP. The conversion uses software from PlayMedia Systems Inc., of Los Angeles, the company that wrote the first MP3-playing software, AMP, and modified it for use by the Napster player. (While details of Napster's business model have yet to be disclosed, music industry observers expect that customers will pay about US $5 per month for a set number of songs.)

RealNetworks' DRM was equally simple until a year ago. RealPlayer, its media player, and RealJukebox, an MP3 storage and playback program, could use other companies' plug-ins for digital rights management. Typically a media player plug-in is software supplied by, and downloaded from, a source other than the player's maker; it then installs itself. It enables its user to play music with new file formats or encoding schemes not recognized by the player as originally manufactured. To illustrate, Universal Music Group and InterTrust Technologies Corp., in Santa Clara, Calif., jointly wrote a plug-in to allow Universal's music to be played on RealNetworks' Jukebox player.

RealNetworks now sells what it calls an e-commerce package for content providers that offers a more complete set of DRM capabilities, though still limited to its own media players. This is true of Microsoft's DRM software as well. Both companies provide software with which content providers may copy-protect music and other content, plus additional software, built into their media players, which consumers use to purchase a key that unlocks the content. The key, or license, may come from a subscription or from a single song purchase or rental; it may be purchased from the content provider directly or through a distributor or retailer. Each of these business models must be supported by DRM software; indeed digital systems are expected to offer new rights never before considered. (For example, an e-book company recently experimented with a $1 right to read a book for 10 hours, after which the right must be renewed.)

The DRM-based license is also what makes it possible to play a protected song on one device, though purchased on another. At best, though, any song under the aegis of either Microsoft or RealNetworks would be playable only on devices running that company's player. This is where InterTrust, without a player of its own, has an edge, in that it has the potential to work with many players.

Currently, InterTrust's DRM works with at least three players: those of RealNetworks, MusicMatch, and Sonique, a division of Lycos Inc. By taking a neutral stance in the player battle, InterTrust, as its name suggests, hopes to become a universally trusted intermediary for content providers as well as player manufacturers. As InterTrust division president Ed Fish put it, "If I'm MusicMatch, for example, do I trust Microsoft for rights management when I have a competing player?"

End-to-end solutions

If you are a content provider, though, there are obvious advantages to the kind of end-to-end solution that Microsoft and RealNetworks provide: a single source of copy protection, rights management, and a popular media player. Hence an announcement made by InterTrust in September, forming what it calls a rights alliance program. Intended primarily for media distributors, such as telephone companies or satellite television providers, the program seeks to assemble all the pieces needed to create a music-on-demand system, including integration with software from Portal Software Inc., of Cupertino, Calif., for management of subscriber databases and billing. Naturally, Microsoft offers similar services to content providers, but mainly through its own products, instead of allowing a choice of other companies.

Choosing among these DRM companies will not be easy. RealNetworks popularized the PC as a music platform with its media player, and there are 200 million copies out there. In addition, the company has gained experience in selling content through an arrangement called GoldPass. This collaboration with CBS and other entertainment companies sells monthly subscriptions to live events online, including professional sports games from Major League Baseball and the National Basketball Association. In fact, late last year RealNetworks claimed that its products are used in 85 percent of all streaming content.

Microsoft has even more copies of Windows Media Player in the hands of users, 350 million all told, and is expected to increase that lead with its new desktop operating system, XP. The company is working hard to see that its player, or at least its format for encoded content, is supported by hardware manufacturers. Amir Majidimehr, general manager of Microsoft's Digital Media Everywhere group, points out that the company has distributed 9000 copies of its software development kit to developers. The company would also like to become a significant music distributor through MSN Music, a part of its MSN Internet service.

This very efficiency, though, in keeping so many pieces of music delivery under Microsoft's own roof, has some people worried about privacy and security.

Trusted intermediaries

The job of DRM is to mediate among users, content providers, and payment systems. A song is no longer a sequence of notes waiting to be heard, but an encrypted sequence of notes waiting to be unlocked. When a user purchases a piece of music, for example, or a subscription to a service, the right to listen to the music on a particular device is a virtual key received in exchange for one's payment. The consumer needs to know that he or she will receive what has been promised, and that any financial information, such as a credit card number, is secure. There is also a concern that a great deal about one's personality and habits can become known when information about on-line purchases and other behavior is aggregated.

"DRM is about trust," said Talal Shamoon of InterTrust. "And someone has to be the root source of trust."

Hence some of the controversy about Microsoft's Passport system, already part of its free Hotmail e-mail service and boasting 100 million user names, e-mail addresses, and other personal data. Passport is also triggered whenever Microsoft products, such as its Office suite, are registered--a form of DRM for its own software. It is found as well in its other Internet services, such as the MSN Internet Access, MSN Messenger Service, WebTV Networks, and the Expedia travel service. It is also built into the new XP operating system. Microsoft describes it as a "single sign-in, registration, and electronic wallet" that can be shared between all of the sites that support it.

Passport can be a ticket into events requiring registration but not payment. A sister Microsoft service, dubbed HailStorm, can even make the payments that a for-pay service backed by DRM would require.

Privacy groups and computer industry commentators have objected to Microsoft's personal-information initiatives. According to a complaint filed with the U.S. Federal Trade Commission by the Washington, D.C.-based Electronic Privacy Information Center and a number of other groups, "It makes Microsoft the central repository for routine information for commercial transactions, as well as personal facts such as birthdates and anniversaries." The Wall Street Journal columnist Walter Mossberg recently said, "Microsoft's bully-boy behavior in the marketplace hardly inspires confidence that it won't somehow exploit this information." Few consumers realize that a birthdate and a zip code are enough to identify an individual uniquely with 97 percent accuracy.

Marc Rotenberg of the Electronic Privacy Information Center points out that hacking programmers often find security flaws in the company's programs. "Microsoft has not established itself as the Fort Knox of Internet privacy," he noted.

Content providers, for their part, need to know that their products are secure from illegal copying everywhere--on every platform and in every device. If a copy protection scheme on an MP3 handheld device is broken, content will leak out into the world of unprotected music exchange, no matter how secure it continues to be on other platforms and in other devices.

Adding copy protection to CDs

Music CDs were the first media to go digital and the first to go online in a big way, thanks to MP3 players. Right now, CDs are by far the biggest music market, and the most troubling to content providers, because there are millions and millions of music files out there with no copy protection. Because digital song files had no copy protection, they could be easily copied--hence the growth of free Internet-based file-exchange services such as Napster, Gnutella, and KaZaA.

Even before DRM-based music services are launched, the record companies are trying to put the genie of free music back into the bottle by adding simple copy protection to CDs. Leading record companies have been experimenting with various methods produced by several copy-protection vendors, including Midbar Tech Ltd., of Tel Aviv, Israel, and Macrovision Corp., in Sunnyvale, Calif. Some of the methods simply prevent copying to hard drives and blank disks; others discourage copying by causing the music quality to deteriorate or add unmusical clicking sounds--digital static, so to speak--when copied. Last year, an experiment with such copy protection by BMG/Music, New York City, the music arm of Bertelsmann AG, came to light when one in 50 of its CDs turned out to have poor sound when playing the original disk, not a copy.

Even without quality problems, simple copy protection schemes are likely to frustrate consumers accustomed to copying music at will. The more robust DRM methods therefore aim at making it easy to copy, if not free.

To gain more complete control over digital music files, the five largest recording companies, controlling 80 percent of music sold today, have formed two consortia. RealNetworks is a member of one camp, which includes Bertelsmann's BMG, EMI Recorded Music, and Warner Music Group, a subsidiary of AOL Time Warner. They will distribute streaming and downloadable music through MusicNet, a company set up for this purpose in Seattle, Wash. MusicNet's song database, created with RealNetworks' encoding and rights management, will in turn be licensed to a number of companies, the first two of which will be AOL and RealNetworks itself.

The other two major music companies, Sony Music Group and Universal Music Group, have in turn established their own service, renamed pressplay (all lower-case) after starting out as Duet. Like MusicNet, pressplay will be a distributor of music, licensing others to sell to consumers. Its first licensees will be Microsoft's MSN Music Network, Internet portal Yahoo! Inc., Sunnyvale, Calif., and music exchange MP3.com.

(Like Napster, MP3.com Inc. was itself sued last year for copyright infringement by Warner Music and BMG. The case has since been settled. More recently, the San Diego, Calif., company was acquired by Vivendi Universal, in Paris, France, the parent company as well of Universal Music Group.)

MSN Music is the music distribution arm of MSN, Microsoft's Internet service provider, second in size only to AOL. In fact, the two record distribution services not only partition the music world but echo the MSN-AOL rivalry and the Microsoft-RealNetworks competition as well.

InterTrust's DRM, in turn, has been licensed by a number of content providers, including two big record companies. One is Bertelsmann, which is already distributing a limited amount of music through its Digital World Services subsidiary (the music itself can be found on the Lycos portal Web site). The other is Universal Music, with which it has a pilot program, including the RealNetworks Jukebox plug-in. Nokia Corp., the Finnish telephone manufacturer, is an InterTrust licensee for a possible music-on-demand system; it also has a 5 percent stake in the company. InterTrust has been at least as active outside the music sphere as within it. It has formed a partnership with Blockbuster Inc., of Dallas, for video-on-demand, and provides the DRM in Adobe's Acrobat-based e-book and document readers.

Awkward at best

Unless the Sony and Universal Music groups agree with MusicNet on a common format, consumers will need different players for their music: Microsoft's Windows Media Player for one, and RealNetworks' RealPlayer for the other. (RealNetworks also has a Jukebox player for storing music files.) This is an annoyance, although people are getting used to it.

Both the Microsoft and RealNetworks players expect music files to be encoded according to formats proprietary to each company. To convert the files so they can be efficiently transmitted or played, an encoding and decoding scheme for digital media must be used. Known as a codec, the term stands for either coder/decoder or compression/decompression, depending upon whom you ask.

Most people who play music or video at home have both kinds of software players. After all, both are free, though RealNetworks has a better version for which it charges. But it's more of a challenge when both media players must inhabit a portable CD player, an automobile's MP3-box, or a song-playing cellphone, especially where data storage and RAM capacities are more precious.

A note on Microsoft's Web site indicates the problems ahead. It pertains to an MP3 handheld player, the popular Rio 800, made by SONICblue Inc., Santa Clara, Calif., and it reads: "If you are using the Real Jukebox software that shipped with your Rio Product, you will not be able to transfer secured Windows Media content to your Rio device using Real Jukebox. In order to transfer secured content...."

In other words, an MP3 file, which has no copy protection encryption, having maybe been downloaded from the Internet and copied to the device, will play on the Rio 800. But a song, perhaps the same song, encoded by Microsoft's codec will not play until the user downloads the Microsoft player to the Rio hardware. The Rio contains much less file storage and memory than a PC, so this can be a hardship as well as an inconvenience for the device's owner.

Another setback for interoperability derives from copy protection. After being encoded, files are encrypted, and different content vendors employ different encryption methods, either on their own or as provided by a DRM system. Microsoft and RealNetworks each offers their own built-in DRM in the software they sell to content providers and distributors (Windows Media Rights Manager and RealSystem Media Commerce Suite, respectively). So, too, do other DRM companies [see table], such as InterTrust.

Music lovers don't care, though, about distributors, codecs, or DRM software. They want to play the music they like on the appliances they own. Talal Shamoon, executive vice president of business development at InterTrust, likes to play a game. It starts: "Name your three favorite artists." The point is that they are unlikely to all come from the same record company or even a single consortium of record companies. (A further 20 percent of music comes from smaller labels or is self-published.)

Nicholas Givotovsky, a digital media consultant, puts it more simply: "The last thing I need is another $20-a-month subscription for just some of the music I listen to. The difficulty of DRM is how to achieve the seamlessness of experience and breadth of choice of unprotected CDs, with new security and revenue requirements." He concedes that there will be a fragmented market, at least initially. "Remember the Sony Betamax--eventually one videocassette format won out, but there was more than one to begin with."

Standardizing rights management software

Clearly the music-selling world as a whole would benefit if it could agree on a language for standards for DRM. Several efforts are under way.

The first is IPMP (intellectual property management and protection), a standard being developed by the Moving Picture Experts Group (MPEG), a committee of the Geneva-based International Organization for Standardization (ISO). The group has been very successful with earlier standards. In fact, MPEG-2 is the standard for digital television, and MP3 is part of MPEG-1. IPMP is being built into the

MPEG-4 codec standard, the successor to MP3 and MPEG-2.

The second attempt is xMCL, which stands for eXtensible Media Commerce Language. It was announced in June by RealNetworks and a group of media software vendors and content providers that includes Adobe, IBM, InterTrust, MGM, Sony Pictures Digital Entertainment, and Sun Microsystems. The xMCL language need not be incompatible with IPMP; rather it could develop as a commercial implementation of the IPMP standard. Indeed, at least one key person is a member of both groups: InterTrust's senior director for initiatives, Rob Koenen, is that company's representative to xMCL, and also chairs the requirements group at MPEG, which oversees MPEG and IPMP.

Microsoft, in the meantime, has contributed to IPMP, but expects the marketplace to standardize de facto on yet another potential standard. This is XrML (eXtensible Rights Markup Language), which is licensed as an open specification by ContentGuard Inc., a Bethesda, Md., spinoff of the Xerox Palo Alto Research Center.

A marketplace in turmoil

The rights management marketplace is in flux despite being relatively small [again, see table]. A June 2001 report by Boston's International Data Group estimates that only $96 million worth of software packages was sold last year from this small group of companies. Nonetheless, the report predicts rapid growth to more than $3.5 billion in 2005. Once media companies are confident that DRM systems meet their needs, the sales of content bound by rights management could be almost 100 times as large. That market will be in even greater flux as new products create new distribution channels.

Take cellphones, rarely regarded as content-delivery devices. According to Anssi Vanjoki, executive vice president for mobile phones at Nokia, by 2003 there will be more connections to the Internet of wireless devices than PCs. As wireless numbers grow, the devices are being called upon to provide greater audio, video, and even identity services.

Nokia and Samsung Electronics Co., in Seoul, Korea, now manufacture cellphones with screens that can play digital video. RealNetworks is already supplying Nokia with software that in effect turns the Finnish company's phones into video players. Bandwidth is still an obstacle, and users are more likely to view a short preview of the latest Tom Cruise movie than the entire film.

Telephone companies will also become media providers, especially of music. Qwest Communications International Inc., Denver, Colo., a regional telecommunications company, is expected soon to add music to the weather, traffic news, and other services it already offers its cellular customers. NTT DoCoMo, the Tokyo-based mobile phone company, has gone further: in May, in Japan, it began selling a phone that can receive music files. Users pay a monthly fee of less than $2 and per-song charges, as well as a one-time charge for the phone.

Hardly any cellphones today can decode DRM-protected content such as music and information, but this capability will become common, especially with the move to Internet-enabled phones. Users will also need to identify themselves to content and service providers. This can be done with a personal identifier number of the kind used with a bankcard. But cellphones themselves already have an identifier, called a subscriber identity module (SIM), built into them, which identifies the phone to the cellular system. In fact, Finland's government authorities are weighing a plan to replace an existing system that uses smart cards for personal identification with one based on the SIM.

This module would identify a user to an Internet-based database, which would hold information about the individual, including entitled rights and services. The rights information could include anything, allowing the phone to act as a surrogate for a credit card, a medical record, an airline boarding pass, or even a (small-p) passport--creating yet another instance where a lingua franca of digital rights is needed and where personal information is at risk.

DRM software is the leading edge of both unparalleled convenience and breakdowns in barriers to privacy, a concern that extends beyond the realm of rights management. It recently stirred Carleton S. ("Carly") Fiorina, the head of Silicon Valley pioneer firm, Hewlett-Packard Co., to remark: "I think we in the technology industry have fallen in love with technology. And in the end it is not about the technology. Privacy and security, or trust, are vital to consumers, and that is what we should focus on."