The P2P risks behind House's Spotify ban
Connecting state and local government leaders
The House of Representatives has ruffled feathers by banning a peer-to-peer music network, but P2P raises security concerns that merit caution.
People love or hate peer-to-peer networking for many of same reasons: If offloads bandwidth demands from content providers to end users; it can provide a convenient way to copy and share copyrighted material, with or without permission; and it effectively turns your computer into someone else’s server.
These factors can cut two ways, so the House of Representatives opened a can of worms when it recently banned use of the Spotify P2P music service. The decision, reported by Politico on Jan. 31, apparently is part of a broad ban on P2P technology within the chamber, but the Chief Administrative Office, which oversees the House’s IT services, isn’t saying whether there are specific security concerns with Spotify.
The move drew quick criticism from the industry. The Recording Industry Association of America, long in the forefront of fighting unauthorized file-sharing, quickly sent a letter to Chief Administrative Officer Daniel J. Strodel pointing out that “Spotify is a licensed, secure online music streaming service,” one of dozens of authorized services that have RIAA’s blessing. It calls the ban a problem that needs to be fixed.
Daniel Castro, senior analyst with the Information Technology and Innovation Foundation, called the ban “haphazard,” and said in a statement that “I have yet to see any evidence from the CAO that using this music service presents a credible security risk.”
Peer-to-peer networking in itself is not an inherent risk, Castro said in an interview, saying that here is risk in any application or network connection. “You never know who controls the connection on the other side,” he said. But, “Spotify is a reputable company.”
Spotify does properly license its music and does appear to be reputable. But there is an additional layer of uncertainty and risk that comes with P2P networking that merits caution. The US-CERT warns that “P2P applications introduce security risks that may put your information or your computer in jeopardy,” and advises that “the best way to eliminate these risks is to avoid using P2P applications.”
But peer-to-peer networking has become a fact of life that now is difficult to avoid. In fact, you might be using it without knowing it. CNN generated some heat in 2009 when it used the P2P application Octoshape Grid Delivery to deliver online video coverage of President Obama’s first inauguration. It wasn’t exactly a secret — users of CNN.com Live were prompted to click “yes” to install an Adobe Flash Player plug-in for “faster, better video.”
The network describes Octoshape as a technology “to deliver higher quality video.” But a closer look shows that it is a P2P application that can take video from any user and deliver it to any other user. So if you watched the inaugural address online, your video might have been coming from someone else’s PC rather than from CNN. And someone else might have been watching your video stream. That upset some people.
Peer-to-peer has come a long way since the days of rogue services such as Napster, which created an uproar in the music and movie industries because its users shared without concern for copyright. There also were serious security concerns. A study by the U.S. Patent and Trademark Office back in 2006 found that five popular P2P applications of the time not only allowed sharing of files that users had downloaded via the apps, but also allowed users to browse throughout anything on another user’s drive and download any file.
One would hope that modern file-sharing schemes operating with the blessing of RIAA do not have such blatantly malicious components. Spotify’s terms of agreement prohibit: “using the Spotify service to import or copy any local files you do not have the legal right to import or copy in this way,” as well as using it for spamming, phishing or distributing malware.
But Spotify is not perfect. In 2008 it found and fixed a bug that that could let intruders acquire user passwords and other user information. The company might prohibit improper use of its services, but can it stop them? That is impossible to say without looking at the software. And as Castro admitted, “I haven’t done a security audit of Spotify.”
Most assessments of peer-to-peer applications, from US-CERT to the SANS Institute, conclude that turning your computer into someone else’s server entails risk. These risks presumably can be mitigated or avoided, but without good evidence that this has been done, caution in using or allowing P2P is warranted.