Friday, 27 August, 2004

Well, a nice bit of news today.. I got myself a new programming job that pays £20,000. Not bad eh I'll be writing pure C# web applications all day - every day. Finally I get to scrap support so I can concentrate on what I actually I want to do with my career.

In many respsects, today has been one of the key moments in my life to date. Getting this far wasn't easy though because I had to sit a two hour C# exam and endure two interviews. All that doesn't matter now - I have the job and i'm chuffed to bits.

On an entirely different note - I'm going to republish a post I made on Slashdot on the effectiveness of the RIAA. The approach is borrowed from Schneier's book Beyond Fear, in it he states five questions that you should always ask when evaluating a security decision. Here is my analysis:

What assets are you trying to protect? The profitability of producing copyrighted music.

What are the threats to those assets? The biggest threat to profitability is the very large levels of copyright infringement. This is such a massive risk that considering any other threat to profitability is a waste of time at this stage.

What is the proposed countermeasure? Suing random copyright infringers.

How does the countermeasure mitigate the risks? The idea is that by suing random copyright infringers you instill fear in people who are more risk adverse. They don't want to be slapped with a large fine so they'd rather pay for the record. There are a number of questions that need to be asked. Firstly, how many people does this approach really scare off? Secondly, How much revenue is it likely to recover? Let's say for every one of the seven hundred and forty four people sued recently ten other people decide not to infringe anymore and go out and buy. Also assume the single costs $3. The revenue brought in by these sales would be $2232, so in this case the cost of the legal action would be more than the revenue recieved. Even if one hundred people were dissuaded for every infringer sued this would only increase to $223,320. The RIAA have a tendency to settle for a few thousand dollars for each infringer so for round figures assume they make a million dollars overall. In this situation you'd likely make a profit over the cost of the legal action but it'd be small and you've not really done much damage to the millions of remaining pirates. In light of this analysis, I don't think this counter-measure mitigates the risk.

What side-effects does the proposed counter-measure produce? The RIAA has already sued a range of people that do their cause more damange than good. People like grandmas, poor families, hardup students. Trying to convince the public that the artist needs renumeration when you're suing a single mother who is strugling to support her family is counter-productive. A side-effect of particular note is people boycotting your products. In those circumstances you've lost sales as a direct result of deploying the counter-measure - a very bad situation.

Is the trade-off worth it? This step is always subjective but I think the counter-measure is meritless given the damage to public image, the small amount of money recovered from most of the infringers and the small amount of people who actually stop downloading as a result of the legal action. The RIAA should consider other, more effective, counter-measures.

Simon.