Apple iTunes Plus Borders on Spyware

Well, I figured something like this would happen. I've written previously about Apple's gracious offer to let you pay an extra 30 cents each for tracks without DRM, but now something more sinister is afoot: When you buy those tracks, it turns out they are tagged with your iTunes user name and your email address.

The iTunes Plus store opened today to mixed reviews and lots of bugs, but it wasn't long before Ars Technica took a look under the hood of those files. And there it is: your account data, for the world to see. (Old, DRM'ed iTunes files contain account info too, but they're useless to file sharers.)

The privacy implications here are enormous. This is obviously a ploy to keep DRM-free files from ending up on file sharing networks (and to make it brainlessly easy to sue those who do share their music), but the reality is far worse than that. Clever P2P users will simply delete the data in the files and go on sharing the music. More clever ones will forge different email addresses and account names into the music, then share the files. It won't be long before the first RIAA subpoena is delivered to someone on the basis of a forged email address found in an iTunes track. Maybe it'll be you. It'll be up to you to prove you didn't download the track in question.

Sorry to be the bearer of doomsaying news, but there's just no reason that Apple needs this information embedded in music files. There's nothing to be gained from it and everything to be lost, as the last thing digital music needs is more bad press. But here's yet another reason to avoid these tracks. (In related news, no one seems to be able to tell the difference in quality vs. the old 99-cent tracks, anyway.)

Also, I'll let you know when someone delivers a utility to strip personal info from iTunes tracks. I figure it'll be a week or two at the most.

LINK: Apple hides account info in DRM-free music, too