Names, e-mails and other sensitive information embedded in files

Rhys Blakely
Fresh privacy fears have been sparked after it emerged that Apple has embedded personal information into music files bought from its iTunes online music store.

Technology websites examining iTunes products discovered that personal data, including the name and e-mail addresses of purchasers, are embedded into the AAC files that Apple uses to distribute music tracks.

The information is also included in tracks sold under Apple’s iTunes Plus system, launched this week, where users pay a premium for music that is free from the controversial digital rights (DRM) software that is designed to safeguard against piracy.

The Electronic Freedom Foundation, the online consumer rights group, added that it had identified a large amount of additional unaccounted-for information in iTunes files. It said it was possible that the data could be used to “watermark” tracks so that the original purchaser could be tracked down were a track to appear on a file-sharing network.

Ars Technica, among the first websites to unveil the hidden information, said: “Everyone should be aware that while DRM-free files may lift a lot of restrictions on our personal usage habits, it doesn't mean that we can just start sharing the love, so to speak. Sharer beware.”

An Apple spokeswoman was unable to comment when contacted by Times Online.

The discovery of the data, of which most iTunes users will have been unaware, underscores the reluctance of music groups to allow music to circulate freely over the web.

With estimates suggesting that 40 tracks are digitally bootlegged for every legally downloaded track, piracy remains a massive problem for the industry and music groups have largely proven reluctant to withdraw the controversial DRM technologies.

Apple had sought to present itself as a consumer champion, with the group’s chief executive, Steve Jobs, insisting earlier this year that his company would drop DRM “in a heartbeat” if allowed to by the labels.

Previously, Apple’s DRM system had been criticised by several European regulators for being anti-competitive because it only allowed tracks to be played on Apple's iPod digital music players.

Apple's iTunes Plus service, launched this week, offers DRM-free music of a higher quality than standard iTunes tracks for 99p a song – compared with 79p for a standard track. Users who opt to pay extra for iTunes Plus tracks will be able to play the music without limitations on the type of music player or number of computers that purchased songs can be played on.

The service is launching with EMI’s digital catalogue of outstanding recordings, including singles and albums from Coldplay, The Rolling Stones, Norah Jones, Frank Sinatra, Joss Stone, Pink Floyd and John Coltrane.

Steve Jobs, the Apple chief executive, said: “We expect more than half of the songs on iTunes will be offered in iTunes Plus versions by the end of this year.”

Online music sales still account for only 10 per cent of the total market and are not yet growing at a rate which compensates for the decline in revenues from CDs – approximately 2 to 3 per cent per year.

EMI, which has previously released tracks by Norah Jones and Lily Allen without copyright protection, shelved plans to drop DRM on a more widespread basis after iTunes competitors refused to make “risk insurance” payments designed to offset potential losses that would result from the move. It is unclear whether Apple has made any such payment.

Other labels, including Universal Music and Sony BMG, have experimented with offering music without DRM, but none has pursued the strategy as aggressively as EMI.

The iTunes Store has sold over 2.5 billion songs, 50 million TV shows and over two million movies, making it the leader in each of those markets.

[link to business.timesonline.co.uk]