RIAA: Gnutella not yet a threat

According to Frank Creighton, the Recording Industry Association of America's chief anti-piracy officer, the community of file swappers that doesn't trade through a central server just isn't enough of a problem to warrant the efforts leveled at independent OpenNap and other Napster clones. Citing network frailties, privacy issues, and low adoption rates, he said his organization is watching the protean network but isn't yet bothering to crack down on members.

"We have a strategy, but we have yet to implement it," Creighton said, adding that the group could change tactics if the Gnutella service improves.

The statement goes to the heart of how far the record industry and other copyright holders are willing to go to track down individual online file swappers--and how much anonymity music traders can retain online.

Gnutella has long been touted as the most enforcement-resistant of the popular file-swapping networks because of its near-complete decentralization. Unlike Napster, iMesh or any of the other similar systems, no central point links people together and serves as an index to all of their files and searches. Instead, thousands of individual computers connect to each other in a massive digital daisy chain, passing search requests down the line as they come in.

This model stops well short of guaranteeing anonymity, however. As with any of the major file-swapping software services, everyone on the system exposes their numerical Internet addresses while they are active. Anybody who looks can take this and track it down to an individual's Internet service provider, which has information identifying a copyright infringer that it can be legally required to give up.

And at this point, there are people looking. The RIAA and other record labels are monitoring software like the kind Metallica once used to track down usernames on Napster. Another company called Copyright.net is using similar methods to find people swapping songs written by its stable of publishing clients.

But there's a difference between the ability to look and the decision to do anything about it--a gap that could protect Gnutella file traders until their numbers grow considerably higher.

Catch me if you can
Much of Gnutella's potential power, its backers say, comes not from its anonymity but from its lack of a central server.

The RIAA's strategy is to approach ISPs instead of file traders, asking the service providers to block access to Napster-like facilities as if they were Web pages or other sites hosted on the ISPs' servers.

This approach has prompted complaints from some ISPs that the industry is overstepping the bounds of existing copyright law. But for the RIAA, it has the advantage of being efficient: One letter to an ISP can shut down a central site serving hundreds, thousands or even tens of thousands of file swappers that use an OpenNap server, for example.

The RIAA certainly could track down Gnutella users. But it would have to go through the process of getting legal warrants to force an ISP to produce the name of each user, a potentially laborious process.

Nevertheless, analysts say that the RIAA is right: Gnutella simply hasn't drawn enough of a critical mass to be much of a threat yet. According to statistics produced by Clip2, a peer-to-peer consulting firm, Gnutella has been drawing about 250,000 users a day since Napster's latest court battles.

"There will always be an underground for piracy," said Gartner analyst P.J. McNealy. "But the RIAA has to draw the line somewhere. Otherwise they'd have to spend all their time on enforcement."