Paul Boutin

Anti-Trustworthy computing

Microsoft's new security drive aims to appease Hollywood, comfort consumers and reinvigorate the PC. But will the price for such safety be too high?

  • more
    • All Share Services

Anti-Trustworthy computing

Would you trust your life to Microsoft?

That’s the challenge the company’s “Trustworthy Computing” initiative is throwing down. First hinted at publicly in one of Bill Gates’ rare companywide e-mails earlier this year, the sweeping concept was explained in detail in a white paper written by CTO Craig Mundie for January’s World Economic Forum summit in New York.

“Computers helped transport people to the moon and back, they control critical aircraft systems for millions of flights every year, and they move trillions of dollars around the globe daily, [but] they generally haven’t reached the point where people are willing to entrust them with their lives, implicitly or explicitly,” Mundie wrote. “We will have to make the computing ecosystem sufficiently trustworthy that people don’t worry about its fallibility or unreliability the way they do today … It may take us ten to 15 years to get there.”

Microsoft is making a big play on its new push: In a wager detailed in the May issue of Wired magazine, Mundie has bet Google CEO Eric Schmidt that by 2030, passengers will routinely board commercial airline flights without a pilot. That is, United and American flights will be flown entirely by computers.

Six months after Sept. 11, you have to wonder: Is he nuts?

Those who’ve followed the company’s escapades the past few years are asking a different question: What’s the spin here? What does Microsoft stand to gain by planting in our minds the image of computer systems so reliable we’ll leave more fallible human pilots on the ground?

Perhaps, if we’ll trust computers with our lives, we’ll also trust them with our credit cards. And maybe, even more important, Hollywood will trust them with its movies. The Trustworthy Computing initiative is as much about securing intellectual property control as it is about “safety.”

Call it corporate arrogance, call it chutzpah, call it the American way: Microsoft is pushing Trustworthy Computing even as its antitrust settlement with the federal government is being fought by nine U.S. states. The company’s announced goal is to make computing a utility as ubiquitous and unnoticed as electric power — a development that would also just happen to preserve Microsoft’s PC-powered monopoly in the process. But with that monopoly comes a software monoculture, one already prone to infections by Outlook mail viruses and Windows server worms. In Mundie’s scenario, the threat could hardly be more lethal: Figure out how to hijack one remote-controlled plane, and you can hijack them all.

Still, the company’s goal isn’t really to fly planes. Onboard computer systems for airliners are a small, specialized market and will probably stay that way. Trustworthy Computing’s real aim is to secure Redmond’s hold on the desktop, by putting the PC back in the center of the action. Just as Gates’ “Pearl Harbor Day” e-mail more than five years ago refocused everything his company did around the Internet, his Trustworthy Computing memo places the company at the forefront of today’s driving interests. Bundling up consumers’ fears of crackers and e-commerce fraud, IT staffers’ worries about server break-ins and Hollywood’s paranoia that its crown jewels are being Napstered into worthlessness, Gates hands back a secure solution for all of us that fits the existing space on our desks. Don’t panic — upgrade!

One of the reasons there’s been little debate about Trustworthy Computing is that no one — including most Microsoft employees — seems to know what it is. Even the company’s public relations experts have trouble conveying Mundie’s vision. But for those willing to wade through it, his white paper details the big picture in depth: “Trustworthy Computing is a label for a whole range of advances that have to be made for people to be as comfortable using devices powered by computers and software as they are today using a device that is powered by electricity.”

That’s a tall order, and a mission statement that could be extended to almost anything vaguely related to computing — Mundie’s paper includes regulatory issues along with technical ones. But besides fixing the notorious security holes in its Web servers and virus-prone desktop clients, the company is also pushing hard on a front that goes beyond its traditional role: Digital rights management, or DRM. A trustworthy DRM system would extend Microsoft’s role where pundits focused on Web services and wireless gadgets least expect — right under their noses, on the PC.

DRM technologies aim to block unlicensed distribution or use of copyrighted material. Movies, music, books, software — any intellectual property that can be put into 1′s and 0′s and passed around the Internet for free. On the consumer side, similar worries abound over credit card numbers, passwords, account information, even mail — all of it easily pilferable from the wide-open architecture of today’s PC. Not just by crackers, but by your kids.

It’s no secret in a post-Napster world that nothing digital is safe from being copied once it’s on a PC. While individual users worry about storing sensitive personal information or sending it across the Net, corporations fear their valuable intellectual property will become worthless once released into the digital wild. Enter Microsoft, offering to tame these Internet-spawned threats — by pushing its Windows operating system back into the center of every digital transaction.

“They’re trying to get the PC back into the stream of e-commerce,” says Lark Allen, VP of business development for Wave Systems, a Massachusetts company that supplies software and hardware to hold data securely inside a PC. “Today it’s just a browser. We’ve moved all the important applications back off the desktop and onto the server, which is the only thing that’s trusted today.” Adding secure systems onto the PC, he says, could be “like the original PC era, where you start moving things back onto people’s desks.”

But at the same time consumers are worrying about having their personal data stolen, Hollywood studios are worrying about consumers. Studios have balked at releasing movies and music online until they’re sure the PC users who pay to download them won’t be able to give out a million free copies. Why should Microsoft care? Because if a solution can be found, downloadable movies might be the biggest boon to PC sales since the Web caught on nearly a decade ago: To play them, you’ll want a PC even more powerful than the new crop of 2.4GHz machines with their 80-gigabyte disks. “It’s going to be the biggest, fattest client you’ve ever seen,” says Allen. “You’ll want terabytes of storage.”

Engineers like to keep intellectual property locked up behind firewalls and server room doors. But it seems to be basic human psychology that consumers prefer to have their stuff right in front of them on their computer. That’s why Microsoft filed for a patent on a “digital rights management operating system” in 1999. The patent was granted this past December — #6,330,670. If the company builds it and ships it, there’s no doubt what it will be called: Windows.

It’s also no coincidence that the proposed antitrust settlement cooked up by Microsoft and the Department of Justice conveniently excuses Microsoft from having to share any information related to digital rights management and encryption technology with its competitors.

So what’s wrong with all this? If the answer wasn’t obvious before last September, it is now: A ubiquitous box that holds everyone’s personal information is the world’s most tempting target for thieves and terrorists alike. Computer scientists call it “the monoculture problem,” drawing a parallel to the frailties of single-strain crops described in Paul Raeburn’s 1995 book “The Last Harvest” and its precursor of a decade earlier, Jack Doyle’s “Altered Harvest.” As Doyle wrote, “What appears to be a genetic godsend and an economic bonanza for the company today could become an economic nightmare for them tomorrow … should one tiny organism find a genetic window of virulence in the Russet Burbank potato … If that happens McDonald’s will have contributed mightily to the spread of a genetic epidemic.” In the early ’90s, as Raeburn documented, a single strain of blight knocked out crops from Maine to British Columbia.

Computing systems aren’t nearly as complex as living organisms, but security experts say the monoculture problem has proven to be more than theory in the wake of e-mail viruses and hack attacks that took advantage of identically weak Windows code on millions of computers — many in the hands of less tech-savvy consumers unable to recognize or remove a virus. Expand Windows’ domain so it holds our credit card info for us and U2′s entire catalog for them, and the much greater risk is obvious.

In the software world, “the existence or nonexistence of a monoculture in a particular environment is usually haphazard,” says Greg Hoglund, CTO of Cenzic, a company that makes automated security testing software. “People will buy three different types of intrusion detection systems specifically because they want to be more resilient,” he says, “but you can’t afford to have three different kinds of Web server environments, with three different kinds of programmers maintaining them.”

When it comes to consumer products, planning is even more shortsighted. “People want instant gratification,” Hoglund says. “They want [a new feature] so bad that they’re willing to buy it and use it without concern for the ramifications. If three years from now that opens me up to an attack, I’m not thinking about it.”

Dr Robert Thibadeau, a Carnegie-Mellon professor who lectures on security and privacy, says the real danger is Windows may already be compromised. “Do you remember how we won the Second World War?” he asks. “We cracked their codes and we never let them know. My concern isn’t about the stuff we hear about, it’s the ones we don’t. A really bad guy isn’t stupid enough to tell you he’s figured out how to get into your computer. You give them a monoculture and you open the door to them.”

But Thibadeau says it’s important not to confuse a business monopoly with a software monoculture. “It’s not bad because there’s one big ugly company doing it,” he says, pointing out that Unix code shared among vendors has similarly been exploited. The threat is created when a common code base — in this case, the Windows “kernel,” the heart of the operating system — is shared across a wide range of computers. Even if one is a PDA and one is, say, an airliner. “I can run a completely different interface for everyone,” he theorizes, “but if someone gets into the kernel … ”

And the upside? “I can’t imagine there’s anything good out of one kernel out there,” he says, echoing what seems to be the ubiquitous sentiment in his field. Instead, he suggests Microsoft take a lesson from the early days of mainframe operating systems: “There should be five giant strong architectures out there that can emulate each other,” he says. “The classic way you do risk management is you limit the amount of damage one person can do because he can’t cross boundaries.”

It’s possible to do that, even within the Windows realm: The free Outlook Express e-mail client, built from an entirely different code base than its pricey big brother Outlook, has proven to be immune to many of the e-mail viruses Outlook users have suffered from for years. But that’s the exception; the company’s usual means of gaining synergy among its software products is to give them access to one other’s data and functions using code hooks only Microsoft can build in. These tie-ins not only lock out other companies forced to use higher-level protocol standards to get, say, your e-mail to talk to your calendar, they’ve also provided many of the biggest holes exploited by virus and worm programmers. And for what? So your e-mail can show you pretty HTML designs.

Will Microsoft break up its code monoculture in order to make Trustworthy Computing more resilient, providing more separate code bases instead of fewer in order to prevent global hack attacks? Probably not. But there are some things it can do that take advantage of the company’s “Windows everywhere” goal to lessen the risks from single-strain software.

First, Microsoft can improve its hugely popular development tools for programmers to prevent them from writing vulnerable code. “Software engineers are not traditional engineers. They’re rock stars,” Hoglund says, meaning they’re less interested in meticulously removing all flaws from a design the way a skycraper architect would feel compelled to do. “But a smart development environment has the capability of being the cleanup crew that picks up the mess behind them,” says Hoglund. Right now, Microsoft’s development tools for C and Visual Basic are the most-used on the planet, and the company’s Java tools are a top contender, despite the ongoing feud over that language between Microsoft and Sun Microsystems. Building into these tools more automated checks for known security holes would help keep programmers at other companies from unwittingly creating unsafe software.

Second, Microsoft can refuse to honor software systems known to be insecure or unreliable — starting with its own. First on the hit list is Passport, the ubiquitous customer identification system known to Hotmail and MSN Messenger users. In attempting to keep sensitive customer data away from millions of individual companies’ Web sites by using a central repository at Microsoft, the company is setting up a single, giant point of failure that makes security experts nervous. One who meets regularly with the company confided that “Passport is a great example of privacy protection by half measure.”

Dave Taylor, a coauthor of the game Quake, told me last year that getting certain third-party software programs certified for Windows was a brutal, expensive process. “You wouldn’t believe the hoops they make you jump through” to get that logo, he said. Yet not too long ago, a consolidation of Passport domain name servers onto one operational team’s network in Redmond — a classic screwup motivated by internal politics rather than engineering — resulted in a day-long outage for all Passport users.

By emphasizing Trustworthy Computing, Microsoft hopes to ride the drive for greater security, privacy, and protection of intellectual property as profitably as it rode the initial Internet boom half a decade ago. The company has called the Consumer Broadband and Digital Television Promotion Act currently before Congress “simply wrongheaded,” yet people who’ve read both the bill and Microsoft’s DRM patent joke about the similarities between the two documents. As usual, Microsoft and Washington have each seen the future and are wrestling over which of them gets to dictate its terms.

Not that any other red-blooded technology firm wouldn’t do the same thing. Apple has long been pushing its Macs as “the hub of your digital lifestyle.” But the name of the new initiative points out that Mundie and Microsoft, far more than their competitors, know they’ve got a tough question to answer before we’ll let them fly that plane 10, 30 or 100 years from now:

Can we trust them?

U.S. prepares to invade your hard drive

A bill before Congress would mandate built-in copy-protection on all digital devices. But even technology experts who really want to protect intellectual property think it's a lousy idea.

  • more
    • All Share Services

U.S. prepares to invade your hard drive

If you think techies hate Microsoft, try asking them about Hollings — Sen. Ernest F. “Fritz” Hollings, that is, the South Carolina Democrat who finally introduced his long-dreaded copy protection bill into Congress last week. If there’s an axis of evil for technology, Hollings has made the list.

Hollings’ bill, formerly referred to as the SSSCA (Security Systems Standards and Certification Act) but now dubbed the Consumer Broadband and Digital Television Promotion Act (CBDTPA), would require any device that can “retrieve or access copyrighted works in digital form” to include a federally mandated copy protection system.

That covers not just your next iPod or Windows Media Player, but just about every digital device with a screen, a printer, an audio jack, a disk drive, a memory stick, or several input/output devices yet to be invented. Your computer, your camera, your car stereo.

CBDTPA’s goal is to force a powerful sector of U.S. industry — makers and sellers of digital hardware and software — to submit to the needs of the smaller but more established entertainment lobby. This legislative approach to copy protection has already riled consumers of digital entertainment who fear that hardware copy protection will make their lives more difficult. But it’s also raising concern among standards experts who already support what is known as “digital rights management” — strategies for protecting copyrighted intellectual property.

Such experts say that by trying to enforce technology standards on a timetable driven by Hollywood’s fears, CBDTPA will more likely undermine existing work toward effective digital rights management. Some say the hypothetical standard sought by Hollings’ bill will only work for major studios. Many are sure it won’t work at all.

Everything you need to know about whom CBDTPA is meant to benefit is summed up near the top of the bill.

The Congress finds:

(1) The lack of high quality digital content continues to hinder consumer adoption of broadband Internet service and digital television products.

Hollings sees the lax demand for these products and services as a dire problem in need of government intervention. “Roughly 85 percent of Americans are offered broadband in the marketplace, but only 10 to 12 percent have signed up,” he said when introducing the bill last week. “Most Americans are averse to paying $50 a month for faster access to e-mail, or $2,000 for a fancy HDTV set that plays analog movies.”

Such consumer behavior might sound to most observers like common sense in a recession, but Hollings offered a different diagnosis: “If more high-quality content were available, consumer interest would likely increase,” he said.

Why isn’t this content available? Digital piracy, the bill says, has prevented makers of “high quality digital content” (sources say Disney and News Corp. are leading backers of the bill) from producing the high-resolution, downloadable movies that would supposedly send Americans running to buy new HDTVs and order fat Net connections to their homes.

CBDTPA lays the blame for piracy squarely at the feet of tech companies:

(7) Competing business interests have frustrated agreement on the deployment of existing technology in digital media devices to protect digital content on the Internet or on digital broadcast television.

Translation: The makers of digital hardware and software are focusing on their own bottom lines, rather than Hollywood’s. Microsoft alone is expected to rake in $29 billion in revenue this year, nearly double that of the entire music biz, and comparable (depending on who’s counting) to the entire U.S. movie industry.

But bundle the whole range of publishing, new media, broadcasting, film, television, cable and satellite communications involved in making and shipping digital content, and the result is a $300 billion sector, according to Andersen Consulting. The larger goal behind CBDTPA isn’t just to keep “Attack of the Clones” from being Napstered; it’s to kick-start consumer demand throughout the entire broadband chain.

In that light, Hollings’ goal may be laudable. But the people who actually create technology standards say his approach is doomed to failure.

Pity the standards wonks: Exceptionally intelligent, extraordinarily focused, and (usually) diplomatic to boot, the people who form the committees that define and maintain the formal rules that let our hardware and software inventions work together have little power outside their own highly politicized worlds. They may define protocols and behaviors worldwide, but they can’t force managers to buy into them, or cajole engineers to implement them properly.

And they’re rarely allowed to speak publicly for their employers, except to utter canned scripts like “Standards are good” or “My employer is a leader committed to standards in our field.”

Take them to dinner, and they’ll follow hilarious one-liners about their colleagues by recanting, with a firm “Don’t quote me on that!” But getting them to talk about Hollings’ bill requires only a sincere promise not to rat them out by name or organization. Then the truth comes out: “Hollywood people know just enough about technology to be dangerous,” one groans, rolling her eyes.

“How many times do we have to tell them? You can’t rely on a hard-coded solution,” says another, waving his chopsticks dangerously close to my nose for emphasis.

Playing devil’s advocate, a thick-skinned journalist can say Hollings’ heart is in the right place, and a nationwide copy-protection standard could help turn the economy around. Assuming a copy-protection mandate is inevitable, what do standards experts think is specifically wrong with CBDTBA? None of them agree on the details. But three common themes emerge:

1) It puts the Federal Communications Commission in charge of a complex hardware/software standard. On this, criticism has been out in the open. “It’s no secret that the federal government has difficulties creating standards for cutting-edge technology,” said Jonathan Zuck, president of the Association for Competitive Technology, in a public statement. “The bill would be more accurately titled the ‘Content Owners Market Promotion Act.’”

2) It may focus on watermarking. Digital rights management (DRM) experts say Hollywood still has hopes for watermarking systems that don’t require the user to identify herself with a security key or password. But watermarking schemes are doomed to failure. In watermarking, the decision is made by software inside the player. A watermark detector inside the player looks at the content and tries to find the watermark, then decides whether or not to play the content. As demonstrated by security researchers like Princeton’s Ed Felten, it’s easy to remove or add a watermark to content, fooling the player. More simply, frustrated consumers could create a market for bootleg players that don’t check for watermarks at all, like the current rush on DVD players that ignore geographic restriction codes burned onto the discs. The decision to play or not to play must be made by the content, not the player, DRM experts warn. It’s tricky, but they’ll get to it — if the industry isn’t forced to accept a compromise standard first.

3) The standard will be a compromise geared toward serving mass-market movies and music. The bill insists the mandatory technologies be “reliable, renewable, resistant to attack, readily implemented, modular, applicable in multiple technology platforms, extensible, upgradable, not cost prohibitive,” and that “any software portion of such standards is based on open source code.” Sounds like a bill drafted by the free-software geeks at Slashdot — but will the result let me protect and promote essays on my weblog just as Sony does its movies, music and games? If not, it would undermine years of work toward global DRM solutions for copyright holders of all kinds, from street poets to operating-system makers.

The music and movie people — and to a lesser extent, e-book publishers — seem convinced that technology companies are just avoiding building an unbreakable content lockbox for them. But to the security experts and the standards-committee members who’ve dedicated their careers to finding solutions, drafting a law ordering the problem to be solved isn’t the “wake-up call” Hollywood is calling it. It’s just the latest Beltway foolishness. Next, they’ll float a bill extending Moore’s Law — to benefit consumers, of course.

Continue Reading Close

Waiting for Wi-Fi

Outside of airports and Starbucks, the wireless Net is still hanging fire. You can build your own node, but who'll hook you up with the rest of the world?

  • more
    • All Share Services

Waiting for Wi-Fi

You’d think there’d be enough laptop-toting yuppies around to fill a Starbucks in San Francisco. It’s been months since the chain equipped 50 of its stores in the area with high-speed wireless Internet access. But a tour of both Starbucks and independent coffeehouses served by the separate Surf and Sip Network uncovers a disheartening trend: Even at the spacious Brickhouse Cafi, newly renovated in the heart of Multimedia Gulch, I’m the only one logged on to a high-speed connection that costs hundreds of dollars a month to operate.

Maybe coffeehouse computing is just uncool, but a key problem is that at this point a Starbucks is one of the few places you can get wirelessly online outside of the office. Never mind that by the end of this year, more than 10 million computers will have 802.11b hardware (better known as “Wi-Fi,” for wireless fidelity) installed. The hardware may be there, but easily accessible networks connected to the Internet are not.

Opening my iBook in any of the urban parks where the locals get their afternoon sun quickly becomes an exercise in frustration. Sure, there are networks — several of them always show up on my Mac’s menu. But they’re either private nodes for nearby offices (“Rosai Group”) or inscrutable private links (“zoom0332″). Every one I try either prompts for a password I don’t have, or rejects me outright.

Techie folklore says that “war drivers” — wireless hackers who cruise the streets in cars tricked out with giant antennae and military-strength amplifiers — can surf any local Wi-Fi network at will. Maybe they can, but I can’t.

Despite the buzz over unplugged coffeehouses, free community networks and war driving, jacking in to the wireless Net is still next to impossible. Even in cities like New York, Seattle and San Francisco where public wireless projects are prevalent, working access points are rare. Technology writer Mark Durham, currently in the process of mapping all available Wi-Fi nodes in San Francisco, says you’re better off looking for a pay phone. “I’ve got about 105 listed,” he says. “But that includes Starbucks.”

If there’s one technology that doesn’t need evangelizing, it’s wireless Net access. But while there are some start-ups out there, such as EarthLink founder Sky Dayton’s Boingo, that may succeed in leading us to the promised wireless land, there are also plenty of prominent failures. Metricom’s late, lamented Ricochet network comes immediately to mind.

Wi-Fi Nation is on indefinite hold, at least until computer-carrying consumers can roam beyond the invisible tether of the base station at the office, or the AirPort in the family den. With tens of millions of customers ready to be wireless by next year, and the price of a Wi-Fi laptop dropping below $1,000, why isn’t AT&T setting up antennae for us, instead of shutting down its Digital Broadband service?

The answer is less about technology than the shifting flows of capital in the 21st century. The wireless Internet won’t be rolled out telecom-style, like DSL or cable modems. In the wake of embarrassing failures to create top-down networks, it will be built from the ground up, by a patchwork quilt of players. Imagine the gradual knitting together of cellular roaming service in the ’90s, but with 10,000 antenna owners rather than 10 giant carriers. Rather than risking billions of investors’ dollars on a ubiquitous rollout, entrepreneurs will play for smaller stakes in more proven local or niche markets: When we come, they will build it.

So how do you turn a grass-roots infrastructure into one system that customers can connect to almost anywhere? That’s where Sky Dayton comes in. The boyish founder of EarthLink, which grew from a small dial-up Internet service provider into a service second only to AOL in size, recently launched Boingo, a nationwide wireless ISP that doesn’t operate any access points. Rather, Boingo pops up its branded “Connect” button whenever any one of thousands of its individual Wi-Fi partners’ networks are in range. Customers pay a monthly fee to Boingo and the company then splits its revenue with the network owners.

Right now, Boingo has fewer than a thousand sites signed up nationwide — a piffle of the millions needed for ubiquitous coverage — but Boingo is the first high-profile consumer offering of roaming Wi-Fi service.

“Until Boingo, you really had to know what you were doing to find these networks and connect to them,” Dayton says, likening the current status quo to the early days of the dial-up Net. “We’re at that stage where you’ve got to know to set your modem to 2,400, 8 bit, and have the right serial cable.”

As Dayton learned at EarthLink, luring enough customers to build a sustainable business requires both removing those technical hurdles, and building a larger and larger “footprint” over which subscribers can connect just as if they were at home — a local call in EarthLink’s case, a one-click connection for Boingo users.

But while Dayton, a self-described “über-aggregator,” sees Wi-Fi as “the next frontier of the Internet,” Boingo still relies on someone else to invest in building the network, and that’s a hot potato in the aftermath of blowouts like Metricom and Mobilestar, which went bankrupt last year wiring Starbucks so I could have the whole place to myself.

The biggest scarecrow is Metricom, whose Richochet antennae — not Wi-Fi, but a wireless Internet service nonetheless — now sit dormant atop lampposts from San Jose, Calif., to Washington, D.C., warding off would-be imitators. One Wi-Fi entrepreneur sighs, “I think Metricom had happy customers. Just not enough of them.” A new owner hopes to restore Ricochet service late this year, but in limited high-subscriber areas.

“This is the great lesson being taught to the wireless industy,” says Bennett Kobb, author of Wireless Spectrum Finder, a reference book on U.S. bandwidth. “These vast systems like Iridium that require a global rollout before you earn one penny will fail, as opposed to these incremental systems based on local coverage.”

Setting up network infrastructures sounds like a job for the phone company, but the big wireless carriers like Sprint PCS and Cingular have a very different idea of what “wireless Internet” means than do Web-surfing Wi-Fi junkies.

“Messaging — SMS — is probably our biggest area of use,” says Steve Krom, Cingular’s vice president of business marketing and product development. “When you look at the wireless Internet specifically, what people are really looking for is the basics — news, sports, stocks and looking up very specific info related to their life.” All of which Cingular delivers, in limited fashion, via phone screens and two-way pagers that eschew normal Web access and existing e-mail accounts — you won’t be blogging from your phone anytime soon.

There are three good reasons for telecom companies to be wary of investing heavily in Wi-Fi. First, the FCC has set up 802.11b bandwidth as free, unlicensed spectrum. The telcos’ preferred strategy has long been to own the spectrum they occupy completely, rather than sharing it with every competitor who comes along. That’s what roaming agreements are for. But with Wi-Fi, jumping ship to a better deal is as easy as changing a menu setting on the new PCs and Macs. There’s no equivalent to a cellphone number you can’t take with you to discourage you from churning through providers.

Second, the telcos still have a previous legacy of spending to recoup. They’ve invested billions of dollars in third-generation wireless spectrum licenses, in order to have exclusive rights to serve high-bandwidth 3G phones — devices that fall short of what Wi-Fi offers in many ways. Verizon alone spent $8 billion on 3G spectrum rights. Writing off those costs and spending further on Wi-Fi, which doesn’t serve as a direct upgrade for their current phone subscribers, would be worse than throwing good money after bad.

The biggest roadblock, though, is the technology itself. A cellular phone antenna can reach for miles, but Wi-Fi has a range of only 100 to 300 feet at best. “It’s not carrier-ready technology,” says David Ticoll, CEO of research firm Digital4Sight in Toronto. “You’d have to put a base every couple of hunded feet, which means getting right of way [from property owners]. At any time, some number of those bases are going to be broken. It’s not an easy thing to roll out logistically on the scale that people have been talking about. And imagine if you stuck out a whole bunch of 802.11b base stations and then your customers said, ‘I really want the new 55 megabit stuff instead.’”

Wi-Fi works in the home and office because it cuts costs — if only in time wasted crawling around with cables — for the same people who install it. Get into public spaces, though, and it’s not clear who gets the benefit, beyond a few early adopters.

“The demand for wireless isn’t what you would expect,” admits Surf and Sip founder Rick Ehrlinspiel, whose six-person company manages about a hundred nodes in several cities. “That’s going to change as the price of a wireless-equipped computer drops below $1,000,” he adds — many laptops now come with built-in hardware instead of an add-on card — but Surf and Sip has had to cut staff and switch network carriers to survive until the demand grows.

With money for new hardware tight, every single access point is now open to review: Who’s paying? What will it cost? Who will get the benefit? Even the newly expanded San Francisco International Airport in the heart of Silicon Valley still doesn’t have a network. (Wi-Fi execs are wary of being quoted, but several claim a mix of internal politics and upfront payment demands crafted in the dot-com era leave aspiring providers with too little in return for the installation.)

Boingo unintentionally raised the cost-benefit issue among the free-wireless movement. Spokespeople for community wireless groups in New York, San Francisco and Seattle claim they had their members’ sites removed from Boingo’s database, since a DSL subscriber who overshares his line with the public faces a steep increase in monthly fees. “Anyone who thinks $50 to $70 a month covers 1.5 megabits per second maxed out all the time is deluding themselves,” says Mike Durkin, president of Raw Bandwidth, a DSL provider in Belmont, Calif. “Bulk bandwidth still costs us $400 to $600 per megabit per second.”

Nonetheless, the share-the-LAN crowd are doing valuable amateur market research on where the hot spots are. “My old place was near the [Highway] 101 entrance,” says science fiction author Cory Doctorow, who keeps his personal network open and lists it in an online Bay Area directory. “I got a fair number of people who needed to get their mail before getting on a plane pulling up in front of my house and hopping on my network.”

You see, despite the absence of wireless Starbucks grande latte drinkers, wireless demand does exist. Doctorow’s front yard had become a feeding trough for the very people driving Wi-Fi’s adoption: the same traveling salespeople and frequent fliers who made cellphone service a must.

“We’re at the early adopter stage,” Dayton says. “The people buying Boingo are power users and business travelers. Their alternative is a slow dial-up connection, which means being unproductive while traveling. And if someone sends them a PowerPoint attachment on a modem connection, they miss their plane.”

Glenn Fleishman, who maintains the industry-tracking 802.11b Networking News, agrees that Wi-Fi’s hot spots are along the paths beaten by frequent fliers.

“Travelers are doing personal risk management now,” he says. “They think, if I get stuck at the airport for six hours, I want to be able to get some work done. That’s worth the extra half-hour drive or cab ride to San Jose instead of San Francisco, so I can get online.” Indeed, one of the pieces of collateral that got Boingo funded was a survey that indicated 97 percent of business fliers surveyed in airports said they based their hotel and airport choices in part on Internet accessibility.

“These are the people that carry laptops when they travel — there’s 27 million of them in the U.S.,” Dayton says.

Follow those 27 million overachievers and you’ll find them connecting through Boingo’s biggest partner: Wayport, one of the few broadband success stories. The company is augmenting its previous high-speed cable jacks with Wi-Fi bases at airports including San Jose, Dallas-Fort Worth and Seattle-Tacoma. Wayport’s 4,000 or so access points are arrayed along the heavily traveled paths through airports to business hotel chains like Four Seasons, where 1.5 megabits is no longer called a luxury.

“Our partners come to us and say, ‘I’m going to lose customers over [Wi-Fi access],’” says Dan Lowden, Wayport’s vice president of marketing.

Wayport’s deal with Boingo is just a small part of its business. The company already sells its own memberships, and also partners with iPass, a provider of global employee Internet access to a couple of thousand corporations, including SAP and other giant consulting firms. For Wayport and iPass customers, Wi-Fi is one part of a larger connection toolbox, for business clients who need to get online by any means necessary, and are willing to pay for it.

Boingo is taking a different tack: It’s focusing on Wi-Fi as a separate, fledgling technology, and betting a proven name like Sky Dayton can get the modest venture capital necessary — not to build a nationwide network, but to leverage the hodgepodge of infrastructure being installed by Wayport and others. In return Boingo offers network builders a return on their capital investments, by bringing them new customers and splitting the proceeds.

If this patchwork approach sounds too flimsy to work, remember: It’s how the Internet began, and how cellphone service worked decades before Cingular arrived on the scene.

“Remember cellphones in the old days?” says Surf and Sip’s Ehrlinspiel. “You had to sign up with a different service for the next town over, because there was no roaming. And you had to carry different phones for different cities.”

Ticoll agrees the growth will be bottom-up rather than top-down. “This is going to happen as a patchwork quilt in people’s homes, offices, factories,” he says. “As it becomes economical, fun and easy, then we’ll have a mess on our hands. Classic North American wireless strategy.”

And that’s when the big phone companies will finally step in, just as they did with cellphones — making an already successful service more homogenous, seamless and mass-market friendly. Cingular’s Krom says wireless carriers may announce plans around Wi-Fi as early as this year, but don’t expect them to go rushing into the business burning big bucks.

“Most of the pioneers in this space have either gone out of business or aren’t doing very well financially,” he says. “Their business models were broken. In order to go into places like hotels, they gave way too much away from a revenue standpoint.”

Fleishman also thinks it makes sense for the telcos to wait. “Compare a few hundred Wayport locations to the number of cellular antennas in America,” he says. “It’s not even worth doing the math.”

Instead, wireless carriers are making cautious, smaller investments in safer circumstances than installing 802.11b en masse. Most recently, MobileStar’s assets have been picked up by VoiceStream, a move entrepreneurs and analysts unanimously cite as a milestone in the entry of the telcos. And part of Boingo’s $15 million first-round funding came from none other than Sprint PCS.

Dayton doesn’t doubt that if he’s successful with Boingo, the big boys will be coming around. “Right now our biggest challenge is just market inertia, and explaining the technology to people” he says, “but I’m sure in the future we’ll have plenty of competition — in fact we’ll have zillions of competitors.” And suitors, including Sprint PCS.

It might seem unfair to the scrappy crowd of Wi-Fi hackers installing their own access points around town, and to the entrepreneurs building the wireless Internet one coffeeshop — or one hotel chain — at a time. Once they reach critical mass they’ll be snapped up or steamrollered by the same telecom giants currently touting 3G phones (or 2.5G phones, or 4G phones — does it matter?). It shouldn’t be a surprise, though: That’s the way it went with cellphone start-ups in the ’80s, and with the mom-and-pop ISPs acquired by Sky Dayton in the ’90s.

Indeed, by the time I can fearlessly open my iBook anywhere in California, it’ll probably involve writing checks to SBC or Cingular. But if someone can eventually leverage the crazy quilt of Wi-Fi to let us get online from wherever we happen to be, will we really care if it’s Boingo or the Bells? Meanwhile, risk-takers from Surf and Sip to Wayport can at least take pride in the moment: While others wait around for the next big market boom, they’re unlocking smaller, safer pockets of capital to bring us the next stage of the Internet.

Continue Reading Close

Don’t steal music, pretty please

Record companies will make big, big money online. They just need to learn to let go.

  • more
    • All Share Services

Don't steal music, pretty please

I knew the fight between the record industry and Internet users was going to work out OK as soon as I saw the print ads for Apple’s iPod MP3 player. Nested at the bottom of the page is a comical disclaimer: “Don’t steal music.” Ha ha! With its thousand-song capacity and easy-to-use interface, everyone knows iPod is a great incentive to go out and steal more music to fill it with.

Think back to three years ago, when the first portable MP3 player debuted. The Recording Industry Association of America sued Diamond Multimedia to halt shipment of its cute little Rio, which held only an hour’s worth of music. This time, the major labels are willing to let Apple sell a portable player for pirated tunes (100 CDs’ worth of them at a time!) in exchange for a laughable admonishment to its customers: Don’t steal music, kids.

If this seems inconsistent coming from the same industry whose lobbyists brought us the DMCA and are now pushing the SSSCA bill that would require all consumer electronics in the U.S. to come with anti-piracy technology built in, it’s because the record companies are pursuing two goals at once. Long term, they need to come up with a way to sell music online that consumers will buy into. In the meantime, they are desperate to keep the entire store from being pilfered.

Jim Griffin, the Cherry Lane Digital CEO who handles rights management for songwriters and movie studios, says the shouting about pirates and anti-theft devices is a deliberate short-term distraction, meant to keep the rest of us occupied until the big players can agree on a cash-flow model for downloadable entertainment. “There may be a division of Sony building encrypted players in all earnestness,” he says, “but there’s no way the heads of the company believe that’s their long-term strategy. So much of this DRM [digital rights management] stuff is just sending husbands out to boil water while the wives have the baby.”

We got a first peek at the baby last week: A little-noticed announcement by America Online was, in truth, the moment we’ve all been waiting for. AOL has debuted its fledgling music subscription service, MusicNet, for $9.95 a month — less than the price of even one CD. AOL execs downplayed the launch as a beta test, but coming from the unquestioned leader in online access, a company known for the Mom-and-Pop friendliness of its software, it’s unmistakably the beginning of the end for the war between the music industry and the Net.

Only the beginning, though. MusicNet suffers from the same sort of restrictions and hurdles that sent people running to Napster in the first place. There’s a monthly limit on downloads, and there are technical restrictions to keep customers from burning everything they can get their hands on to CD. And MusicNet only offers music from three of the big five labels — Warner, Universal, Sony, BMG and EMI — with no independent releases.

To really succeed, AOL’s music service needs to be as good as the free and easy alternatives. Pricing needs to be an all-you-can-eat bundle rather than a complicated set of restrictions that thwart customers at the moment of fulfillment. AOL should know: The company pioneered flat-rate ISP billing in 1997 and made it an industry standard despite the initial pains caused by a rush of customers who simply left their modems dialed in. Music should be offered the same way: Once you’ve paid to get in the door, listen to as much as you want.

Likewise, the industry needs to let go of attempts to impose Byzantine copy-protection schemes on consumers, as suggested by the SSSCA bill being drafted by Sen. Fritz Hollings, D-S.C. Remember the complicated copy-protection schemes on software floppies? We can only imagine the number of profit-killing phone calls to customer support: “It won’t play.” My own attempts to use MusicNet’s beta were frustrating, clearly because of code designed to stop me from playing music not covered by the terms of my subscription, a technical feat much harder to pull off than just letting me go ahead.

Indeed, the pointless attempt to control copyrighted data every step of the way from musician’s voice to listener’s ear is the biggest roadblock to success for online music. Just as HBO doesn’t try to stop you from taping its movies, so music sellers need to let go and trust their customers. Remove the incentives for people to steal, rather than imposing more technology that treats customers as would-be shoplifters. Even former BMG head Strauss Zelnick, who says he has no problem throwing big-time bootleggers in jail, agrees the industry’s challenge is to come up with an attractive alternative to Aimster and its ilk. “We need to give consumers a service they want, at a price they’re willing to pay,” he told me in an interview this summer. “People don’t like to think of themselves as criminals.” But ironically, the more anti-theft hurdles crammed into the legal products, the more attractive the pirate alternatives become.

Surely they know that by now. Given the ample evidence from researchers like Edward Felten that there’s no technological way to stop bootlegging, it’s hard to believe the heavy-handed application of the DMCA and lawsuit threats is anything other than a stall for time — sending husbands to boil water — until the stakeholders can agree on how to tap and share the lucrative Internet music channel.

A monthly subscription shouldn’t require the customer to stop and wonder every time she wants to play a tune: Do I have my license key? Which players will this work on? Which record label is the singer on and what subscription services carry that one? Why won’t it play? Ugh. The threat of ubiquitous digital licensing, copy protection and monitoring isn’t that Big Brother will know what you’re listening to; it’s that you’ll give up trying to listen to it.

There’s no business need to monitor every song every surfer on the Net is listening to, anyway. Griffin points out that radio airplay royalties have long been based on samples taken from station logs — actuarial fees, rather than actual fees. “Radio stations have the option to pay exactly per song played,” he says, “but not many of them use it. After 15 years, we’ve learned there isn’t much difference between the sampled numbers and the individually counted numbers.”

Even my local coffeehouse pays an insurance-like annual fee to ASCAP, the songwriters’ agency, to cover the likelihood that one of its open-mike night troubadours will do a Pete Seeger tune and incur royalty fees for the house. And whenever I buy a new blank cassette to record phone interviews, I pay a few extra cents that goes to the major labels in case I use it to bootleg one of their recordings. Why can’t my ISP just add on such a tax, send it to the major labels and let me download anything I want, any way I want? There’s no one pricing scheme that will make everyone happy, but bundled payment options are a lot more attractive than trying to stop people from doing what they will.

It may happen. “Don’t Steal Music,” rather than the complicated copy-protection system Apple could have jiggered into the iPod, gives me hope the music industry is finally figuring out its place in a world being remade by the Internet and a global economy. As a longtime musician and sometime D.J. myself, I’ve seen firsthand that the big five are in it not to make music, but to make money. But the industry’s annual revenue of $15 billion is, on a global scale, peanuts — Web hosting alone pulls in more than three times that much. Already, the big five record companies are losing their grip as evil Masters of the Universe, becoming instead the mere henchmen of new broadband empires. Warner is part of AOL, Universal is merged with Vivendi, and Sony makes far more from Playstation than from Michael Jackson. In the 21st century, record execs are finding themselves on the other side of the negotiating table: Yes sir, Mr. Case.

In that light, Bertelsmann’s partnership with Napster was a smart move to secure a future for itself. Napster had reenergized millions of music fans, who held its brand dearer than any record label. But that excitement is fading with every day we wait for the people who own the music to let go enough to make buying their wares easier than bootlegging them. Instead of telling us not to steal, how about just giving us a way to pay?

Continue Reading Close