The morning during/after the launch of iTunes Plus yesterday was a rough one for the iTunes Store, but users were generally pleased with their newfound freedom. Or so they thought. Not long after the launch, sites like Ars and TUAW observed that the DRM-free songs carried identifying information—the same identifying information that was embedded in other, DRMed songs that were purchased from the iTunes Store. While the information itself isn't necessarily a threat, Ken wrote on the front page that it would be trivial for Apple to report back that Joe User's songs keep mysteriously showing up on Jane Userette's hard drive and ultimately catch them for file sharing.
Well, the Electronic Frontier Foundation picked up on this newfound information about the embedded personal data and investigated a bit further. As it turns out, the DRM-free AAC files from iTunes contain more than just names and e-mail addresses. While they decoded some DRM-free AAC files to PCM/WAV and found that there isn't a watermark in the compressed audio signal, there are "surprisingly huge differences" in the encoded files. "Much bigger differences than just different tags, or even different signed/encrypted tags," the EFF wrote.
We compared two DRM-free copies of the track Daftendirekt by Daft Punk. When decoded to PCM/WAV data, both copies produced an identical audio signal (the MD5sum is e40b006497f9b417760ca5015c3fa937). So there is no audio watermark. But one of the .m4a files is almost 360K larger than the other!
We haven't finished examining these differences yet, and we don't have in-house expertise on MPEG codecs, but some of them have an intriguing amount of structure. There's a region (see around offset 0x11470 in the Daft Punk track for example) where the files contain what look like tables with sequential indices but different data in the table.
The EFF doesn't claim to know exactly what's in the apparently structured data, but they theorize that there might be "large amounts of iTunes library data" present in every one of those files. Either that, or Apple has watermarked the AAC encoding itself so that it would be significantly harder for users to anonymize themselves from the files after purchasing.
Either way, everyone should be aware that while DRM-free files may lift a lot of restrictions on our personal usage habits, it doesn't mean that we can just start sharing the love, so to speak. Sharer beware.