An Extraordinary Music-Streaming Scam

A glimpse into the grim AI-inflected future - and a possible answer to the question "Why does so much music suck on Spotify?"

Some of you may recall that several months ago the band I play in ("Bad Dog") was embroiled in a rather unpleasant copyright infringement episode (see my earlier blog posting here) in which recordings from an album we had recently released had been copied and distributed to all of the major music-streaming platforms (Spotify, Apple Music, Amazon Music, etc.) without our permission and under new song titles and new (and pretty obviously fictitious) "artist" names.

David Segal of the NY Times picked up the story and published an (excellent) article about it that ran on the front page of the Sunday Times Business Section, which generated a fair bit of buzz in music industry circles.

Shortly after the article came out, I was contacted by someone in the US Attorney's office in NYC, and I was subsequently interviewed for an hour or so by an investigator from that office, to whom I gave as many details as I could about what had happened to us, and to our files.  He didn't say - and I didn't ask - what his purpose was in gathering all this information, but I had the impression that they were engaged in some sort of ongoing investigation involving the music-streaming business, and wanted to see if our problem was possibly related somehow to something that they were already looking into.

It turns out there was indeed an ongoing investigation, which has now yielded an indictment, released last week, alleging that Michael Smith, a musician from North Carolina, "orchestrated a scheme to steal millions of dollars of musical royalties by fraudulently inflating music streams on digital streaming platforms such as Amazon Music, Apple Music, Spotify, and YouTube Music."

The DOJ announcement of the unsealing of the indictment is available here; the full-text of the indictment is here.

The indictment contains some pretty astonishing details; I urge anyone interested in how the music industry works these days to look it over.

Here's how Smith's scam allegedly worked (all quotations are from the indictment):

First, he contracted with an AI firm specializing in music production (unnamed, and referred to as "Co-Conspirator 3" in the indictment) to deliver newly-created "songs" to him, and to transfer all the rights in those songs to him. The quality of this material may be inferred from the fact that the contract obligated CC-3 to deliver up to 10,000 "songs" to Smith every month, and the indictment alleges that between 2019 and 2024, CC-3 produced hundreds of thousands of songs for Smith.

SMITH then "created randomly generated song and artist names for audio files so that they would appear to have been created by real artists rather than artificial intelligence."

The indictment gives these examples.  First, an "alphabetically consecutive selection of 25 of the names of the AI songs SMITH used:

"Zygophyceae," "Zygophyllaceae," "Zygophyllum," "Zygopteraceae," "Zygopteris," "Zygopteron," "Zygopterous," "Zygosporic," "Zygotenes," "Zygotes," "Zygotic," "Zygotic Lanie," "Zygotic Washstands," "Zyme Bedewing," "Zymes," "Zymite," "Zymo Phyte," "Zymogenes," "Zymogenic," "Zymologies," "Zymoplastic," "Zymopure," "Zymotechnical," "Zymotechny," and "Zyzomys."

Second, an alphabetically consecutive selection of 25 of the names of the "artists" of the AI songs SMITH used :

"Calliope Bloom," "Calliope Erratum," "Callous," "Callous Humane," "Callousness," "Callous Post,"(Uncle Callous!!) "Calm Baseball," "Calm Connected," "Calm Force" "Calm Identity" "Calm Innovation" "Calm Knuckles" "Calm Market" "Calm The ' ' , ' ' Super," "Calm Weary," "Calms Scorching," "Calorie Event," "Calorie Screams," "Calvin Mann," "Calvinistic Dust," "Calypso Xored," "Camalus Disen," "Camaxtli Minerva," "Cambists Cagelings," and "Camel Edible."

To get his songs posted to the music-streaming platforms, Smith contracted with at least two different music distribution companies - a "Manhattan-based music distribution company ("Distribution Company-1") [and] a Florida-based music distribution
company ("Distribution Company-2")."

Meanwhile, Smith created several thousand fake email accounts which he then used to create fake "bot" user accounts at the major streaming platforms. At one point he had over 10,000 active bot accounts on the major platforms. He then programmed the bots so that they would stream "his" songs, over and over again, 24/7.

"After registering the Bot Accounts, MICHAEL SMITH, the defendant, then caused the Bot Accounts to continuously stream songs he owned using the following methods:

a. SMITH used cloud computer services so that he could use many virtual computers at the same time.

b. SMITH used some of the Bot Accounts on each virtual computer at the same time. SMITH typically used the web players for each of the Streaming Platforms, and had a number of Bot Accounts simultaneously streaming music on separate tabs in internet browsers on the virtual computers.

c. SMITH purchased-and subsequently modified-"macros," or small pieces of computer code that automatically continuously played the music for him."

As a result, Smith "obtained millions of dollars in royalties based on the artificially inflated streams of his music."

"On October 20, 2017, MICHAEL SMITH, the defendant, emailed himself a financial breakdown of how many streams he was generating each day and the corresponding royalty amounts. In the email, SMITH wrote, in substance and in part, that he had 52 cloud services accounts, and each of those accounts had 20 Bot Accounts on the Streaming Platforms, for a total of 1,040 Bot Accounts. He further wrote that each Bot Account could stream approximately 636 songs per day, and so in total SMITH could generate approximately 661,440 streams per day. SMITH estimated that the average royalty per stream was half of one cent, which 7 would have meant daily royalties of $3,307.20, monthly royalties of $99,216, and annual royalties of $1,207,128."

Nice work if you can get it!

Smith has been charged with wire fraud, conspiracy to commit wire fraud, and money laundering.  Notice: no copyright infringement here, unlike in our Bad Dog example, because whatever else Smith might have been doing, he did own the copyright in the "songs" that were composed for him.

Needless to say, I have absolutely no idea whether these allegations against Smith are true, let alone whether they can be proved beyond a reasonable doubt.

But it's pretty clear that whether or not Smith is guilty as charged, someone could have done - and may still be doing - what he's been charged with. That is, as a technical matter, nothing in what Smith is alleged to have done strikes me as impossible, or even particularly difficult, at least for someone who has substantial programming chops - like, say, your clever teenage nephew.  And given the money that can be made by a scam like this, it's hard to believe that nobody else is in on the game.

And that, I have to say, bums me out.  It's like Gresham's law: bad music will chase out good music. If the streaming services are clogged up with garbage, real musicians will be less inclined to use them to distribute their music.  And that, I would say, is a real loss.

Comments

[DaveM]

Not copyright infringement, but you bet a violation of the Terms of Service of the streaming hosts and a fraud against the licensing agencies. I agree this is not difficult to replicate technically, the weak link in the chain is how trivially easy it is to create the bot accounts -- both the "creators" and the "consumers". We had similar issues with email in the beginning, it was (technically) trivially easy to impersonate an email account. The hosts later adopted several layers of authentication and security so this became much, much harder to do.

[wolfefan]

I kind of like the name "Calvinist Dust" for a band.

[mulched]

The Cambist's Cagelings could definitely be a pseudo-intellectual metal band.

[IANNAL]

You must be on Camel Edibles

[Bubba Jones]

Would it be fraud if he set all these bots up to actually play music in his house?

How does his goal of driving traffic for royalties differ from any other artist?

I get the metaphysical, and ethical difference. It just *feels* wrong, but is it?

Presumably he's violating an agreement he made with the service when we uploaded the music.

[Bubba Jones]

Guidelines that prohibited, "artificially increasing play counts or follow counts, artificially promoting Content, or other manipulation including by (i) using any bot, script, or other automated process."

The indictment does a nice job explaining how his inflated bot streaming would divert royalties from other writers and performers.

That answers my question.

[David Nieporent]

How does his goal of driving traffic for royalties differ from any other artist?

Because he wasn't trying to drive traffic; he was trying to trick the company into thinking there was traffic.

[Both Sides]

Interesting and depressing. Good luck with your band.

[Jerry B.]

But no one could possibly create fictional people to register and vote online.

[Zarniwoop]

Well, if you’re a fool enough to believe that voting in local, state, and Federal elections is exactly the same as an internet poll to name a boat, you’re not wrong.

https://en.m.wikipedia.org/wiki/RRS_Sir_David_Attenborough#Naming_poll

[jb]

Yes, yes. Signing up for a free Spotify account and registering to vote are just the same with similar levels of record keeping and scrutiny. Great analogy. /s

But even if you assumed both things were kind of the same, this guy managed to divert something like a hundredth of a percent of Spotify's royalty stream (and still got caught!) Even the closest state elections in 2016 and 2020 were decided by significantly greater margins. If he'd tried to up the fraud to something like 1% of royalties, he'd have been caught much faster. This is the principal objection to election fraud paranoia: not that it's impossible to produce fraudulent votes, but to do so at sufficient scale to change an election outcome without being noticed.

[Zarniwoop]

I made an obvious, sarcastic comment to "Jerry B." pointing out that the system design matters. But I think "jb" and I might be arguing the same side here!

But even if you assumed both things were kind of the same, this guy managed to divert something like a hundredth of a percent of Spotify’s royalty stream (and still got caught!) Even the closest state elections in 2016 and 2020 were decided by significantly greater margins. If he’d tried to up the fraud to something like 1% of royalties, he’d have been caught much faster. This is the principal objection to election fraud paranoia: not that it’s impossible to produce fraudulent votes, but to do so at sufficient scale to change an election outcome without being noticed.

I agree with "jb". There are potential exploits for every system, all the way down to paper ballots (who controls registration; what are verification and cross-check steps?). Scale matters. And risk/reward matters. And in elections, votes can be checked against the existence of real people, which are not fungible like fractional pennies per stream. And more resources go into election security than private streaming payouts.

So again I agree: I don't think electronic election fraud would be scalable using the exploit model of the streaming case. That's not to say that a different exploit is impossible; but the streaming case does not make a good argument against electronic voting. Even if "Jerry B." was trying to spin it that way.

[SRG2]

As an aside but kinda related - and fun - the only case I'm aware of wrt classical music is the Joyce Hatto case. It's a good one because it exposed some classical music critics as, essentially, frauds.

Hatto was a pianist. Her husband released CDs of other artists, slightly modified, as though they were hers.

https://www.woodpecker.com/blogs/joyce_hatto.html

[Roger S]

The feds are over-charging what is really a simple violation of the terms of service. Count 1 is conspiracy, but there is only one defendant. Count 3 is money laundering. It appears that the feds can charge money laundering whenever there is money involved.

[David Nieporent]

It appears that the feds can charge money laundering whenever there is money involved.

Essentially. The popular notion of money laundering, that one would glean from tv/movies — that one use some sort of financial trickery to make illegally-obtained funds look like they came from a legitimate source — is far narrower than the statute.

[loki13]

" It's like Gresham's law: bad music will chase out good music."

Increasingly, the internet in general (and life, maybe?) is having a signal to noise ratio problem. Scammers and miscreants are using tools to automate the process of harassing and defrauding us faster than we can stop them.

Despite various services, I still refuse to answer phone calls unless I know the person calling. Because there are just so many scam/robocalls. And unfortunately, they work, especially on the elderly.

And then there are the scam texts, either with links or from a number I don't know and a cryptic, "Hey, how are ya?"

Email? HA! Go and look in your junk folder for public emails. If you have a great work account, you won't believe how much email gets blocked from you ever seeing it. But even when I get emails from people I know, I am careful, because idiots get hacked all the time.

And it's on websites. Social medial platforms. Music streaming.

There is so much to love about modern technology, but having to fend this off all of the time is tiring.

I wish that a party or candidate would make this a real priority. That's a quality of life issue for a lot of people.

[ReaderY]

Whenever the person who pays is different from the person who receives the goods or services, there is incentive to defraud by creating records of fictitious goods and services to fictious customers to obtain the real-money payments from the real payer.

This is in the same family as Medicare/Medicaid fraud, insurance fraud, etc. It may be a particuarly high-tech member of the family, because AI here permitted creating the false records in an automated, industrial-scale way that enabled very large numbers of small fraudulent transactions to add up to a big payout. But it’s still the same basic kind of fraud as the other, more old-fashioned kinds.

[Old Smokin' Egg]

Whence the money that the streaming service paid to Smith? Presumably, his bots weren't paying a fee for each piece of music that they streamed—otherwise, he'd be taking a loss on each one. Do the streaming services finance themselves by selling advertising, and remit some of that revenue to the providers of the music?

[mulched]

Yes. Also subscription revenue for ad-free service for into the royalty pot.

[jb]

Even if he was paying for the service for each bot, there's a big arbitrage opportunity here. As long as you listen to more streams than the average subscriber, you will be sending more money than average to the artists that you listen to. Spotify only keeps about 25% of revenue, with the rest paid out in royalties, so you only need to listen to 33% more streams than the average user for this scheme to be profitable. If your bot is listening to music 24 hours a day, you'd be significantly profitable on a per-bot basis and then you just scale up the number of bots until you have as much income as you want, run out of hours in the day to run your scam, or get caught.

[M L]

Yeah. I suspect this scam likely required paid bot accounts to work.

[Zarniwoop]

I also assumed that the bot-created songs were shorter than average, so that the bot-listeners could listen to more streams/day and thus generate more payouts per bot-listener (assuming the payouts are "per stream" not "per minute).

No way the bot songs were 20mins+ extended guitar wankery from the mid-70s. If the average song is 3 minutes, but the bot-created songs average 1 minute, that could significantly increase (by 3x) the payout ratio per paid account.

[M L]

With a free version of spotify, you hear ads. But with the free version, you also can't choose to listen to particular tracks or artists on demand. So I'm not sure that would work. You can choose to listen to "radio" based on a particular track or artist, so maybe that would focus enough on the specified artists that it would work with a free account.

[Zarniwoop]

I assumed that each bot-listener must have a paid account, but most streaming services that I'm familiar are flat fee per month, rather than a per-listen fee.

This suggests an alternative model for streaming services that would nuke this exploit model from orbit: a flat fee (say $5 or $10) for the basic setup, then one penny per stream. The artist gets 0.9 cents per stream (the remaining 0.1 cents per stream covers added marginal data cost).

So no matter how many fake streams are played, the bot-listener pays 0.1 cent, rather than generating profit once the flat fee per month is covered.

But lots of customers like an actual flat fee (don't have to think) so it may be a hard sell to many people.

[jb]

And that, I have to say, bums me out. It's like Gresham's law: bad music will chase out good music. If the streaming services are clogged up with garbage, real musicians will be less inclined to use them to distribute their music. And that, I would say, is a real loss.

I don't think this follows. Based on everything we know, this was basically robots listening to robots without affecting what humans listen to at all.

The only thing that somewhat affected the human music ecosystem is that some royalty revenue was stolen from legitimate artists, but the result was a tiny of a fraction of a percent being deducted from every legitimate artist's income rather than some specific set of artists losing a significant amount of revenue. That's obviously unfair and (as it turns out) illegal, but given the tiny amount of money per artist, would not change their ability or inclination to continue to produce music for other humans to listen to.

[Zarniwoop]

I don’t think this follows. Based on everything we know, this was basically robots listening to robots without affecting what humans listen to at all.

I think that’s self-evident in the exploit model: there had to be (tens of) thousands of bot-artists and hundreds of thousands (or millions) of bot-songs so that no individual song or artist would rise above noise level. If a single song/artist starts getting even 0.1% of Taylor Swift streams/revenues, someone will start asking how to find their booking agent, and the scam falls apart.

[M L]

This doesn't really "clog up" spotify in any way. That's not how it works.

It maybe drains funds from Spotify, though, and potentially from other artists.

[tuphat]

As long as my Yacht Rock is safe, and nobody messes with my levels.