Do purchased DRM'ed ebooks have any personal user info stored in them?

[MikeB1972]

Originally Posted by drjenkins

Using personally identifiable watermarks is known generically as Social DRM. BooXtream is just one company that provides such a service.
https://www.booxtream.com/

Yes, the question was more about if encryption based DRM also includes hidden social DRM as a backup.

[DiapDealer]

Kindlebooks have scads of obscure metadata in them. You can, of course, easily check it all out AFTER you convert them to epub, but who knows what kind of identifying features/tokens are lurking (or can be placed) in those drm-free binary originals I keep as back-ups? Better I guard them like I could get into trouble if they fell into the wrong hands than to not.

[soondai]

Originally Posted by Pablo

The only way to know if any account information is embedded in a book is to buy two copies of the same book, at the same time, using two different accounts, DeDRMing both and making a binary comparison of the resulting files.

with all the whizs around here, I am surprised no one has done something like this

[NonDuality]

Originally Posted by soondai

with all the whizs around here, I am surprised no one has done something like this

Exactly my thought!

Also, found this interesting line on A.Alf's blog -

Once the DRM has been removed, is there any trace of my personal identity left in the ebook?

The tools only remove the DRM. No attempt is made to remove any personally identifying information.

Is he implying that there is personal info in DRM'ed ebook files? Not quite clear.

I understand that it's in our interest to assume that there is personally identifiable info in these files and remain responsible with them. Even so, I believe that it is far better to be responsible in the light of knowledge and understanding than to do so out of fear and ignorance.

[haertig]

If there is personal info in the eBook you bought, and it ends up in someone else's hands, then you have evidence that they stole it from you. Or at least evidence that they got if from somebody who got it from somebody who stole it from you. Receiving stolen property - whether knowingly or unknowingly - does not give them claim to it. If they're caught with it they gotta give it back, no matter how much they paid for it or how innocently they thought they obtained it. Digital media is different than physical items (how would someone return a stolen eBook?), but I doubt the law would treat a stolen eBook any differently than a stolen bicycle, except for the monetary value involved.

It's probably in your best interest not to download eBooks from pirate websites, or upload any there either.

[barryem]

Originally Posted by crossi

Audible files would seem to be more complex with more places you could hide watermarks without them being detected. Converting to a straight text file, not HTML, would seem a better bet for removing watermarks. Is there anyplace in a notepad file that a watermark could be hidden without changing the text?

There is nothing in a plain text file but text. It's probably possible to include binary characters in text and not have it detected by something like Notepad (I haven't actually tried that so I'm not sure) but I doubt that Notepad would save those characters if it was edited.

HTML is also a plain text file and the same should apply to it but I'm not expert on HTML so there might be ways to embed binary information that I'm not aware of. Again, I doubt if Notepad could save it. Some editors might be able to.

An epub isn't just HTML. It's a zip file that can contain HTML and other types of files. Presumably some of those can be binary. Whether Calibre or other conversion tools would carry them across, I don't know.

I will say this though; if this is an important question to you do some serious research before you decide. This just might not be a simple question with a simple answer.

I just did a simple test: I dragged a jpg file (a binary file) into notepad, saved it and then checked it. It was the same size as the original. However, Irfanview, an image display program, can't view it.

Barry

[DNSB]

At one time about a decade back, I played with a tool called StegDetect to see if image files in an ebook had information hidden in them when I became curious about an ebook that had rather large for the image size .png images which I noticed when the total file size was way larger than I expected. What I did find was that there were files appended to the image files but near as I could tell, the contents of the appended files were garbage. Running the files through a conversion to .jpg with 100% quality shrank the files to a more reasonable size and converting those jpgs back to png did not show any remnants of the appended file.

It might be the first ebook where I spent a lot more <expletive deleted> time dissecting the file rather than reading it.

[Difflugia]

Originally Posted by soondai

with all the whizs around here, I am surprised no one has done something like this

I have done this with ADE epubs. After removing the DRM, the files inside the resulting epubs are the same for different ADE accounts.

Each text file in the epub contains an Adobe ID, which is the ID of the book on the particular vendor's ADE server. Someone could figure out which store you bought it from, but that's about it. The line looks like this:

<meta content="urn:uuid:4c189c49-f830-4679-90ce-923d9d2ca79e" name="Adept.expected.resource"/>

That line is the same for the same book from the same server, even for different downloading accounts.

The only other thing that I can think of is that if the timestamp on the output epub (also embedded in the zip header) is close enough to when you downloaded the book from the ADE server, someone with access to the ADE server might be able to make an educated guess about who the original downloader was.

If anyone cares to "replicate my findings," it's pretty easy. First, have two installations of ADE. You can use two different computers, virtual machines, or even just different Windows accounts. I'm a fan of virtual machines and it's harder to accidentally screw up your ADE account that way, so that's what I do.

An easy place to find books that can be downloaded to multiple accounts for free is Adobe's sample ebook library. Each download generates a brand-new ACSM file that can be fulfilled by any ADE account.

An actual ebook store that makes this easy is eBooks.com. Though you have limited downloads for each book (usually either three or five, depending on the publisher), each ACSM download can be fulfilled by a different ADE account (unlike Kobo, which requires the same ADE account as the first fulfillment for any book). There are enough free ebooks that you should be able to satisfy yourself. This link goes to a rivetting book about how the HCSB is the best Bible translation ever.

That ebook is pretty much free everywhere, so you can do the same thing at Kobo or Google Play, but you'll need access to two store accounts.

The comparison tool that I use is Scooter Software's Beyond Compare. It will compare whole directories, so you need to unzip the two epubs, but you don't need to check each file yourself. Beyond Compare costs $30, but you can try it out for free for 30 days, even though the software doesn't ever stop working (I think it nags you after 30 days, but that's it). For people worried about watermarks in images, Beyond Compare will compare images as well. I compared Pottermore books from two accounts and found the watermarks (it amounted to a pattern of dots embedded in the images).

[soondai]

Ha. I guess I should have said "with all the whizs around here, I wouldn't be surprised if someone has done this"

Thanks for sharing your findings. Takes a little edge off the paranoia, but I guess it's hard to disagree with those that have said the best policy is to treat your library like it could be tracked back to you.

[sjfan]

Originally Posted by haertig

Digital media is different than physical items (how would someone return a stolen eBook?), but I doubt the law would treat a stolen eBook any differently than a stolen bicycle, except for the monetary value involved.

My non-lawyer understanding:

This is another place where the terrible intellectual "property" metaphor that's become so common is misleading.

An ebook that was actually stolen (say, on a thumb drive, thereby removing it from the original owner's possession entirely) would be treated similarly.

But an illegally copied one would be treated rather differently in many jurisdictions. Theft under common law (and in most parts of the US and most UK/Commonwealth nations, and many others) legally requires intent to deprive the owner of the property stolen, and is a crime against the property owner*.

Copyright violations are typically not legally theft. They are civil and/or criminal offenses against the copyright holder (not against the ebook owner).

Webster's also defines theft similarly. Wikipedia has some higher-level discussion.

I could be wrong about all of this, consult a lawyer if you need legal advice.

*The UK law, for instance, reads: "A person is guilty of theft, if he dishonestly appropriates property belonging to another with the intention of permanently depriving the other of it; and "thief" and "steal" shall be construed accordingly". In New York the law says that theft occurs when someone "wrongfully takes, obtains or withholds property from its rightful owner, with the intent to deprive the owner of such property"

[Little.Egret]

Originally Posted by sjfan

My non-lawyer understanding:

This is another place where the terrible intellectual "property" metaphor that's become so common is misleading.

An ebook that was actually stolen (say, on a thumb drive, thereby removing it from the original owner's possession entirely) would be treated similarly.

But an illegally copied one would be treated rather differently in many jurisdictions.

*The UK law, for instance, reads: "A person is guilty of theft, if he dishonestly appropriates property belonging to another with the intention of permanently depriving the other of it; and "thief" and "steal" shall be construed accordingly". In New York the law says that theft occurs when someone "wrongfully takes, obtains or withholds property from its rightful owner, with the intent to deprive the owner of such property"

The UK story goes back to the reason for the Official_Secrets_Act_1889

https://en.wikipedia.org/wiki/Official_Secrets_Act_1889

My history teacher told me that a disgruntled government copyist (meaning pen and ink) made his own copy of a secret treaty and sold it.

The prosecution for theft (probably larceny in those days) failed. The paper was probably his own.

[darryl]

As others have said, one should assume that there is some identifying information which survives DRM and even format conversion. Even if you were to take the trouble of converting to plain ascii text and painstakingly review the file you could still not be certain. There are so many different techniques developed over many years to detect the source of leaked versions which have potential application. For instance, circulating a paper using different words or phrases in different places so as to make each unique. This would not be detectable even theoretically without other copies of the work to test against. Even then it may prove difficult. And this is but one approach.

It is naive to assume that those who take the trouble to use DRM will put all their eggs in one basket. Eliminating any risk is both labour intensive and unreliable. One could never be sure that the book has been totally sanitised.

The assumption that this is not happening because no one has so far to our knowledge been prosecuted after being detected through such information is also an unwise one. There are many reasons for not resorting to legal action.

And, of course, even if such techniques are not being utilised now, they can be implemented at any time. I recall one of Fred Saberhagen's Berserker short stories made the point quite nicely. Whether a man's life was forfeit for treason was determined by a fake entry placed in the ubiquitous Galactic Encyclopedia to catch copiers.

[Dazrin]

Originally Posted by darryl

As others have said, one should assume that there is some identifying information which survives DRM and even format conversion. Even if you were to take the trouble of converting to plain ascii text and painstakingly review the file you could still not be certain. There are so many different techniques developed over many years to detect the source of leaked versions which have potential application. For instance, circulating a paper using different words or phrases in different places so as to make each unique. This would not be detectable even theoretically without other copies of the work to test against. Even then it may prove difficult. And this is but one approach.

Exactly! Post #7 isn't just me being paranoid!

[kacir]

Originally Posted by crossi

Audible files would seem to be more complex with more places you could hide watermarks without them being detected. Converting to a straight text file, not HTML, would seem a better bet for removing watermarks. Is there anyplace in a notepad file that a watermark could be hidden without changing the text?

Just choose 20 places in a plain text file that can hold a different character and you can encode binary number with 20 digits - numbers between 1 and 1048575 (1024*1024). Enough to identify an individual buyer plus a few bits for checksum.

You can use a non-breaking space versus ordinary space, you can use a space after a coma at the end of the paragraph, you can use Unicode typographical equivalent of some ordinary character, you can use a non-printable character. You can even alter the text and introduce tiny errors.

When it comes into html, there are lots of places to hide something in the plain sight. Like whitespace or newline characters or letter capitalization within html tags, or naming system for css elements.

Originally Posted by NonDuality

Also, found this interesting line on A.Alf's blog -

Is he implying that there is personal info in DRM'ed ebook files? Not quite clear.

He is implying that he is not trying to look for personal info.
Nobody really knows whether some publisher decided a week ago to start including some hidden info or not. Stenographic, hidden in plain sight as described above, or in a tag somewhere. or in a name of included file perhaps.

[Apache]

Originally Posted by darryl

For instance, circulating a paper using different words or phrases in different places so as to make each unique. This would not be detectable even theoretically without other copies of the work to test against. Even then it may prove difficult. And this is but one approach.

Before computers and GPS mapmakers used to add nonexistent streets to their maps. If another company published maps with those streets on them they could be easily sued for copyright infringement.
Apache