Another Blanket Denial By Last.fm

Well, we asked for a denial, and they’re giving us one. Russ Garrett, a Last.fm developer, issues another blanket denial of the Last.fm user data fiasco:

Nothing I can say will convince you that this didn’t happen, because allegedly CBS did the deed and not us. I hope that CBS will issue their own denial soon, but the wheels of large companies run slowly.

This accusation was made the evening before a three-day holiday weekend in both the UK and the US. Yet again, we were not given the opportunity to respond.

The article claims that “This source’s information comes directly from Last.fm employees who he has spoken with.” Nobody at Last.fm knows anything about such a leak. We didn’t when they last wrote an article, and we don’t now. Any suggestion that we were complicit in transferring user data to any third party is incorrect.

The exact nature of the data that was allegedly transferred is still not clear. It’s implied that the data linked scrobbles to IP addresses. That particular data is controlled tightly inside Last.fm and is only stored for a short period of time. Any request for such data would have to be approved by myself first. The suggestion that CBS’s ops team provided this data is just not possible – Last.fm operates as a separate entity and their operations staff do not have access to our system.

As Arrington points out, transferring personally identifiable data (i.e. IP addresses) from the UK to the US is against data protection laws. We wouldn’t risk a lawsuit to pander to the RIAA’s requests.

It really seems like someone is trying to slander us here.

Last.fm cofounder Richard Jones, the author of the “TechCrunch are full of shit” post from February, also quipped “busy sending data to the RIAA… Oh wait, no, that’s still nonsense.”

A careful read of the post turns up very little actual information. There’s indignation over the story, indignation over us not giving them a heads up, and a statement that it’s impossible for data to be sent to CBS without Garrett’s knowledge. They also say “Any suggestion that we were complicit in transferring user data to any third party is incorrect.”

We need more than that.

First, it’s correct that we didn’t talk to Last.fm or CBS before posting this story. Our efforts to do so in the past have been met with a brick wall. CEO Felix Miller has outright refused to have any direct conversation with us, instead pointing to Last.fm’s New York based PR group. We’ve been trying to have an off or on record conversation with him for months.

But to the meat of our post and the story as told by our sources, we need direct answers. A blanket denial can easily be issued if even some small part of the story we reported is inaccurate or up for discussion. Given the seriousness of the story, we think its fair to ask Last.fm and CBS exactly what did happen:

1. Are they claiming that the initial story, including the email allegedly from a former CBS employee, was completely fabricated by our source? Was there no data request by CBS in February? If there was one, was data transmitted to CBS? Did CBS pass it on to the RIAA or one or more music labels?

2. You say “Any suggestion that we were complicit in transferring user data to any third party is incorrect.” Ok. How about a suggestion that you were innocently involved in transferring data to a third party, and subsequently outraged when you discovered what happened?

3. We believe Last.fm staffers have been agreeing with our story in private conversations for some time. Why the private agreement and the public broad denial? We have emails from Last.fm and CBS employees that are saying quite the opposite from what you are.

4. We believe Last.fm put in broad new data policies following our February story. If the original story was completely untrue, why did they put new data policies in place?

5. What is CBS’ position on this story?

We all understand that Last.fm is upset and “rather pissed off.” But what we really want to know is exactly what happened in February. Was data requested? Was it supplied? Can CBS pull data directly from Last.fm without Last.fm’s involvement?

We remain open to on or off record conversations with Last.fm, which has been our position throughout this story. The phones are ringing. They’re just not answering.

Update:
Garrett clarifies his denial here. We’re going to wait for any further statements from Last.fm, and we hear from sources inside Last.fm and CBS that they plan on issuing a denial as well early next week. We’ll respond at that time with the additional information we’ve gathered. There are employees of both companies who are saying things that are quite different from these blanket denials.