Yo ho ho

The good ol' Business Software Alliance has released its annual study of software piracy rates worldwide. And this time - after some people whinged about the lack of clarity over their methodology - they've also released a video explaining how they compile the figures.

I can't comment on the video, because whenever I try to view it my browser crashes. This is a classic obfuscation tactic: put part of the documentation in a form that we can't read, then, when we ask questions, they can just ask "Did you watch the video?" Nice work, but I'd have to deduct marks for lack of originality.

So instead let's look at the methodology section of the published report itself:

The basic method for coming up with rates and commercial value of unlicensed software in a country is as follows:
1. Determine how much PC software was deployed in 2009.
2. Determine how much PC software was paid for/legally acquired in 2009.
3. Subtract one from the other to get the amount of unlicensed software.

Which raises two rather obvious questions: how do you go about step 1? and how do you go about step 2?

The next page explains helpfully: "Total software units installed = # PCs getting SW × Units per PC"

By now I'm getting déjà vu. This is like sixth-form economics, when I learned the infamous monetarist equation "Money supply × Velocity of circulation = Price level × Number of transactions". It's true, but it tells us nothing about how to measure all these things.

To get the total number of software units installed [...] IDC determines how many computers there are in a country and how many received software in 2009. IDC tracks this information quarterly in 105 countries, either in products called ‘PC Trackers’ or as part of custom assignments.

A swift Google search suggests that the only "products" commonly called "PC trackers" are a form of software used to play music. Unless the survey is using its own variant of the language here, in which case it might (more plausibly) mean some form of spyware. Again, kudos on the obfuscation - using words to mean something other than what the rest of the world means by them, that's another good tactic to ensure that no-one can tell what the hell you're up to.

If it means "music software", then your survey will be weighted towards people who care about playing music on their PCs. If it means "spyware", then - apart from dubious legality in several countries - that means your survey will be weighted towards people who don't take their digital hygiene very seriously. If it means something else entirely, then I wish you'd say so. Whichever, it will produce results that are weighted one way or another; how do you compensate for this weighting?

It gets worse.

For countries that are not surveyed, IDC uses a methodology that relies on a correlation between the number of software units per PC and an emerging market measure published by the International Telecommunications Union, called the Information Development Index (IDI). IDC also considers other correlations such as gross domestic product
(GDP) per capita, PC penetration and various measures of institutional strength

(It's "International Telecommunication Union", by the way. Don't worry, everyone gets that wrong.) More importantly, this means that you're basing your "survey" - which you are asking governments and the like to accept as primary evidence - on secondary sources. (Arguably, tertiary sources even.) You're using "various measures of institutional strength" to estimate rates of software piracy, then using those estimates to argue for stronger institutions. Do you really see nothing wrong with this process?

There's more, but by now my readers can be divided into (a) those who agree with me already and (b) those who've stopped reading. Plus, if I'm really lucky, (c) some junior BSA analyst or press officer who's been briefed to look for blog posts on the subject.

The tone of the report seems to have changed from past years. This is welcome. There's no scaremongering here about connections between pirates, pornographers, traffickers and terrorists; instead, we have a few plausible tales about the dangers of doing business with people without some sort of enforceable contractual relationship. There's also some cajolery about the benefits of paying for your software. What bothers me here is that the best they can come up with is "support and updates". I know what that means: "support" means that if you get an address to send e-mail to (although there's absolutely no reason to believe that any kind of help will come back), and "updates" means that every time you go online your bandwidth gets crushed by a honking great patch to deal with some bug that would never have been allowed out of the door under any kind of competent QA regime.

I find it kinda sad that, after 30 years of shrinkwrapped software, the industry still can't come up with any better incentives to buy its product than these.