Comment on the Copyright Office Notice of Inquiry: Music Streaming Fraud

Streaming fraud runs on recordings whose origin no one in the payment chain can verify. A royalty pool pays for plays. It cannot tell who made a recording, whether a person or a model generated it, or whether the uploader holds the rights. Detection tools work hard to spot fake listening. The supply of unverifiable recordings is what lets a scheme spread its plays thin enough to evade them.

Detection, clawbacks, fines, and removal remain essential, but they act after money moves. Box Commons recommends a complementary layer that acts before money moves: a minimum, verifiable provenance record attached to each recording when it enters the supply chain.

Box Commons answers Questions 4, 6, 7, 8(a), and 10 of the Notice. We do not have prevalence, economic, or live-event data and do not address Questions 1, 2, 3, or 5.

There is nothing inherently wrong with using AI as a creative tool. The issue for royalty integrity is undisclosed and unverifiable origin at scale. A fraud scheme needs many recordings so that no single track draws enough plays to trip a detector. Generative tools have removed that cost constraint.

Royalty eligibility now depends on facts the supply chain does not record. Whatever the answer on how human-authorship principles apply to statutory royalties, it cannot be administered at scale unless each recording carries a reliable record of how it was made. Today, disclosure relies on what the uploader declares, and that declaration travels separately from the audio.

Streaming services, distributors, rights owners, and cross-industry alliances have acted on many fronts, and the record should reflect it. Each method is effective at what it is designed to do. Together, they leave one gap: customer verification confirms the person, content matching catches copies, and neither establishes the origin and rights basis of a new recording.

After-the-fact tools also carry a cost for honest independents, who can be caught by fraud they did not commit. A verifiable provenance record gives them evidence to present on appeal.

Distributors sit at the point of ingestion and are the natural place to capture a provenance record. Streaming services and collectives are best placed to check it at payment. What no single participant can do alone is define a record every other participant will trust. That calls for a shared, neutral specification.

The industry already has strong building blocks. ISRC identifies the recording, not its rights. DDEX carries the supply chain's data, including a new AI disclosure standard for music credits. C2PA content credentials bind a signed provenance record to the file itself. A minimum provenance record would connect these tools rather than replace them. It would contain:

1. a verified party, linked to the distributor's know-your-customer record;
2. the ISRC, plus a content identifier bound to the audio itself;
3. a structured disclosure of how the recording was made;
4. the basis of the uploader's rights; and
5. a signature, so that later changes are detectable.

Known-bad and known-good. A shared list of fraud markers is valuable, but a bad actor can open a new account. Pair it with a registry of recordings that carry verified provenance records, run under multi-stakeholder oversight with published rules and appeal rights.

Label facts, not conclusions. Labels should state how a recording was made, what rights basis was declared, and whether the record has been verified. "AI-generated" is not the same as "ineligible." Eligibility judgments stay with the Office and the collectives.

1. Request a provenance-at-ingestion working group convened by the Office with DDEX, C2PA, IFPI, the MLC, SoundExchange, the Music Fights Fraud Alliance, streaming services, distributors, and independent creator representatives.
2. Enact a narrow information-sharing safe harbor for fraud indicators, conditioned on data minimization, notice, and appeal rights.
3. Direct a study of statutory-royalty status labels that keep factual provenance labels separate from legal eligibility determinations.
4. Encourage independent conformance assessment of voluntary industry baselines such as the IFPI Streaming Integrity Initiative, with technology-neutral criteria.
5. Protect independent creators with a low-cost path to verification and a fair, timely appeal process.

None of these steps requires government to build or operate new infrastructure. Each builds on standards and alliances the industry has already created.