So this is the story that's been eating my week: Nate Hoffelder over at The Digital Reader dug into Adobe Digital Editions 4, the e-reader software a huge chunk of libraries and ebook stores rely on for their DRM, and found it's logging what you're reading, how far you've gotten, how long you spent on each page, and shipping all of it back to Adobe's servers. In plain text. Not even over HTTPS.
I want to sit with that for a second because its worse than it sounds on first read. Its not just tracking books you bought through Adobe-flavored stores. People who scanned their libraries and found ADE was reporting on EPUBs they'd pulled in from completely unrelated sources, stuff sitting in calibre libraries that never touched an Adobe server for purchase purposes, still got catalogued and phoned home. So the "we're just tracking our own catalog for legitimate business reasons" defense, which is already a weak defense, doesn't even hold up on its own terms.
I dont think most people outside the ebook/library world have thought about this even once, and I get why. DRM is one of those topics that makes eyes glaze over instantly, myself included half the time. But librarians have been sounding alarms about this exact scenario for years, the idea that DRM infrastructure isn't just about stopping piracy, its also a convenient pipe for harvesting reading habits, and now there's a very concrete, very documented case of it happening. Someone ran a packet sniffer. Its right there.
Why the "its just for licensing checks" excuse falls apart
Adobe's whole pitch for why ADE needs to phone home is DRM license validation, making sure the book you're reading is one you're allowed to read. Fine, I can buy that in principle, though even that could be done without shipping page-by-page reading timestamps. But when the app is also reporting on files that were never subject to any Adobe license check in the first place, the "its just DRM enforcement" story stops making sense. At that point youre just collecting data because you can, and because nobody's watching closely enough to stop you. Which, until Tuesday, was apparently true.
The plain-text part is almost funnier than the tracking itself, in a bleak way. A company whose entire business model for two decades has been "trust us with your content protection" couldn't be bothered to encrypt the traffic. Anyone on the same coffee shop wifi as you could've been watching your reading list scroll by in a packet capture. I run Wireshark maybe twice a year and even I could've caught this if id thought to look.
Librarians are, predictably, furious, and rightly so. A lot of public library ebook lending runs through Adobe's DRM under the hood (its the backbone a lot of the "borrow this ebook" systems use), so this isnt some edge case affecting three people with a niche reading app. Its baked into infrastructure that public institutions lean on to loan out books to patrons who have every reasonable expectation that what they check out from the library stays between them and the library, the way it's worked for the entire history of libraries as an institution.
I'll admit I've got a soft spot for this particular outrage because I ditched DRM'd ebooks years ago wherever I could get away with it, mostly buying direct from authors or publishers who sell plain EPUBs, partly for portability reasons and partly because I never fully trusted the "we're just checking your license" line to begin with. This is the kind of story that makes that choice feel less paranoid and more like I got lucky guessing right. Not that I think everyone should feel obligated to strip DRM off everything they own, that's a bigger argument for another post, but stories like this are exactly why "just trust the platform" keeps losing ground as a reasonable default.
No word yet from Adobe beyond a vague statement to the outlets covering it that they take privacy seriously, which is the sort of sentence companies reach for when they haven't decided yet whether to admit fault or just quietly patch it. I'll believe a real fix when I see a changelog. Until then if you've got Digital Editions 4 installed, maybe don't assume your reading list is staying between you and your bookshelf.