How to pirate someone else's podcast onto Anchor

Boring legal note: Obviously, we’re not suggesting you do any of the below. This is an article pointing out flaws in Anchor’s process, and is for educational purposes only. Read on for Anchor’s response, and what Anchor should have done if following best practice.

Pirating someone else’s podcast is surprisingly easy on Anchor - you don’t even need to know the RSS feed of the podcast you want to pirate. Here are the simple six steps you need to follow.

Step one: select “import”

Visit Anchor and hit the “sign up” button. Don’t type your name and email just yet: just press the little button at the bottom of the window marked “import”.

Step two: choose a podcast to pirate

Type the name of the podcast you wish to pirate into this window. In this case, we typed in the RSS feed - but you don’t need to know that: just the name will do.

Step three: create an account

Anchor will still make a copy of this podcast even if you don’t confirm your email address, so you can type anything here if you want.

Step four: agree you own it

Don’t worry: Anchor won’t check, and the podcast owner will never know. Just tick the tickbox.

Step five: Anchor copies it over

Anchor makes a copy of the podcast’s artwork and metadata, and downloads each episode, making a copy which it puts in its own system. (It uses an RSS UA of AnchorImport, not that you need care about that). They’ll not notify the owner of this podcast.

Step six: You’ve done it!

Congratulations. Your pirated podcast is now live. Here’s the RSS feed, all nicely marked-up for Google Podcasts to automatically find it, and for you to submit to other podcast platforms.

You can also edit the artwork or the description, if you want to add in your PayPal account or a link somewhere. We did - the description of the pirated podcast links to this article. Email verification is not needed for this, though it is if you want to add a new episode.

You’ll need to verify your email address, and get the original podcaster to do a 301 redirect, if you want to use Anchor’s tools to publish your show on other platforms - or if you want this podcast to show up in the Anchor app. But you’ve got the RSS feed so you can submit it yourself anyway.

If you don’t validate your email, or do a 301 redirect, Anchor won’t remove this RSS feed, or the audio you copied. We did this on 9 September, but it’s still there over a month later.

On September 18, we submitted this pirated copy to third party podcast directories, like that used for Podfriend. It plays fine there, and in spite of getting plays without having been verified, Anchor is still hosting this pirated copy.

Recap

During this tutorial, you’ve:

• made a new Anchor account, without verifying your email address
• copied someone else’s podcast without Anchor notifying or checking with the copyright owner
• published a pirated copy of their podcast on the Anchor website (and been able to change the artwork and episode notes)
• gained an RSS feed of this pirated podcast which you can successfully submit to other podcast platforms, and which contains markup for Google to discover and list

Anchor’s response

We believed this was an unintended bug, so we made a responsible disclosure to Anchor on September 15. After a telephone discussion and a few holding emails promising a response, we informed Anchor we would publish on October 6. On October 5 they responded with this statement which we reproduce in full:

When a creator looks to switch a podcast to our platform, Anchor requires verification of identity and ownership of the podcast feed before it is discoverable or accepted for Anchor’s distribution capabilities. Our current process, which requires the user to authenticate via the podcast’s current host by initiating a 301 redirect, both verifies the user’s email address and confirms permission.

As is the case for all of our products and features, we’re committed to making switching to Anchor as seamless as possible and constantly iterating on the process to meet the needs of podcasters. For more information on our podcast hosting process, please see our help center.

What Anchor should be doing

Podnews has repeatedly discussed the need for a best-practice working group for podcast platforms: and this is just one reason why it’s sorely needed.

Verify an email address before allowing any publishing on any system.

Yes, even importing a podcast. To not check an email address before publishing content (and editing the metadata) allows all kinds of mischief to happen on any system.

When importing a podcast: check first with its owner.

Almost every podcast comes with a valid email address in the RSS feed, except for Anchor’s (see below). Always send a mail to that email address to ask, before copying any audio. Never allow any user to copy someone else’s work without permission from the original owner.

Here’s what happens when you try to import a podcast to Simplecast, by way of example:

Ensure your podcast feed has a valid email address in it

Every podcast should come with a valid email address in the RSS feed - Apple request that it “is active and monitored”. All except Anchor podcasts, that is.

A different random test podcast, for which I validated my email and published audio as normal, has an RSS feed which deliberately hides my email address, changing it to podcasts60+2f6267fc@anchor.fm. This address silently fails - it doesn’t forward incoming mail to me; though it doesn’t bounce either.

Anchor says this is for privacy reasons.

We conducted a test on all available Anchor podcast feeds in the Apple Podcast directory. Only 6.5% of currently-published Anchor feeds contain a valid email address, in spite of Apple’s request. As an aside, it also means Apple can’t email any Anchor podcasters - not having an Apple ID or a valid email address.

In Summary

Anchor’s special relationship with Apple - which uniquely allows Anchor to submit shows to Apple without the user agreeing to Apple’s terms or using an Apple ID - already marks Anchor out as a unique podcast host.

It’s this special relationship between Anchor and Apple - a relationship both companies strenuously deny - that has enabled Anchor to produce a market-leading platform: one that is easier to use than any other podcast host.

With power comes responsibility. Anchor’s ability to make copies of entire podcast feeds without the permission of the podcast’s owners is disappointing; and for the sake of podcast creators, it would be better if they followed best practice.