A federal guilty plea involving the sale of unreleased Eminem recordings has exposed a risk that exists in studios of every size: the people trusted to help make a work may also have the access needed to copy it.
On October 22, the US Department of Justice announced that Joseph Strange, a former employee of Marshall Mathers, had pleaded guilty to criminal copyright infringement. Prosecutors said the case involved the reproduction and sale of unreleased music. Strange is scheduled to be sentenced on January 27, 2027; a judge will determine the sentence.
The lesson for artists is not that collaborators should be treated as suspects. Creative work depends on trust. The practical lesson is that trust works better when access is clear, limited and documented. A painter with an assistant, a filmmaker with an editor, a musician with an engineer and a digital artist with a developer all face versions of the same problem.
1. Separate the archive from the working folder
Do not give every collaborator access to the complete history of a project. Maintain an archival master under the artist’s control and create a working folder containing only the files needed for the current task. A colorist may need final footage, not discarded interviews. A fabricator may need measurements and selected images, not collector records or unreleased bodies of work.
This principle is known in information security as least privilege: each person receives the minimum access required to perform a defined role. It reduces accidental exposure as well as deliberate misuse.
2. Give access to named people, not shared identities
A single studio password shared among assistants erases accountability. Use individual accounts wherever possible, require strong unique passwords and enable multifactor authentication. Keep a simple register showing who has access to each system, why it was granted and when it should end.
For freelancers, set an expiration date when the platform allows it. For long projects, review access at agreed milestones. A collaborator who moves from editing to promotion may need a different set of files rather than continued entry to everything.
3. Make provenance part of the workflow
Use consistent filenames, version numbers and dated exports. Preserve the original creation files and record who received which version. For sensitive previews, consider individualized watermarks or low-resolution review copies. Where appropriate, cryptographic hashes can help show that a file has not changed, but even an ordinary version log is far better than no record.
These measures are not only defensive. They prevent teams from working on the wrong version and make authorship, approvals and delivery easier to reconstruct.
4. Put the rules in writing before access begins
A contract cannot stop every breach, but it can remove ambiguity. Define what material is confidential, who owns source files and derivatives, whether copies may be retained, how cloud services may be used, what happens at the end of the engagement and how suspected loss must be reported.
Keep the document proportionate to the project and obtain qualified legal advice for high-value or complex work. A non-disclosure clause is not a substitute for secure storage, and secure storage is not a substitute for clear rights.
5. Treat departure as a production step
Offboarding should be scheduled, not improvised. On the last day of access, revoke accounts, rotate shared credentials that cannot yet be eliminated, collect devices and drives, confirm the return or deletion of local copies and preserve the project log. Do the same when a vendor changes staff or a collaboration pauses for a long period.
The aim is not to accuse a departing collaborator. It is to close a door that no longer needs to remain open.
6. Prepare for the moment a leak is discovered
Write down who will preserve evidence, contact platforms, notify collaborators and speak publicly. Do not begin by deleting logs or confronting people through the same accounts that may be compromised. Capture URLs, timestamps and screenshots, and obtain professional legal and security advice before making accusations.
CISA defines an insider threat as the potential for a person to use authorized access or knowledge to harm an organization. The definition includes intentional and unintentional conduct. That is why a healthy studio system should not depend on predicting character. It should make the safe action easy, limit unnecessary access and preserve a reliable history.
Unreleased work carries more than market value. It may contain experiments, mistakes, unfinished ideas and personal material that an artist never chose to make public. Protecting it is part of protecting the freedom to develop a work before the audience arrives.