MIT Releases Subpoenaed Student's Info

An anonymous reader submits: "MIT has released the name of the alleged infringer whose information was subpoenaed by the RIAA. The student's position? He was (1) not in the country at the time of the infringement, (2) he does not own a computer, and (3) he is not, and has never been, associated with the username in question (crazyface@KaZaA). MIT initially opposed the subpeona, but the RIAA refiled with the proper court."

Comments

Er...Dude...

[Oddly_Drac]

"For example, you might have registered a machine, and given that machine, sold that machine to another MIT student," Bruce said. "Unless that person goes to inordinate lengths to re-register the machine, it's still going to have your registration."

This is getting beyond a joke. The 'registration' talked about is the @Kazaa, as far as I can see, and you can change that in seconds

This gets even sillier if they mean the IP.

Re:Er...Dude...

[dougmc]

There are hardware devices (personal firewalls) that allow you to CHANGE the broadcasted MAC address on the fly.

You don't need a personal firewall to do this. You can do it with many (most? all?) ethernet cards as well.

I would have, theoretically, obtained multiple IP addresses

Except that the system requires you to `log in' with each new MAC address ...

Or, better yet, I could just change my broadcasted MAC address to one that I know is already registered.

That would certainly do it.

So, are MAC addresses about to become as `sensitive' as social sercurity numbers? (of course, just like your SSN, your MAC address is broadcast with every packet you send out, at least to the first router :) )

Re:Er...Dude...

[dougmc]

any organization of any small size is going to have everything behind NAT

So, do you consider MIT to be an organization of any small size? I'm not aware of any schools that put their dorms behind a NAT. I haven't been paying attention lately, but it used to be that A&M was the only large school that even put their dorms behind a firewall (and it wasn't a NAT)!

Or an ISP? AOL is the only ISP of any size that I'm aware of that puts it's customers behind a NAT.

so nobody is going to be doing any MAC-address *anything*

I don't think you understand much of what was said.

MAC addresses are broadcast -- but they only go as far as the first router. So you'll never see somebody's MAC address over the Internet, NAT or not, because it's going to have to go through some routers.

But at MIT, if a new MAC address is encountered, apparantly the routers send you over to a login screen where you give a MIT login and then it works. The original poster was talking about sniffing the network for somebody else's MAC address (even on a switched network this is easy), and then using it once they turned their computer off. This has nothing to do with a NAT.

With the MIT system, when the RIAA says that IP whatever was being bad at this time, MIT looks at their logs, see what MAC address was using that IP, then looks at their login records to see who logged in with that MAC address. And then they give the RIAA the name (assuming that all the legal procedures are followed.)

This isn't very different from what cable modem providers do -- but instead of looking at a login logs, they look at DHCP logs.

Perhaps if the RIAA *pays* $2000

[redelm]

Why would the guy settle? The RIAA may need to abandon the case to avoid an adverse ruling. IANAL, in some states they might not be able to simply abandon without Respondant consent.

A Setup??

[bluesangria]

What happens if the student does win this case? Doesn't that mean that the method the RIAA uses to subpoena users comes into question? Is this something MIT planned (maybe just a little) knowing that courts cannot hold accountable a person who has a solid alibi?? After all, even a civil lawsuit has to show the person was responsible for copyright infringement. Just wondering....

A modest proposal

[rworne]

What we have here is the same need to swap identifying info that those who are members of grocery-store "club cards" are doing:

Get a bunch of fellow college students together (the more, the merrier) and organize a group buy of a bunch of NICs.

Everyone registers their NIC with the university, and then swap the cards amongst yourselves in a double-blind fashion. When questioned about it later, just call it an administrative screw-up or just say you sold the card to another university student and you no longer remember who it is.

If this activity is rampant enough, we can regain anonymity on college campus networks.