MIT Releases Subpoenaed Student's Info

An anonymous reader submits: "MIT has released the name of the alleged infringer whose information was subpoenaed by the RIAA. The student's position? He was (1) not in the country at the time of the infringement, (2) he does not own a computer, and (3) he is not, and has never been, associated with the username in question (crazyface@KaZaA). MIT initially opposed the subpeona, but the RIAA refiled with the proper court."

Comments

MIT and no computer?

[strider415]

Yeah right..

Re:MIT and no computer?

[Anonymous Coward]

Hey, I didn't have one for most of my time at MIT. There are computer clusters everywhere - not too much need to have one in your room.

And I was course 6 (EECS).

Er...Dude...

[Oddly_Drac]

"For example, you might have registered a machine, and given that machine, sold that machine to another MIT student," Bruce said. "Unless that person goes to inordinate lengths to re-register the machine, it's still going to have your registration."

This is getting beyond a joke. The 'registration' talked about is the @Kazaa, as far as I can see, and you can change that in seconds

This gets even sillier if they mean the IP.

Re:Er...Dude...

[jtev]

No, it's about registering the MAC address to get an IP address with MIT. the KaZaA registration is a totaly different issue. It was the owner of the IP address that was subpeonaed, and he was out of the country.

Re:Er...Dude...

[dougmc]

There are hardware devices (personal firewalls) that allow you to CHANGE the broadcasted MAC address on the fly.

You don't need a personal firewall to do this. You can do it with many (most? all?) ethernet cards as well.

I would have, theoretically, obtained multiple IP addresses

Except that the system requires you to `log in' with each new MAC address ...

Or, better yet, I could just change my broadcasted MAC address to one that I know is already registered.

That would certainly do it.

So, are MAC addresses about to become as `sensitive' as social sercurity numbers? (of course, just like your SSN, your MAC address is broadcast with every packet you send out, at least to the first router :) )

Re:Er...Dude...

[dougmc]

any organization of any small size is going to have everything behind NAT

So, do you consider MIT to be an organization of any small size? I'm not aware of any schools that put their dorms behind a NAT. I haven't been paying attention lately, but it used to be that A&M was the only large school that even put their dorms behind a firewall (and it wasn't a NAT)!

Or an ISP? AOL is the only ISP of any size that I'm aware of that puts it's customers behind a NAT.

so nobody is going to be doing any MAC-address *anything*

I don't think you understand much of what was said.

MAC addresses are broadcast -- but they only go as far as the first router. So you'll never see somebody's MAC address over the Internet, NAT or not, because it's going to have to go through some routers.

But at MIT, if a new MAC address is encountered, apparantly the routers send you over to a login screen where you give a MIT login and then it works. The original poster was talking about sniffing the network for somebody else's MAC address (even on a switched network this is easy), and then using it once they turned their computer off. This has nothing to do with a NAT.

With the MIT system, when the RIAA says that IP whatever was being bad at this time, MIT looks at their logs, see what MAC address was using that IP, then looks at their login records to see who logged in with that MAC address. And then they give the RIAA the name (assuming that all the legal procedures are followed.)

This isn't very different from what cable modem providers do -- but instead of looking at a login logs, they look at DHCP logs.

It could happen.

[MarkusQ]

MIT and no computer? Yeah right.

Keep in mind how they measure things when they don't have a measuring device. Who says they aren't equally creative when it comes to computing things with out a computing device?

-- MarkusQ

P.S. That's what my wife (an MIT grad) claims to be doing sometimes when she stares off into space. Since the result often conflicts with my pet theory of the moment, I'm not sure how accurate the process is though.

Twisted

[4of12]

Sounds like the guy in question had unofficially let someone else use his computer, account, etc.

I kind of like the idea of RIAA making a big fuss and pursuing legal action and then turning out to be wrong.

It helps shine a light on their gestapo tactics.

It may not slow them down too much, but the publicity helps to make them look like ravenous wolves out to get "whoever".

That kind of PR will erode their support from government.

Re:Twisted

[rjw57]

Sounds like the guy in question had unofficially let someone else use his computer, account, etc.

Not quite. From what I can gather MIT have a system whereby as soon as a un-recognised MAC-address hits the network, the machine is DHCP-d a temporary IP and a all web-traffic is relocated to a registration page.

On this page, a valid MIT id and password is entered then the temporary IP becomes 'attached' to that MAC address with the MIT id used stored in a DB somewhere.

Hence just having an IP registered to a particular user is just an indication that that guy/guyess was the first to use the machine, not that its theirs or that they even have an account on it.

In fact, if all MIT students registered their machines under a common id (e.g. riaasuckmyballs) then there would suddenly seem to be one big pirate there :)

The system as it stands will probably just match an IP to a person who once used the machine in question.

Re:Twisted

[gl4ss]

as to freenet, it's main problem is the lack of users, and the public notion that it sucks because it is slow, things like frost and fuqid have made inserting files a lot easier.

all the popular top ten hits would get very well spread i would say, even now you can get selected mp3's at ~10-30kbyte/s easily from freenet, i guess much faster if you run a permanent node with a big datastore(heck, run a big enough datastore and the chances are that those pop songs are in your store mostly already and you'll get them pretty darn fast when you decide to get them).

Re:Twisted

[amcguinn]

And that doesn't change the fact that the RIAA isn't suing him for violating MIT's AUP.

If he's got an alibi, then he didn't infringe the plaintiff's copyright. If they say "but you must have broken the AUP!", he can say "I guess I must have, but I didn't download those files."

If MIT then want to have a go at him for breaking the AUP, that's fine, but I imagine they're not in the habit of suing their students.

Bound to happen

[redelm]

With the RIAAs gill-net fishing technique, they're bound to catch some innocents.

The real question is how long this sort of trawling will be allowed. The student could get the case dismissed on summary judgement, and the RIAA seriously admonished about bringing frivolous lawsuits.

aha!

[Joe the Lesser]

"In particular, on June 27, at the time of the alleged infringement, I was in Romania."

So that means he's actually under the authority of the Romanian Industry and Art Association right?

Perhaps if the RIAA *pays* $2000

[redelm]

Why would the guy settle? The RIAA may need to abandon the case to avoid an adverse ruling. IANAL, in some states they might not be able to simply abandon without Respondant consent.

MAC address can be changed

[narratorDan]

The problem with using the MAC address is that it can be changed or covered up, and since this is MIT how many folks do you think now how to change it?

And according to the article, he was out of town (way out, like Romania) and therefor could not be the person who set up the computer. Since he can prove that he was out of the US I don't think that he will have to make any deals to save his ass.

NarratorDan

His name was Claudiu Prisnel.

[Discoflamingo13]

His name was Claudiu Prisnel.
His name was Claudiu Prisnel.

A Setup??

[bluesangria]

What happens if the student does win this case? Doesn't that mean that the method the RIAA uses to subpoena users comes into question? Is this something MIT planned (maybe just a little) knowing that courts cannot hold accountable a person who has a solid alibi?? After all, even a civil lawsuit has to show the person was responsible for copyright infringement. Just wondering....

The RIAA is on a roll

[LastToKnow]

"Lets sue some little girl with no money! Oops, maybe that wasn't such a hot idea. I know, I know! Lets get some student who doesn't have a computer at all! That'll learn 'em!"

A modest proposal

[rworne]

What we have here is the same need to swap identifying info that those who are members of grocery-store "club cards" are doing:

Get a bunch of fellow college students together (the more, the merrier) and organize a group buy of a bunch of NICs.

Everyone registers their NIC with the university, and then swap the cards amongst yourselves in a double-blind fashion. When questioned about it later, just call it an administrative screw-up or just say you sold the card to another university student and you no longer remember who it is.

If this activity is rampant enough, we can regain anonymity on college campus networks.

So what's RIAA Strategy here?

[cmdrwhitewolf]

Capture some Kazaa usernames, perform a tracert to follow the usernames traffic back to it's origin so they can shotgun subpoena the the infringers?

Hey Martha - Get out the Nachos. This s**t's gonna be /REAL/ finger pointing comedy as soon as they hit a company that's using one of those simpleminded ISP "gateway" routers with NAT & DHCP!

RIAA: {looks at list of IP #'s) There's the Perp's PC with IP Address we're looking for! Seize it!

Company: Nope, that's just a Dos Print Server.

RIAA: {looks at list again} ok than, how about that thing over there? It's Ip address is also on the list.

Company: Umm sorry, that's the Router.

RIAA: {points to the nearby tower} That's our infriger than!

Company: {sighs} That's the Novell 3.12 server, Mr pointy hair. It couldn't play a tune even you reformated it and installed windows server on it because it doesn't even have a sound card!

scheduling files

[Gryftir]

Technically it is possible to schedule files to download while you aren't at your computer.

The MIT student could have scheduled the files to download at a certain time, though I'm not aware of a specific program that does this.

Of course it would be damn hard to prove that he did so, especially if they haven't gotten a chance to look at the computer.

It is possible

[ScottyB]

MIT's IP numbers in living groups (like fraternities, where the guy revealed lived) are assigned typically by a network admin at the house who registers the person's machine on the network.

It is very possible, especially over the summer, for one of the temporary residents (females from other schools typically at the fraternities) to just pick an IP from the block assigned to the house and end up looking like the user who originally registered the IP. There are no network checks to verify a MAC address unless you are using DHCP.

And if you registered a computer you borrowed under your account with DHCP, unless you specifically unregister it someone else could continue using the computer even though it's IP entries are registered to you (I even don't know how to do that on MIT's network, and I go to school there).

So, long story short, this guy's claims are very possible, especially if he has people that back up his claim that he borrowed the computer. If this guy really was in Romania, I imagine someone else actually committed the infringement, but those records would be impossible to find since you don't have to log in with your MIT account every time you use MIT's Internet access.

You're all missing a very big point

[scosol]

The RIAA is suing people who are *sharing* files, not *downloading* files.

Get that through your head.

It's entirely conceivable that this guy left Kazaa running while going away to Romania, with all his stuff shared.
I dunno- that's kinda how the shit works when you've got a permanent connection.
To give back, you leave the stuff running even while you're not there.