What Questions Would You Ask An RIAA 'Expert'?

NewYorkCountryLawyer asks: "In UMG v. Lindor, the RIAA has submitted an 'expert' report (pdf) and 26-page curriculum vitae (pdf), prepared by Dr. Doug Jacobson of Iowa State University who is the RIAA's expert witness in all of its cases against consumers, relating to alleged copyright infringement by means of a shared files folder on Kazaa, and supposed analysis of the hard drive of a computer in Ms. Lindor's apartment. The RIAA's 'experts' have been shut down in the Netherlands and Canada, having been shown by Prof. Sips and Dr. Pouwelse of Delft University's Parallel and Distributed Systems research group (pdf) to have failed to do their homework, but are still operating in the USA. The materials were submitted in connection with a motion to compel Ms. Lindor's son, who lives 4 miles away from her, to turn over his computer and music listening devices to the RIAA. Both Ms. Lindor's attorney (pdf) and Ms. Lindor's son's attorney (pdf) have objected to the introduction of these materials, but Dr. Jacobson's document production and deposition are scheduled for January and February, and we would love to get the tech community's ideas for questions to ask, and in general your reactions, thoughts, opinions, information, and any other input you can share with us. (In case you haven't guessed, we are the attorneys for Ms. Lindor.)"

Comments

Jusst one Question

[Joe Snipe]

Why?

Re:Jusst one Question

[nacturation]

Why? Actually, why this story has been posted is quite ingenious. All of the +5 responses supplied become NewYorkCountyLawyer's cross examination of the RIAA experts. It's like having access to thousands of researchers with a passion for the topic. Quite a brilliant idea, really.

Next up: Hans Reiser's lawyer wonders what questions you'd ask a homicide 'expert'.

Conflict of interest

[MECC]

What steps would you take to prove that a screenshot is 'authentic'? If I doctored a screenshot to include a list of songs, how would you discover the doctoring? How would establish that the song names contained the correct songs and not something else? Are all screenshots unalterable?

Describe the process of 'proving' that someone's home computer used a given IP address at a given time. Anywhere.

Re:Conflict of interest

[Iphtashu Fitz]

If I doctored a screenshot to include a list of songs, how would you discover the doctoring?

Even more importantly, what if the actual files were doctored. If I were to create a file named "Around the World - Red Hot Chili Peppers.mp3" and put it on the Kazza network how would you determine if it's actually that song? Are you relying on just combinations of filenames and checksums/hashes? Hashes like those used by Kazza can be replicated with a bit of effort. Maybe I set up a phony Kazza server to flood the network with bogus copies of files. They'd need to download the actual files and listen to them in order to verify their authenticity.

Re:Conflict of interest

[Score Whore]

The problem you are experiencing is called cluelessness. These are not criminal cases, they are civil. Which means that your "it's technically possible that it wasn't me (if Jupiter is in Mars's house and my neighbors are part of the Illuminati and they're all out to get me and if George W. Bush brushes his teeth with his left hand but wipes his ass with his right)" theory means nothing. The burden of proof here is "more likely than not", not "beyond a reasonable doubt." Instead of reviling the copyright holders and their licensees, how about people stop trying to get utility for free?

Re:Conflict of interest

[darkain]

This reminds me of years ago when P2P networks first started to become popular. I went into MSPaint, created a new file... I used my mouse and my "awesome" *cough.cough* art skills to wrtie the word "porn" on the screen. I would then save it as "porn.jpg", and see how many losers would download it. Now, if I where to rename that same file to "child_porn.jpg", I probably would have been arrested.

Re:Conflict of interest

[squiggleslash]

A very good point. I've been trying to figure out why people are responding as if everything the content maker's team comes out with has to be absolutely air-tight to the point nobody could even consider questioning it.

The reality is that unless the defendent can come up with a good reason why the screenshot would have been forged, it's likely to be taken by the court as evidence, and go a long way towards a "balance of probabilities" in favour of the plaintiff. So these kinds of questions aren't really that useful. Yes, technically, someone could have forged the screen shot, but there's no earthly reason why the RIAA and the content makers would actually want to frame an innocent computer user at the beginning of the case.

You know, most of this is pretty open and shut. People are offering massive libraries of music to download that they're not authorized to do. The technicalities are not computer based, they are not the kinds of questions the average Slashdotter is qualified to answer, they're legal. Does having a copy of a song on your hard drive configured to be automatically transmitted to anyone who wants it constitute fair use, simply because having a copy of the same song on your hard drive for the purpose of listening to it probably is fair use?

It's that kind of thing. Not "OMG! This IP address and time and song name was represented by pixels on a computer screen! You can easily forge those! Do they know this? Someone should tell them!"

Re:Conflict of interest

[T-Ranger]

All logs of what? "All logs" could mean "all logs you keep now", which could mean exactly 0 logs. Or "all logs" could mean "log everything", which on a, say, OC-48 would be only the trivial amount of 2405.376 Mbit/s.

Which is about 4500 terabytes for 6 months.

But lets be reasonable and say that they are only averaging 20% utilization down to a more reasonable 900 terabytes.

Which is a minimum of of 1800 drives, assuming you are using drive manufacturers math, and no redundancy. So lets say 2500 drives.

In 12 bay, 4U enclosures, you get 208 enclosures, which would require a rack 47' high. Or more likely, 7 8' racks. With 8 racks full of drives, the UPS itself has size measured in cubic meters, not rack-units, so Ill ignore that for rack space. And Ill ignore servers, too.

The enclosures are about $1100/USD each, but lets say you get a deal when you by 208 of them, and they come in a $200,000 even. The drives would be about $200/ea, in volume. So about $500,000. Good racks would be about $1k each. $8k

The enclosures suck 350W each, so just about 72kW. But you never turn them on all at the same time, so lets be kind and say only half that: 36kW. Still, that would require two APC InfraStruXure 20kW UPSen, which are $33,900USD. Im sure they have 50kW model, but I can get a price on the 20kW, and Im not counting APC approved powerbars. $65,800USD

In other words, "all logs" could be kept for the low-low price of $773,800 USD. For drives, racks, and UPSs. No computers to drive the drives, people to get it up and running, let alone maintaining it. No ongoing power or cooling costs. And they would look pretty silly sitting in your parking lot outside (but I suppose that might cut down on the cooling requirements).

Clearly, if what you say is true, I need to get into the hard drive, drive enclosure, rack, and UPS importing business in the Czech republic.

Re:Conflict of interest

[Anonymous Coward]

The reality is that unless the defendent can come up with a good reason why the screenshot would have been forged, it's likely to be taken by the court as evidence, and go a long way towards a "balance of probabilities" in favour of the plaintiff. So these kinds of questions aren't really that useful. Yes, technically, someone could have forged the screen shot, but there's no earthly reason why the RIAA and the content makers would actually want to frame an innocent computer user at the beginning of the case.

Why would or should anyone assume that they wouldn't want to frame an innocent person when they profit from doing so? If they can do it and get away with it so easily (and lets face it, they can), why not do it? They make lots of money settling these cases even when the volume of evidence suggests that the defendant had no knowledge or ability to perform such an offense. You have to remember that the music industry is still heavily run and influenced by the mob. It's not talked about openly but that's the way it is. They use the music industry as a "legit" source of income but it doesn't mean they will throw old school extortion out the window when they can get away with it so easily. Some judge basically gave them the right to ass-fuck anybody they want (which would be very comical if it weren't so unbelievably sad) and get away with it. There's not much a defendant can do about it unless they have deep pockets or some very generous lawyer friends. The RIAA has essentially been granted the powers of a police force with the only limit being financial punishment and they are clearly not opposed to dishing out some Rodney King style treatment from time to time. Also, from everything I've read about them since this shit has started, they aren't the slightest bit picky about who they go after. So for me, you'll have to do a fuck-ton better than "why would they go after innocent people" because I'm just not that trusting of the legalized mafia.

Finally, because I know the RIAA is out doing this kind of shit, if I want to completely fuck someone over, and I know how to spoof IP's and other such dirty tricks, I can make it look like you are illegally distributing music. But with your logic, it's totally cool that they don't really have to PROVE anything because the mere accusation is good enough for the RIAA. I could ruin you financially and there isn't a fucking thing you can do about it. I like your logic sir! Keep it up and run for president some day. You'll make mom proud.

Re:Conflict of interest

[Jack Sombra]

"The reality is that unless the defendent can come up with a good reason why the screenshot would have been forged, it's likely to be taken by the court as evidence, and go a long way towards a "balance of probabilities" in favour of the plaintiff. So these kinds of questions aren't really that useful. Yes, technically, someone could have forged the screen shot, but there's no earthly reason why the RIAA and the content makers would actually want to frame an innocent computer user at the beginning of the case."
Actually there is a very good reason, money.

And this is easily demonstrated by examining previous cases of people being accused by the RIAA (or more exactly the intermediary company's they use for this stuff) and the modus operandi of those companies

Do they notify you that they are taking you to court no matter what? Nope they say pay $$$$ or we will take you to court. Money is one of the best motivators to lie, cheat and fake evidence

Now of course someone will say "hey it's only a few grand, that's chump change to these people", easy response, add up all the people they have stung and you are in the 10's of millions if not 100's of millions

Money that an entire industry is dependant on (and not talking the music industry here but rather the RIAA and the companies it employs) money that will go away completely if the courts start ruling against them because then their tactics of "legal extortion" will be toothless and everyone will know it

Thus nothing that the RIAA (or it's experts) present as evidence should be taken at face value without verification, because their very livelyhoods depend on winning the case

Have you _ever_ made a mix tape?

[waterford0069]

To take one for Steven Jay Page of the Bare Naked Ladies

Have you _ever_ (and I mean EVER) made a "mix" tape? Did you give it to your SO/love interest?

Steven's argument being that effectively EVERY person in the music industry has done this at one time or another, and to be punishing their customers from doing effectively the same thing is hypocritical.

Start easy . . .

[Dr Caleb]

Like - did you listen to the alleged data to see if it was actually a copyrighted work? Does the copyright on those works all belong to the planitiffs?

Can they verify what IP address the alleded copyrighted work was uploaded from? (Eg: did it come from a single source only?) Go back a little further; can they produce anything that verifies Ms. Lindor's computer had the IP address they uploaded from at the time in question?

A bit about Mr. Jacobson

[linefeed0]

I always hate it when academics use their position to further crap like this rather than fight the bullshit. My alma mater had plenty of these jerks too, particularly the people running the career programs in "e-commerce" and computer security. One telltale sign is that they've testified before Congress. Apparently Mr. Jacobson doesn't like p2p because there's porn on it. The money shot is this bit:

There are several issues that make pornography on peer-to-peer networks more problematic than web or FTP-hosted pornography. You don't have to look for pornography on peer-to-peer networks; it will find you.

On SOVIET LIMEWIRE, PORN FINDS YOU!

Re:A bit about Mr. Jacobson

[acordes]

I had Dr. Jacobson as a professor for multiple courses (including "how to hack computers") and as a Senior Design advisor. He's a really nice guy and a good teacher as well. His stance on P2P surprises me a little bit. I would have figured he'd be on the side of less strict regulations on this stuff.

Come on!

[zepo1a]

Come /.! NewYorkCountryLawyer is trying to do something good here.

Can we get serious for a minute? Please?

Re:Come on!

[Vengeance]

More importantly, can we not entertain each other in the process?

After all, that IS at least half of the function of this web site.

questions

[superwiz]

1. What measures will be taken to safeguard the integrity of the data and the data storage devices. You don't want your property destroyed in the process of investigation.

2. Ask for extensive access to all the equipment that will be used during the investigation to verify that the said equipment may not accidently harm your devices and data.

3. Ask for a comprehensive review of all the privacy-safeguarding mechanisms that the plaintiffs have in place for the retrieved data. Further, ask for an audit of the feasibility of the privacy safeguards as well as their effectiveness in actually protecting the privacy of the data.

Re:questions

[cain]

These just seem like stalling tactics. Eventually the RIAA would comply with the requests and the trial would continue.

Re:questions

[crmanriq]

1. Please provide a detailed outline of what tests you wish to perform, and the tools that you will use to perform them. Are these industry recognized tools, or are they proprietary? If they are not industry recognized, please provide source code so that their results may be analyzed in context by recognized experts.
2. Please state your reasons why these tests cannot be performed by an independent laboratory by skilled professionals.
3. Please state what industry standards these tests meet that will confirm their validity. (Do they meet an IEEE or ASTM testing standard?) If no industry standard exists, then provide documented research that lays out why these tests meet a standard of proof that can and should be allowed in a court of law.
4. What specialized equipment will be used in testing? Has this equipment been certified for this use, or is this a new use of the equipment? If it is a new use, then please provide supporting documentation to certify that any results achieved will be meaningful.
5. What measures will be taken to preserve the integrity of the data so that your results may be independently verified?
6. What measures will be taken to keep the equipment free from harm?
7. What measures will be taken to preserve the chain of evidence?
8. What measures will be taken to ensure that no data is added to, removed from or changed on the by your personnel or your agents? How can this be independently verified?
9. Which of your described tests include subjective criteria, and which are purely objective? How is the subjective criteria to be evaluated, and how could an independent testing body repeat this portion of testing?
10. How long will the testing take, and will you provide a functionally equal replacement during the testing duration so as not to deprive the owners of the use of their property?

Re:questions

[DamnStupidElf]

4. Ask them if they have the necessary licenses from Microsoft and any other companies to make copies of the data on the hard disk, including any legally purchased music they might encounter. Almost every forensic software package creates a complete duplicate of the hard disk as its first step to preserve the chain of evidence. Additionally, ask them if they will violate copyright law if they duplicate the hard disk and there are illegally copied media files on the disk that they don't own the copyright to. In criminal investigations, law enforcement is generally exempt from copyright law for the purposes of evidence gathering. I don't think individuals and companies have the same leeway during discovery, so basically the entire premise they are basing their case on will prevent them from performing an accurate forensic examination. Even if they don't make a duplicate copy of the drive, they will still be unlicensed to view certain files simply because the defendant doesn't have the right to relicense them. I imagine this has come up in courts before where companies try to hide things like trade secrets and copyrighted documents from discovery, but in those cases they are generally the sole owner of those documents and can be compelled to release them. A person owns almost none of the rights to software and other media on their own computer.

I think it's only fair that the plaintiffs should have to play by their own rules, e.g. that any use or copies of copyrighted material without explicit permission is absolutely forbidden.

What worked over there...

[kid_oliva]

May work over here. Prof. Sips and Dr. Pouwelse expert witness statement seems to be what anybody being sued by the RIAA would want to find. The inability to prove they were involved in actual contribution. I think if you can get an intelligent judge or at least be able to explain what their findings mean; you should be able to get alot of cases thrown out. If not then appeal until you get the right judge. It seems that they have to go on hunting expeditions to try to even build a case otherwise they are close to slander by false accusations. I may understand it wrong, but their analysis shows you can't prove if anyone was involved by using the tools they do.

Attack his expertise

[Anonymous Coward]

I saw at least one false statement in one of the filings. It's not a lie so much as a total lack of understanding of how IP networks really work and how far they can be pushed. Combine that with the fact he's been discredited in Canada and it should make the court ask questions.

In particular the statement that he was able to determine there was no wireless router in use at the time cannot be substantiated. It is possible to have a wireless router that NATs you right back to your public IP. In fact, I've done it (with out the wireless part) at least twice for different reasons.

If I were you, I would set up a demo that shows this and rub his nose in it.

Re:Oh, man, this is sad.

[RingDev]

The differences is most readers of /. are not lawyers, so asking questions about law on /. is kind of pointless.

Inversely, most readers of /. are technically adept, so asking questions about technical issues (like is this 'technical assessment' valid?) can be rewarding. Even if you are a lawyer.

-Rick

Payola

[Anonymous Coward]

Has your acting as an expert witness for the RIAA generated any income whatsoever, either directly or indirectly? Has the RIAA provided you with any non-monetary gifts or perks?

Seriously, I would ask that.

ask groklaw

[SABME]

Have you considered asking this question on http://groklaw.net/?

You might get a better response there (i.e., less noise than /.), especially since Groklaw is about legal issues surrounding tech.

Then he should have asked his question better

[Slashdot Parent]

What he should have said was:

The plaintiff wants to compel $person to surrender his computer for forensic analysis. For the judge to order this, their evidence must meet $standard.

Their evidence is $evidence. How can I show, from a technical perspective, that $evidence does not satisfy $standard?

What bugs does MediaSentry have?

[Chris Snook]

My father is an attorney, and he once told me that you never ask a question you don't already know the answer to, unless the answer cannot possibly hurt you. There are a few possible answers here:

1) I don't know.

If he doesn't know, he's not an expert on MediaSentry.

2) None.

At this point you enter into evidence a copy of The Mythical Man-Month or some similar tome, and quote figures on bugs per lines of code. You have now discredited him.

3) Lots, for example...

This will go over *great* with a jury.

This guy claims that the hard drive provided must be the wrong hard drive because it doesn't show any evidence of file sharing whatsoever, and MediaSentry claims there was file sharing. Maybe it's a bug in MediaSentry.

Whatever.

[arkanes]

Did none of you read the PDF? The expert report says that the hard drive provided to him was *not* the one used to share the files. He doesn't discuss his methodology in any detail, but it's reasonable enough. He states that, based on his analysis of the hard drive that the machine was directly connected to the internet (not via a router), which is easy enough to tell from the IP address assigned, and that it does not and did not have Kazaa (apparently the p2p program used) on it. From the other links, it sounds like they're claiming that his isn't the hard drive they wanted, from the machine they wanted, and that they're trying to get access to the sons hard drive based on that. Assuming that the expert isn't totally incompetent and/or lying, he's right. If this hard drive is from the machine that had the IP addresses in the subpoena from Verizon (he says he has access to the Verizon information, but not whether or not the IPs match up), then you have a pretty airtight dismissal - no evidence of sharing, lets go home. If they're trying to claim that the son probably brought his machine over, you're going to have to rely on legal arguments rather than technical ones. It's certainly possible that he did, but I don't know enough about the law to say whether that matters in a case like this. The case is against her, not her son, so can't you argue for dismissal on that alone? If they're claiming that you gave them some totally unrelated drive, you're going to need to document where that drive came from. I assume you have all your ducks in a row with regards to the chain of documents and evidence for that drive. If you don't, then someone screwed up along the way and someone is going to pay for it - probably your client and her family. That's not something interrogation of this witness will help you with - his analysis of the drive is probably correct. What he's saying is that he didn't find the evidence the RIAA wants on the drive, so prove that's the drive they asked for and go home.

Re:Whatever.

[TubeSteak]

I agree with everything you've said 100%.

However, NewYorkCountryLawyer is looking at the bigger picture beyond just this case. Since very few of these cases make it past the settlement letter stage, it behooves the defense to get as much information as possible each and every time.

The idea is not only to dismiss this case, but to air out as much of the RIAA tactics, methodology and bullshit as possible.

Or at least I assume that's what is going on here, otherwise why bother to depose the RIAA experts?

Prove it!

[wynler]

Can you prove that the user was not licensed to possess the file?  Does he, a neighbor, a friend or otherwise own a license?  Was this license temporarly used on this computer? if so then there is always going to be a trace of the file.

For example, I own a copy of Artist A's cd.  I share this CD on a P2P network so that I can play it for my friend at his house (FairUse).  I then delete the file when we're done.

Nothing unethical took place in the above scenario.

Technical side.  Public IP?  Was it static of dynamic?  Can you prove he was the possesor of the IP address at the time of the alleged use?

As for Lindor's son's computer.  No way in hell should they be allowed to have access to it.  Prove that that computer was ever in the house of Mr. Lindor.  Plantif's aren't allowed to go on wild goose chases for evidence when their cases start to fall apart.

It seems to me that the RIAA has way too much to prove here.  Even in civil proceedings, it's just idiotic.  Can they even prove that Mr. Lindor has caused them harm?

All they've got is someone, with a certain IP, may have downloaded a file that they may not have had a license for.  There's a lot of maybes there.

More technical...

Had he ever used any anonymizing software?
Could their have been a worm or a trojan causing the sharing on his computer?
****HOW EASY is it for someone to spoof an IP address through one of these services?****  (very)

Given they've already searched his harddrive...  Was it a used computer?  Who else had access to said computer?  Was a good faith effort made to correct any unauthorized licenses?

The obvious one

[grazzy]

How much of the money RIAA claims goes back to artists who created the music?

I read the PDF...

[Shadowruni]

Item 5 is too vague, I can set my router to say whatever IPs I want, good net citizen doesn't do this but non-reputable... IP addresses are not.

Item 6 is simply a fishing expedition, IANAL but last time I checked this is legal but HIGHLY contestable. The rest of the content isn't very good as it's akin to saying that since *you* own a gun you may know who shot someone else *ANYWHERE IN THE WORLD* with a gun.

Item 7 isn't that good either but it *does* show that the person in question is related to the person there.

All in all I'd say what you have to overcome is the CSI/Law and Order effect of IPs being traced like a phone call to the exact address because that's what you're up against.

Also what are they using to take these screenshots, did they have a warrant (RIAA tends to forget they're NOT law enforcement). "We use encryption" is not a valid answer for that as both MD5 and SHA-1; standard hashing functions used to prove that data has not been tampered with have BOTH been proven to have collision domains (places where different data can have the same hash).

Ok, on to the questions. Since you didn't say the field of the

First off I'd ask about the screenshots and then if he brought out the encryption statement, I'd tear him apart on that, Stealing the Network: How to own the box, (a great book on network security, stories are fictional but the technology is VERY real), has some great layman's explanations for this. If they say it's proprietary then you can tear that apart with enough ammo for NSA people and such. (no one rolls their own crypto it's just too hard, just because *you* can't break it means absolutely nothing, CSS, Apple DRM, Comcast crypto anyone?)

Then I'd ask how they got the numbers for the values of their songs and I'd then rip apart the logic on that as I heard it's something like 730 a song, so then that means that a Vanilla Ice song makes as much money as something from The Game.

Then I'd ask about the full enforcement of the copyright laws and then if they felt exceptions should be given, and demand a yes or no from them. Then point out that the children of the CEO of Time Warner stole music and just leave it at that.

That's all I could come up with in five minutes. I tend to equate the RIAA lawyers to humans (but not *AS* humans) in two words "Mostly Harmless".

Re:Could the defendands computer have been hacked?

[Anonymous Coward]

Ummm, suuuuuurrrrrrre, 2 gigs of porn he didn't know about!

Here's an obvious one...

[supremebob]

"Why do you think that US copyright laws apply to Russian businesses?"

I'm referring to the RIAA 1.65 Trillion dollar lawsuit against AllofMP3, of course.

Discovery questions

[gregor-e]

Since this is the discovery phase, I'd ask plaintiff to produce documentation substantiating the validity of the copyright for each claimed infringement, along with a complaint from each rights-holder or designated representative for each instance of alleged infringement.

I'd ask for specific evidence that establishes the defendant as the perpetrator of the alleged infringements, especially evidence that excludes the possibility of defendant's computer having been used, perhaps unknowingly, by an outside party - friends, hackers, etc. The presence of an 802.11 connection could make this especially tricky. It shouldn't be too hard to come up with numerous examples of people's PCs being taken over for illegal purposes, thus decreasing the strength of the 'preponderance' that shows defendant committed alleged infringements.

I'd ask for information supporting plaintiff's allegations of damage. Given the high likelihood that all of the infringed properties are available anytime, from any internet connection, by any subscriber willing to pay $6/month to Yahoo! Music Unlimited, any claims for damages beyond $6 per month total (or, more precisely, whatever fraction of the $6 the rights-holders would actually receive from Yahoo), are obviously egregious.

Re:Excellent Questions

[mpapet]

Maybe the legal staff needs a little explanation as to why these questions are *so* important and hopefully clarifying things.

1. Screenshot http://en.wikipedia.org/wiki/Screenshot
There is *no* way to prove where a screenshot came from. There is *no* audit trail, no chain of custody, no way to verify where the screenshot came from. NOTHING. Practically speaking it is *very* simple to completly fabricate screenshots. I'm not saying prosecution would do that, but very substantial doubt is easily established by asking the parent's questions.

2. Chain of custody on the PCs in question
Has the chain of custody been established and verified? Do you know the PC hasn't been tampered with by prosecution? Obviously you can't say that outright, but what they are claiming is almost impossible to verify.

3. What were prosecution's discovery techniques?
Substantial doubt can be established by punching holes in their discovery methods. Screenshots is a good example. Easily faked. Or maybe it's just a case of "the wrong man" because it's not clear who did the stealing which doesn't question the prosecution's standing as good lawyers so much. There will be many holes you can drive a bus through and slashdot is just the place to clarify/verify. I for one will be happy to volunteer if it sets some precedent. mpapetATyahoo.com.

4. Chain of custody on the files in question
It's possible that the files were transferred to them lawfully. Can prosecution establish a chain of custody on the files in question? Files on a computer is impossible to establish as fact the time/date the file was written. The opposite example is how easy it is to establish the time/date a shoplifter was in a store. A store employee would testify, "Because I saw them there" or "I caught them." There's no such analogy in file sharing.

5. Doctrine of First Sale
Check out the doctrine of first sale. That's a long-established precendence that may help you.

I'm shooting in the dark, but I want to help. I have a good server and some bandwidth, if you need a way to collect expert advice from the techies in maybe a wiki or slashdot style site let me know. It'll take a couple of days to set up. I'll do it for peanuts just to establish some precedent.

Legal advice

[Vandilzer]

So much for not asking Slashdot for legal advice :P

Well fine there is a lot of thoughts here if you find something use full good. For the rest of you please pick this a part if I am wrong (because I would like to know to).

He is a Professor of Electrical and Computer Engineering. Ask him what experience he has with software in general, electrical and computer engineering deal with the hardware not software in general. Ask him at those security conferences what he spoke about? In all likely hood it has to do with network security that is all this guy dose. He has no credential to analyze the disk image of your client. What he can and did tell you is that yes the computer was linked to the internet and yes it was possibly using the p2p client program. It dose not indicate that any copyright material was transferred to or from the computer. Actually the Wikipedia article gives a pretty clear idea of MediaSentry (http://en.wikipedia.org/wiki/MediaSentry) and the unreliability of the evidence they give.

Odd thought to MediaSentry is hired by the RIAA what integrity do they have? A good analogy would be: A Shop owner realizes that he has been robed. He hires someone to point the finger and find who did it. They look at what is there and see 10 people in the store but can not figure out who did what so they say they all involved and provided evidence to such e.g. they were all in the store and here is a photo to prove it. The shop owner goes on to sue all of them.

Now it gets better. In section/point 6 of the 'expert' report he states that this is "not the same hard drive that was used to share copyrighted sound recordings". By that no amount of analysis will show stolen files. (I found a gun in your home, it was not the one used in the murder but further investigation might show something!) Now he might be referring to the fact that the defended formatted his computer. (Think using an eraser to clean a page, this information is gone but if you look really hard you might still be able to read it) In ether case if this is true then the information he used to like the ip address of the computer would be a lie since the logs and anything else on the computer at the time of the crime would have been erased.

Next: Cleaning up the blood. As anyone hear can tell you if you have ever tried to remove Kazaa or any other file sharing program it is near impossible to do. If Kazaa was on the computer there should be some evidence unless A) it was formatted or B) you paid a vary skilled computer technician to clean it up or C) it is a different hard drive.

Last but not lest there is the who done it clause. They can show that it was his computer but can not show that it was him. On that same note if there are no loges from the system unless they have the Mac address (This is a unique id assigned to every peace of network hardware. Though in reality it is not and can be copied) from the computer they can not even say that it was that computer that was hocked up.

Re:Real questions

[Speare]

I would also ask him how common spyware and viruses are, and how a user such as Ms. Lindor would be able to fix a machine infected with spyware and/or viruses without resorting to formatting her hard drive and re-installing Windows.

Then I would ask him about the Sony rootkit, and how a user should remove such unauthorized software if not by formatting and reinstalling Windows. And so on.

Discredit him thoroughly

[Xenographic]

Obviously, we know several things:

* Screenshots are unreliable. They're easy to fake. I suggest you have a few fakes on hand.
* Thus, the chain of evidence *IS* the evidence and the only evidence. Make sure you know EVERY detail about it.
* You can't really prove which person was at the computer without something else to corroborate it, only the owner of the computer.

These are the biggest apparent gaps. You need to know everything about them and to dump as much as you can into the public record for us. You also need to document all the "I don't know" answers, because those will be the ones where you might hurt them the most.

Therefore, you should question him in detail on at least the following points:

* How are the screenshots taken. Who has access to them? What's the chain of evidence? How and where are all of these things stored? Are they stored in a secure manner? How would you know if they were altered?
- Make doctored screenshots. Have him "authenticate" the fakes. Bonus points if you do this in front of the jury. Double bonus if the infringing IP is that of riaa.com, sony.com or similar. WARNING: This is a public site. He may VERY well be reading this.

* Describe, in detail, the exact process by which you find those allegedly infringing upon your copyrights. Be methodical. You want to know the exact version of the OS they're running (not just "win XP" or "various"). You want to know EVERY program they use, even if it's MS Paint. You want them to produce the source code of any custom programs for analysis by outside experts. You want to know about any known flaws. You want to see any and all release or design notes, ESPECIALLY any bugs, source/versioning control, changelogs, etc. You want to know which exact version of their custom program found the infringement for this case. That does NOT let them off the hook on letting you examine prior versions or newer versions--old bugs DO stick around even when they've been "fixed" and you need to see both newer and older versions. I.E. if the bug has been fixed twice, you know it was there in the interim. Yes, they may put out protective orders and whatnot, but the more information about this you can get into the public record, the more they'll squirm and the more we'll reveal the sloppiness they're hiding. And I know they have things to hide, unless they're so clueless as not to know their own weaknesses. You can work both alternatives to your advantage.

* Describe how the ISP identifies the person associated with the IP. You may actually have to subpoena the ISP on this point, I suspect they'll just produce the letter and say that that's sufficient. It's not. We both know that even if the IP belonged to a computer using their internet service, they don't have any idea who's at the screen at any given time, only which account is active. And even this may be unreliable. You NEED to get every last detail about how they log the IPs leased out, how they associate them with their customers, where the data is stored, how long it is stored for, who has access to it, on what computers it's stored, how reliable those computers are (e.g. any records of maintenance, program changes or downtime), etc. You're the lawyer here. You know better than I how important being methodical in discovery is, and every detail may be significant. I suspect they'll have trouble producing everything. Records may not exist for some things, but this is also important--every gap is a gap in their chain of evidence. It takes only one broken link to destroy a chain... Get EVERY detail you can from this into the record and make sure it gets sealed or redacted as little as possible. All these details about software, hardware, and the human processes that work with them are of vital importance to us for technical analysis, just like case law, venue and precedents are to your case. Even the programs they don't use directly, like antivirus or firewall software may be important, not to mention the topology of thei

Stick to the fundamentals...

[geoff lane]

Stick to the fundamentals...

How does that RIAA know that a given computer was under the sole control of the current owner? A badly secured Windows PC may be under control of somebody a thousand miles away.

here's my strategy

[greenrom]

First I'd use their own witness to establish a possible defense for the alleged infringement. Then I'd point out how weak the argument for claiming the hard drive he examined is not the correct one. Finally, I'd establish that there is no evidence that the hard drive they're trying to subpoena contains any evidence of infringement and portray the whole thing as a big fishing expedition. Let me walk through these 3 in a little more detail.

1. The witness claims the computer was not connected to a router because of the IP addresses he observed in the registry. The addresses you'd typically use for a home router are non-routable ip addresses like 192.168.*, 172.*, or 10.*. These are special address ranges that don't appear on the public internet. Routers use them because you can guarantee that the IP addresses assigned to computers by the router will not conflict with any other address. While it is possible to configure most routers to use a different routable address, the assumption the defendant makes is probably reasonable. However, if no router is being used as the witness claims, then the attached computer did not have the protection a router's NAT provides from outside attacks. I would grill him on this. The theory I would push is that since the computer was insecure, someone else did the infringement but used the defendant's vulnerable computer to run proxy software to hide their illegal activities. This sort of thing actually happens quite frequently. If you search, you can find lots of software for doing this. Further, proxy software isn't that difficult to write. Anyone with a good programming background could easily write one, and anyone with a good understanding of networking who wanted to do something online without it being traceable back to them would likely use this exact technique. Virus scanners already detect many of these programs, but there are many, many more that the virus scanners don't know about yet. I would get him to admit this. There are many, many ways to hide software like this, so even if you look for it and don't find it, you can never be completely sure it isn't there. That's why many experts will tell you that if a system has been compromised, the only sure way to restore it to a secure state is to wipe it and reinstall everything. There's just too many ways to hide malicious software to be sure you found everything the attacker did.
2. I'd point out the many other conclusions one could draw other than, "this must be the wrong hard drive." One possibility is the proxy explanation I gave in #1 - kazaa wouldn't be on the computer in this case. Another explanation for the lack of files on the computer is that the defendant just didn't use the computer very much. Another explanation would be that the computer recently had the hard drive formatted and the software reinstalled - I believe this is undisputed. An explanation for the lack of kazaa files is that kazaa was never there in the first place. Essentially he's saying, "I was told the person using this hard drive was using P2P software to share files. I don't find any evidence of that on this hard drive, so this must be the wrong hard drive." Another explanation is that it's the right hard drive, but that kazaa was not being used and the defendant didn't even use the computer that much. If you try to say a format and reinstall would wipe away all evidence of kazaa, he might try to claim that the forensic software he used could still detect it as not all the data gets overwritten. This is true, but to counter this, ask "Is it possible the data you were looking for could have been overwritten when the operating system was reinstalled?" His answer will be yes. "Could your forensics software detect that data after it has been overwritten by other files or when the operating system was reinstalled?" His answer will be no.
3. Finally, portray the whole thing as a fishing expedition. Ask him about how widespread the problem of illegally sharing files with kazaa is. Ask him if you randomly just

Re:What Questions Would You Ask An RIAA 'Expert'?

[squiggleslash]

Scott,

I have some great news for you. This'll probably relieve the other Slashdotters too who are suffering from the same misconception:

The lawsuits are about people uploading music on networks that are designed to pass the music onto (potentially) millions of anonymous strangers. They are NOT about listening to the music.

So you can breath easy. You will NOT be sued for listening to your Beegees collection. Your copy of The Birdie Song will not get you into trouble (unless you rip it and allow people on Kazaa to download it from your PC.) You can retrieve your REM CD from that little nook on the wall you also use to store the catnip someone told you was dope, and the Confederate money which, I'm delighted to tell you, isn't illegal to possess either (you just can't use it.)

I hope this helps.

Your pal,

S.

Re:Very good questions

[whoever57]

* How do you prove that the contents of the "shared" folder were actually shared with third parties? (I have a "shared" folder with music on my PC, to stream to my other PCs and my stereo)

This raises an interesting question: how do you prove that the listed files could actually be shared and that technical means (such as a firewall) were not preventing sharing, while still allowing the listing of files?

Re:What Questions Would You Ask An RIAA 'Expert'?

[jank1887]

general law of the land does not typically need to be spelled out in each and every agreement. Current law of the land stipulates rather stringent limitations on the right to produce copies of some one else's copyrighted works, except where exceptions to that limit have been granted. Sharing involves producing copies (even partial ones), thus potentially violating the copyright if the copyright owner hasn't granted you licence to copy in that fashion, or unless law of the land stipulates that the form of copying you are doing is acceptable violation of copyright.

No limit is placed by copyright on your ability to listen to the music. Copyright limits your legally permitted ability to make copies of the work.

Now, express and implied consent to copy can be granted. If inherent in a playing medium is digital file transfer from one location to another, and the copyright holder produces a format for that medium, and grants purchasers the right to use that format on that medium, than he has implicitly granted permission to copy for use in that medium. That does not mean that he's granted permission to copy that file willy-nilly and distribute whereever.

Right or wrong, copyright is very limiting, especially when applied to a digital domain where even intended use often involves creating a copy of the data somewhere. Nonetheless, even in a digital format, and whether or not digital copying is possible/easy/trivial, the same limits apply as in the brick and mortar world.

The law of the land does not need to be explicitly spelled out in a contract. You are in no way limited to listening to the copy of the work that you paid for. You may be limited in producing other copies of that work, as limited by the law of the land. Fair use was specifically allowed way back when for specific cases. As it hasn't been specifically applied to newer cases in any court of law, any assumption of fair use rigths in other circumstances is just that: an assumption. Assumptions very well may get smacked down in a court of law. If there's a 'you should have known better' tied to that smack-down, expect penalties. IIRC part of that fair use allowance involved the fact that it didn't detract (much) value from the original product. That was typically tied to the fact that copies couldn't be perfect. Now, that is no longer the case, so applicability of fair use may very well be legally very different in newer cases.

No one says copyright is perfect, but it is what it is, and the law (and penalties) is based on that. If you think it's unreasonable, fine. I think a ticket for going 74 in a 65mph zone is unreasonable. I still pay the ticket, as I was willingly operating in the wrong. Given the opportunity I might argue for a change. But until the change comes to pass, I still recognize that going 74 in a 65 is outside the law.

Warning: Licensing Media Troll

[mpapet]

If you don't pay for unlimited rights, you don't have them when you're licensing media.

Extra points to everyone who saw the bus-sized hole in this statement.

ANY media I purchase is subject to the doctrine of first sale. That means, when I buy it it's mine to do with what I want within limits we all know and follow.

The media conglomerates want to pretend the doctrine of first sale doesn't exist by pretending digital media is somehow radically different than an LP/VHS or even the CD.

On its face that is ridiculous and you either are astroturfing for the media conglomerates or woefully misinformed. In case it is the latter, you have given away your personal freedoms for absolutely nothing and opened the door to even more abuse.

Mod parent down.

Other computer, other IP address.

[whoever57]

IP address assignment varies by ISP and also within ISPs, but my experience is that if I disconnect my PC from the cable modem and connect a different computer to the same modem, it will get a different IP address.

Thus, the idea that the disk is from a different computer that had the same IP address is unlikely, at least with my ISP.

How important is it?

[anubi]

Given the importance the computational infrastructure is to our society, as it now maintains hospital records, medical equipment, flight safety, industrial operations, personal histories, damn near our entire economic data, how much is it worth that we thoroughly understand this technology?

Is it really worth it, for the priviledge of a few for the use of exacting payment for content, to legislatively mandate ignorance of this technology?

Today, viruses are rampaging our networks. Supposedly "top secure" ways of selling somebody something without giving it to them, are cracked and made public within days of release. Our top business systems are violated within days of release. Aren't we chasing after wind? Ignorance only makes us vulnerable to others with wisdom. People who are not compelled to live under our law reign free, unfettered by our laws. Only the law abiding citizenry will adopt ignorance.

While our wisest minds in Washington ponder law to restrict knowledge of our computational infrastructure, other equally brilliant minds in countries eager to collapse us by rendering our technologies useless can use our ignorance to their advantage.

A typical instance of this in history is how Alexander the Great rendered a far more powerful adversary helpless by causing his adversaries infrastructure ( his elephants ) to malfunction ( by blinding and stampeding them ). His adversary now had his hands full with his problem elephants while Alexander took control.

When we do not understand our own technology, our business leaders are going to be completely powerless to control anything if their communications infrastructure has just about the same effectiveness as giving a child a toy steering wheel in a car.

I hate to see so much of our technologies being so centered aroung hanging itself up if something isn't just right. All this secret-keeping. Its enough to give any computer engineer the CIA Heebie-Jeebies ( as related in that movie release "The Good Shepherd", when nobody could trust nobody. I know we love to talk "trust", but frankly, EULA's instill about as much trust in me about as much as a pre-nuptial agreement instills a sense of love. If you want TRUST, then be RESPONSIBLE for it, not deny it in a EULA.

I would hate to have future civilizations digging up the remains of our civilzation, only to discover our civilization was done in by ignorance of how their own technology worked ( as in the theme of many Star Trek episodes ) and deduce we we became ignorant of our own support technology for a song. Literally.

Re:Dear Slashot

[LuYu]

It seems very odd for lawyers to be asking Slashdot how to defend their client. Right? If your lawyer can't do better than that, you should get a better lawyer.

Wrong. Lawyers understand the law, not technology. You could probably build a ladder to the moon with all the text that is generated on Slashdot alone about stupid lawyers and politicians getting technology wrong. This expert witness is a Geek (yes, with a capital G), or at least he thinks he is. This could not be more completely Slashdot's turf.

Lawyers do not often consult public opinon on any topic. They should be thanked for this.

Also, by the way, the lawyers here are not doing their job, they are doing your job. They are defending your freedom to share information -- which is the modern form of speech. It is every individual's duty to defend freedom. Do not criticize them for giving you a helping hand.