Safeguards For RIAA Hard Drive Inspection

NewYorkCountryLawyer writes "In SONY v. Arellanes, an RIAA case in Sherman, Texas, the Court entered a protective order (PDF) that spells out the following procedure for the RIAA's examination of the defendant's hard drive: (1) RIAA imaging specialist makes mirror image of hard drive; (2) mutually acceptable computer forensics expert makes make two verified bit images, and creates an MD5 or equivalent hash code; (3) one mirror image is held in escrow by the expert, the other given to defendant's lawyer for a 'privilege review'; (4) defendant's lawyer provides plaintiffs' lawyer with a 'privilege log' (list of privileged files); (5) after privilege questions are resolved, the escrowed image — with privileged files deleted — will be turned over to RIAA lawyers, to be held for 'lawyers' eyes only.' The order differs from the earlier order (PDF) entered in the case, in that it (a) permits the RIAA's own imaging person to make the initial mirror image and (b) spells out the details of the method for safeguarding privilege and privacy."

Comments

Some things I wonder about are....

[NewYorkCountryLawyer]

1. Who pays for the neutral expert?

2. Who makes the deletion of the privileged files?

3. How are the privileged files going to be deleted?

Re:Some things I wonder about are....

[zappepcs]

I have a similar question, possibly related. I have no less than 12 systems at home. On the very remote chance that I should even be accused by the RIAA, how would they know what system to look at, or which drive (I have quite a few) to look at for evidence. Who pays for that? Do they come in and simply confiscate everything? I might have hacked the DVR and moved my music there. I might be an upgrade junky and have upgraded every system that I own on a regular basis, including wiping the drives clean of any previous data. How do they figure they can tell the difference between my habits and someone trying to hide data?

Are my computing habits putting me at risk if they should ask about my online activities? Should I be afraid? Should I be hiding stuff now?

I don't download music or movies, but how do I prove that without having to go through such huge measures as going to court? The existence of MP3 files on my hard drive does not mean I've been downloading. If I buy a used system that has music files on it, am I guilty?

My belief is that they don't have a right to look at it at all without hard evidence that I've been downloading illegally. The police are the only ones given the ability to search with probable cause only. Discovery for court purposes is one thing, do they search each defendant's home top to bottom to find any hidden hard drives? Do they 'interview' neighbors and friends to see if there is a missing hard drive they are just 'holding'?

To me, this whole hard drive evidence thing is illegal in itself. What if a virus infected my machine as was being used to pass illegally downloaded files? What happens if the defendant's lawyer declares all data on the disk to be private, other than the OS files?

Where's Mr. Tuttle when we need him?

[StefanJ]

It's like reading a procedures document from the Ministry of Information Retrieval.

You just KNOW that the creepy bureaucratic gnomes who write up this stuff are going to have a hand in designing the "revised Internet" that's made the news lately.

Your computer has been used to violate article IV of the The Working Artists' Protection Act. Please unlock your front door, sit on the ground, place your hands behind your head and wait quietly. Attempts to flee, contact the press, or hire legal counsel is a violation of the P.A.T.R.I.O.T. III Act and may result in detention in an Overseas Protective Facility.

Re:Initial image by agreed experts, not RIAA

[Skapare]

A subpoena is supposed to not cause undue harm or burden. Since due process has not actually taken place (e.g. argue against it in court), the harm and burden is supposed to be limited. Preventing someone from using their computer is, IMHO, an undue harm and burden. This is the principle our laws came from (not that the laws actually implement it very well).

In the "old days" (when such principles were established), evidence was generally written on paper. An order to preserve evidence would mean not destroying those papers. That would not have been an undue burden in most cases. Someone doing more stuff with papers is generally going to be buying more paper, or at the very least doing more writing in the remaining blank spaces of paper.

The computer of today does not fit an analogy of paper. Perhaps the CDROM backups might. Using a computer typically does involve deleting old data and using the space for new data.

But there is an even more extreme situation here. Microsoft Windows is so vulnerable to exploits that several things can end up destroying evidence, or exacerbating the burden. Infectious programs may cause damage or filesystem corruption. Spamware and spyware may be so pervasive that the only option is to wipe the disk and re-install the OS. It has happened to several of my friends and family (in many cases I've been the one to diagnose the problem and carry out the cure which first involved booting Linux to run "dd" to be damned sure the drive was wiped clean, before booting the Windows install disk to start all over). I actually recommend to people that they re-install Windows every 3 months if there are no visible signs of infection (or immediately if there are).

Is it really the intent of the court to tell someone they must not clean out the infections in their computer, and must let the spamware keep popping up various ad windows, and must let their computer keep emailing spam to others on the internet? Will the court also extend that order to the ISP to prevent the user's account from being shut off due to all the spam coming through?

Courts do need to learn a whole lot more about technology. And they sure aren't going to get it in an ex-parte hearing, especially with RIAA lawyers.

IMHO, when a court has issued a subpoena that does cause harm and burden by preventing someone from using their computer, at least for more than a day or two, that court has overstepped its authority. Note that this is an opinion, not a description of how lawyers and judges have currently structured things (which is really wrong because of their lack of knowledge about technology). Fixing it, though, is going to be a tough issue for the future.

But do keep in mind that lost evidence can be very easily the result not of the user, but of things beyond the user's control, at least if they keep using their computer. Tell me what you would think if a subpoena ordered you to shut your computer off, and not run it or use it at all, for 30 days, until they can get a bit image of the drive made (whether you did anything suspect or not)?