Slashdot Mirror
Safeguards For RIAA Hard Drive Inspection
NewYorkCountryLawyer writes "In SONY v. Arellanes, an RIAA case in Sherman, Texas, the Court entered a protective order (PDF) that spells out the following procedure for the RIAA's examination of the defendant's hard drive: (1) RIAA imaging specialist makes mirror image of hard drive; (2) mutually acceptable computer forensics expert makes make two verified bit images, and creates an MD5 or equivalent hash code; (3) one mirror image is held in escrow by the expert, the other given to defendant's lawyer for a 'privilege review'; (4) defendant's lawyer provides plaintiffs' lawyer with a 'privilege log' (list of privileged files); (5) after privilege questions are resolved, the escrowed image — with privileged files deleted — will be turned over to RIAA lawyers, to be held for 'lawyers' eyes only.' The order differs from the earlier order (PDF) entered in the case, in that it (a) permits the RIAA's own imaging person to make the initial mirror image and (b) spells out the details of the method for safeguarding privilege and privacy."
1. Who pays for the neutral expert?
2. Who makes the deletion of the privileged files?
3. How are the privileged files going to be deleted?
Ray Beckerman +5 Insightful
Digital forensics is a very tough issue as laws are somewhat immature and judicial precedence over what is acceptable and what isn't, isn't set yet. What is considered in plain sight on a hard drive? These questions haven't been fully answered yet and it is going to take at least one high profile case before it is done. And always remember to use a write blocker when examining somebody else's hard drive. Even booting into Windows will change the timestamps on a lot of files which might allow the theory of the evidence being planted.
My vote: it's the troll. It's too stupid to do a parody of anything.
Ray Beckerman +5 Insightful
It's like reading a procedures document from the Ministry of Information Retrieval.
You just KNOW that the creepy bureaucratic gnomes who write up this stuff are going to have a hand in designing the "revised Internet" that's made the news lately.
Your computer has been used to violate article IV of the The Working Artists' Protection Act. Please unlock your front door, sit on the ground, place your hands behind your head and wait quietly. Attempts to flee, contact the press, or hire legal counsel is a violation of the P.A.T.R.I.O.T. III Act and may result in detention in an Overseas Protective Facility.
I would strongly recommend against that, if you make the tiniest of mistakes such as timestamps which lets them show that you reinstalled your OS or swapped out your disk for a fake system after being subpoenaed, you could find yourself at the wrong end of some nasty criminal charges for destruction of evidence, obstruction of justice and so on. If you think psying a few thousand dollars is bad, you should see what a felony conviction does for your life...
Live today, because you never know what tomorrow brings
Think they'd buy it?
No, it said the earlier order specified that an RIAA's person was to make the image. The new order says agreed upon expert.
Verbatim, from the new court order:
1. Kimberly Arellanes ("Defendant") shall make her computer hard drive available for imaging by Plaintiffs on or before March 21, 2007 [emphasis mine]
Clearly the court order says that Sony gets to do the initial imaging.
Step 2 is, "an expert in computer forensics selected by the parties shall make two (2) verified bit-images". That's the second set of images. The initial image is done by Sony.
Stop-Prism.org: Opt Out of Surveillance
I think 1 and 2 are consistent, it's just the numbering in the document isn't the order of events.
How I read it, it's basically:
1) Plaintiff, don't worry, you'll get access to the drive by March 21
2-3) Defendent, don't worry, here's how we'll do it---first, you get to delete your private files
IANAL, but that's how I read it. The summary's a bit confusing, and seems to suggest that #1 in the document has to occur before #2, which really doesn't make sense, as the GP points out.
Priveleged file list
1) *.mp3
2) *.avi
3) *.mpg
I'm wrong - in fact I get the feeling that it's now important that MD5 is NOT used. NIST (an authority when it comes to forensic investigations) do *not* recommend the use of MD5 checksums. The grandparent was perfectly correct. A decent summary (sorry PDF) is here
Simple solution is to simply use something like TrueCrypt.
:)
TrueCrypt is pretty neat, but that brings up a question. If you encrypt your entire hard drive, what happens when your computer is taken as evidence? Can you be required to divulge the decryption key? IANAL, but I assume that you can be held in contempt of court (or something) by refusing to offer it up, leading to criminal charges, fines, and/or jail time. In any case, I doubt you can just give the RIAA the bird and say "Nah nah, can't touch this" because your stuff is encrypted.
Does anyone know the details about this? I doubt encryption helps you when it comes to legal matters, unless maybe you can plead the Fifth. After all, by giving up the decryption key you may be incriminating yourself
Anyone know?
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Assuming you really do have something to hide, using an encrypted volume embedded within another encrypted volume could be very useful. TrueCrypt supports nested encrypted file systems and since TrueCrypt uses no headers to demarcate its volumes, it is not possible to determine if an additional volume is embedded within a TrueCrypt volume. In effect, it provides plausible deniability of the existence of a 2nd embedded volume if you're forced by court order to decrypt the main volume. (stick some Creative Commons licensed mp3 files in the main volume though, just to throw the RIAA the middle finger a little more.)
Better yet, support non-RIAA artists at sites like Magnitune. The quality of music I've found there is proof positive that the RIAA no longer has a legitimate purpose in the music industry.
My tips for installing TrueCrypt on Fedora Core 6.
1.A loaded S&W .357 for use on the RIAA trolls trying to gain access to my house.(Under Ky Law I may defend my personal property using deadly force if I deem it necessary)
2.A good self destruct device (easy to built and arm) for the hard drive(renders it absolutely useless to any forensic expert,since it physically destroys the platters.)
3.I use an external drive to store the MP3 and other multimedia files on.Easily hidden,(like the old Varmit XL1000 CB Linear amps of decades past)
Anyone wanting to seize my machine will pay dearly for trying.I just don't give a damn anymore since I had the nervous breakdown last year.
That way,If the RIAA does get the machine,it will turn to scrap before they can get it 2 miles away.Paranoid? Sure,but with the corruption of the courts these days,these steps are needed.
Geek Hillbilly
Suppose one were to have a CRON entry that does touch /* -R every night at 3AM? For extra goodness, have it write out 4 random times and then the new time to prevent data recovery of original times. Running every day for a week, it'd be impossible to get the originals. It's impossible to prove anything, including when the script was added, as dates are overwritten constantly. Goodbye timestampiness!
Or if you're real paranoid, just get a laptop body + huge HDD + wireless and bury it in your wall and store your shit on that. Just manually mount the (encrypted) remote volume and supress NFS logging and there's zero evidence that you ever had any files.
Just remember to encrypt everything anyway. And use ext2fs to avoid a journal leaving any "suprises" behind.
And what about disk-copy utilities that duplicate a disk, timestamps and all, except you leave out certain important things (like ~/music/) from the copy? Actually, best to have some classical or nerdcore music, lest the absence of anything prove suspicious.
I guess what I'm saying is, there are many, many ways to foil the MAFIAA. You just have to implement them beforehand, and calmly cover every angle. Trying to do something *after* getting subpoenaed is a bad idea, because then you're hurrying. And as you say, one tiny mistake is all it takes, and people tend to make mistakes when they hurry.
Pleading the Fifth:
Judge: "How do you plead?"
Defendant: "Ta-da-da-daaaaaa, ta-da-da-daaaaaa..."
(sorry, couldn't resist...)
The Hacker's Guide To The Kernel: Don't panic()!
and I'm proud to have one of the most extensive Christian rock sections that I know of.
You mean that people are actually ripping and sharing Christian rock??
Thats just *sick*.
In the free world the media isn't government run; the government is media run.
In the end they should receive any MP3 files that are on their list of infringing files, and Online Media Distribution System (P2P file sharing program, for the rest of us) files for the OMDS they've claimed they've identified (e.g. KaZaA) if present, AND NOTHING MORE!
As I understand it (IANAL), you are allowed to remove personal files that have no relationship to the case at hand. The RIAA can object if you try to protect files they say have a direct bearing on their case, however, they should find it an impossible task to justify why they need to see anything other than specified MP3 and/or OMDS files. Don't give them a byte more than they're entitled to.
And most importantly of all, perhaps, wipe all the unused file space. Let them try to prove why they deserve access to areas of the hard drive not included in any files.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Well, in one case they are demanding to image and search the hard drives and all MP3 players of the son of a defendant, who lives miles away, and claims to only have a desktop system at home that he uses for his job as a legal assistant (i.e. large amount of confidential files there). They're trying to do this because, having searched his mother's harddrive and found ABSOLUTELY NO EVIDENCE of illegal activity on it, and only assumed that they were given the wrong hard drive, and are now on the hunt for the correct one that they're sure exists.
In the RIAA's twisted logic, he has either taken his desktop (not notebook/laptop computer) to his mother's house miles away to do illegal filesharing on her Internet broadband account, and then taken it home again, or REMOVED HIS HARDDRIVE and transported it over and back to infringe on record company copyrights. This theory, they feel, allows them to now search his hard drive -- or, I would expect, anyone within 4 degrees of separation from the defendant -- and all music players as they wish. While I believe this was finally ruled unreasonable and unlikely to produce admissible evidence, they now are fighting their best to avoid paying his legal bills that he entailed explaining this bit of common sense to them.
So in answer to your question: Yes!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
TrueCrypt inside of TrueCrypt.
The inner volume can be hidden, and the creators believe that it is robust enough that it can not be identified if you don't know it is there.
http://www.truecrypt.org/
Nerd rage is the funniest rage.
A subpoena is supposed to not cause undue harm or burden. Since due process has not actually taken place (e.g. argue against it in court), the harm and burden is supposed to be limited. Preventing someone from using their computer is, IMHO, an undue harm and burden. This is the principle our laws came from (not that the laws actually implement it very well).
In the "old days" (when such principles were established), evidence was generally written on paper. An order to preserve evidence would mean not destroying those papers. That would not have been an undue burden in most cases. Someone doing more stuff with papers is generally going to be buying more paper, or at the very least doing more writing in the remaining blank spaces of paper.
The computer of today does not fit an analogy of paper. Perhaps the CDROM backups might. Using a computer typically does involve deleting old data and using the space for new data.
But there is an even more extreme situation here. Microsoft Windows is so vulnerable to exploits that several things can end up destroying evidence, or exacerbating the burden. Infectious programs may cause damage or filesystem corruption. Spamware and spyware may be so pervasive that the only option is to wipe the disk and re-install the OS. It has happened to several of my friends and family (in many cases I've been the one to diagnose the problem and carry out the cure which first involved booting Linux to run "dd" to be damned sure the drive was wiped clean, before booting the Windows install disk to start all over). I actually recommend to people that they re-install Windows every 3 months if there are no visible signs of infection (or immediately if there are).
Is it really the intent of the court to tell someone they must not clean out the infections in their computer, and must let the spamware keep popping up various ad windows, and must let their computer keep emailing spam to others on the internet? Will the court also extend that order to the ISP to prevent the user's account from being shut off due to all the spam coming through?
Courts do need to learn a whole lot more about technology. And they sure aren't going to get it in an ex-parte hearing, especially with RIAA lawyers.
IMHO, when a court has issued a subpoena that does cause harm and burden by preventing someone from using their computer, at least for more than a day or two, that court has overstepped its authority. Note that this is an opinion, not a description of how lawyers and judges have currently structured things (which is really wrong because of their lack of knowledge about technology). Fixing it, though, is going to be a tough issue for the future.
But do keep in mind that lost evidence can be very easily the result not of the user, but of things beyond the user's control, at least if they keep using their computer. Tell me what you would think if a subpoena ordered you to shut your computer off, and not run it or use it at all, for 30 days, until they can get a bit image of the drive made (whether you did anything suspect or not)?
now we need to go OSS in diesel cars
If anyone wants to look up that case it's UMG v. Lindor.
Ray Beckerman +5 Insightful