Slashdot Mirror
Judge Orders TorrentSpy to Turn Over RAM
virgil_disgr4ce writes "In an impressive example of the gap of understanding between legal officials and technology, U.S. Magistrate Judge Jacqueline Chooljian 'found that a computer server's RAM, or random-access memory, is a tangible document that can be stored and must be turned over in a lawsuit.' ZDNet, among others, reports on the ruling and its potential for invasion of privacy."
Maybe she meant 'hard drive'? The majority of the people I supported while working IT during college used the terms RAM and hard drive interchangeably.
-gb
Here is a working link to the article: http://news.zdnet.com/2100-9588_22-6190900.html
I read a couple of other articles on it (google 'em, easy to find) and basically the Judge understands more than this Slashdot abstract says.
Torrentspy was contending that they had no record of user's IP addresses, since they don't do any IP logging. The Judge has ordered that since, even though there is no logging, the IPs are available in the RAM for a period of time, that constitutes a recording and they were ordered to capture that information from the RAM in a more permanent spot.
This is new because it's the first time that volatile RAM has even been considered as evidence in that manner.
As the TFA explains, the judge means that the RAM would become a legal document, and that any information put on it would have to be retained for later examination, and that if this ruling were extended to things like SOX, a SOX-complying company would have to keep transaction logs or images of their RAM so that the state of the RAM at any point in the past could be accounted. EEep.
Don't blame me, I voted for Baltar.
Maybe a few minutes later. Not hours or days. The decay is total by then, and there isn't even theoretical equipment that could distinguish its state from noise.
Don't count on it. In the UK, under the Regulation of Investigatory Powers Act, anyone can be required to turn over the password to decrypt any encrypted data they have that is needed for certain legal purposes... even if the "encrypted data" is just random bits, with no significance and not derived from any meaningful data. You are presumed guilty if you won't (or can't) supply the appropriate password.
If this case happened in the UK, the RIP Act would appear to make you guilty by default if you couldn't supply a password that "decrypted" whatever data was in the RAM when it was next powered up to turn it back into whatever they think was there before. And given that these are people who don't appreciate the volatile nature of RAM, I wouldn't hold out much hope of explaining to the judge why it's not possible to comply with their ruling.
Aren't you glad that our inept legislators and your incompetent judges work in different jurisdictions?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Oh, and whoever moderated this informative, please never ever use mod points again.
[1] Main memory in all mainstream machines is DRAM.
I am TheRaven on Soylent News
When I was a kid, RAM was made of flip-flops and I had to go to school with three feet of snow, and it was uphill both ways. Oh boy.
Nowadays, BosstonesOwn (794949), RAM is made out of capacitors and they have to be "refreshed", that is, some circuit re-reads/re-writes the same values all over many times per second. One second without refresh, and all the data is gone for ever and ever and ever.
BEFORE: a flip flop has an input, a clock, and an output. when you put 0 in the input and pulse the clock once, the output is now 0; if you put 1 in the input and pulse the clock, the output now has 1. This is how one bit of memory is stored. Also know as SRAM, this kind of memory is fairly large in terms of integrated circuits (like 20 transistors in-die), is reasonably fast, and it's still found in L0/1/2 caches of microprocessors, in quantities in the range of Megabytes.
NOW: you have a capacitor, if you put 1 in its input (that is the same pin as its output) it retains this one for a fixed period of time (T). if no-one tries to read this bit in, like, T/2, a circuit in the memory reads this bit, and if it's 1, writes again 1 in its input. Also known as DRAM, this kind of ram is smaller per-bit (one capacitor in-die, 40-60 times smaller than a bit of SRAM), but the memory itself has to add in the end the size of the refreshing circuit, it's slower (because read cycles must be synched in time with refresh cycles), and is found in the "RAM" socket of your motherboard, in quantities in the range from hundreds of Megabytes to Gigabytes.
So, DRAM _really_ clears, i.e., if unplugged when plugged again it's all beautifully zeroed.
Ok??
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
Actually, they are. The data has to be modulated to a particular frequency that equates to a television channel, using 64-QAM or 256-QAM modulation on the downstream (to the customer) channel, and QPSK or 16-QAM on the upstream (to the provider) channel. The cable system I used to work for used 64-QAM on 105MHz downstream (a very, very low frequency for a cable modem, equating to channel 97 digital 1 if I remember correctly) and QPSK on 26MHz (pretty typical). Just because the channel is carrying digital data doesn't mean it isn't modulated.
Attention dipshits: learn to read.
From the first line of TFA:
In a decision reported late Friday by CNET News.com, a federal judge in Los Angeles found (PDF) that a computer server's RAM, or random-access memory, is a tangible document that can be stored and must be turned over in a lawsuit.
Note the "can be stored" bit.
If you'd read the PDF of the court order you'd have noted the judge understands quite well that the RAM is volotile and that he was asking the relevant parts be stored. Specifically, he wants the ip addresses stored.
The story headline should have read "judge orders torrentspy to store IP addresses".
Need Mercedes parts ?
You have been misinformed if you take the slashdot summary at face value.
And you have been misinformed if you RTFA.
The judge's decisions responds to most of the comments posted here, and the lawyers comments naively repeated by the author of the article.
Instead, read the decision (RTFD) that the article links to.
Although she mistakenly says websites have RAM, she definitely knows what RAM is, if you read her analysis about why the RAM should be turned over. She doesn't want the chip, she wants the ip address that temporarily pass through the website server's RAM.
Based on existing case law from other copyright cases, whatever passes through a computer's RAM is a tangible copy, if only a temporarily one. According to the rules of discovery, the defendant must produce this copy because it is within their control. It is within their control due to the fact their provider uses the a web server (Microsoft's), and this server has the capability of logging ip address that temporarily pass through the computers RAM.
So "turning over the RAM" actually means "hand over the documents that are temporarily stored in the RAM by simply turning on the logging function of the webserver." The judge is simply following existing case law and discovery procedures.
There are established rules that say that a defendant cannot be compelled to create new documents for the plaintiff, even if the new document would just be a compilation and/or summary of other documents. TorrentSpy maintains that they do not currently log IP addresses, and therefore an order to begin logging IP addresses and turn over their logs would be illegal. The judge has ruled that RAM is legally a document, and therefore they DO in fact have such documents in their possession, if for a very short period of time. As such, he has stated that a requirement to enable logging does not constitute creating a new document, and is simply transcribing a document from one format to another, which they CAN be required to do. And that's why he referenced the RAM, because without acknowledging that this data is contained in the RAM "document" at one point, they cannot be legally compelled to enable logging.
ASCII stupid question, get a stupid ANSI
Not in modern DRAM. Modern DRAM is basically [sic] a capacitor.
Sure, forgetting about the whole row and column stuff, and the sense amps...
However, due to the natural resistance of silicon there is always some leakage current leaving the capacitors.
Incorrect. Capacitors lose charge because dielectrics are not perfect insulators, and thus some current actually leaks through from one plate to the other.
This means that RAM left alone for more than a few tenths of a milisecond will lose enough voltage to drop to a logical 0
Disturbingly wrong. Most manufacturers specify that a row of DRAM must be refreshed at least every 64 milliseconds. In fact, Wikipedia cites a pdf saying that some information can be retained for up to minutes in a cell of DRAM - though you will get some bit errors.
TO prevent this, RAM is constantly refreshed- the ram chip will spend spare cycles writing its own value to itself.
Actually, the memory controller will issue a refresh command to the DRAM chip. This is probably what you were thinking about before...a row refresh must happen every 7.8 microseconds or so (depending on the RAM chip). But, that's because the refresh operation only refreshes a single row. The DRAM chip usually has an internal address counter, so you just say "refresh the next row" and the DRAM chip already knows what the "next row" is, and afterwards it increments it so the next time you issue the refresh command, it refreshes the next row. If you execute these refresh operations every 7.8 microseconds, then in 64 milliseconds you will refresh every row of memory on the DRAM chip.
Oh, and by the way, reading from any cell of DRAM will refresh the entire row that cell is on, because reading from DRAM is a destructive operation. Therefore, there's actually a row of latches at the bottom of the columns, and the values from those latches are placed back into the capacitors while the bit of interest is being shuffled out onto memory bus.
Writing to a cell also requires reading the entire row, which means that writing also refreshes that row.
:(){
No, as that's not what was ordered. The order was to start logging the information so that it can be submitted as evidence in the future, not to hand over the RAM chips themselves.
It's official. Most of you are morons.
i am kinda late to the fray, but the actual ruling doesn't seem to concern itself with the technical aspects of RAM, instead, it addressess the argument "does TorrentSpy have electronic recordings of their server logs", and, as far as read, it seems to say "yes, because data is in RAM for a while, and RAM is an electronic media built for the purpose of storage and retrieval of information, albeit short-term one, and TorrentSpy can read the data during that time".
The whole argument is there in the first place because TorrentSpy seem to allege they don't have logs because the logs are not on disk, but in RAM, which is transient and not an electronic medium.
So, to my IANAL eyes the ruling says "if you are in the US, and you have been issued a court order to store all your electronic communications, you better do so and don't come up with excuses which are lame technically."
I respectfully decline to comment on whether this ruling is good, bad or ugly.