Slashdot Mirror
Oklahoma Security Expert Attacks RIAA Claims
NewYorkCountryLawyer writes "A group of Oklahoma University students has made a motion to vacate the ex parte order the RIAA had obtained compelling the university to turn over their names and addresses. In support of their motion was the expert witness declaration (PDF) of a computer security and forensics expert who essentially attacked the entire premise of the RIAA's lawsuit, characterizing the declaration upon which the RIAA based its motion as 'factually erroneous' and 'misleading.' Among other things he pointed out that 'An individual cannot be uniquely identified by an IP address,' and that 'Many computers can be connected to the Internet with identical IP addresses as long as they remain behind control points.' The students are represented by the same Oklahoma lawyer who recently obtained a award for $68,000-plus in attorneys fees against the RIAA in Capitol v. Foster."
"Oh SHIT ... not this guy again."
The higher the technology, the sharper that two-edged sword.
No matter who comes out on top only the lawyers win. :/
~
;d
"Many computers can be connected to the Internet with identical IP addresses as long as they remain behind control points" Did the MAFIAA really think someone would overlook this point? Anyone with a class in Internet 101 knows that routers assign one IP address to represent whatever computers are attached to it. I'm glad their having their asanine package of BS handed right back to them.
Sure baby, I'll give you my phone number...in Hex
I'm wondering why it's taken other lawyers so long to realize the RIAA is ripe for fleecing with their undefendable suits. Surely the lawyer vs. lawyer guys would have figured out by now that the RIAA, with so much $$$, is ripe for plucking...
:)
I'm actually ashamed of this, BTW
Moderation in everything, including moderation.
Nitpick:
TFA says the 11 students are at Oklahoma State University (OSU), not that Other University to the south (OU).
[ Yes, I am an alumni of OSU. ]
As usual, the RIAA is full of shit.
I think this is cool...I really do. It's neat that some Oklahoma students are standing up to this. But under no circumstances do I wish the state's flagship university (University of Oklahoma) to be confused with Oklahoma State University. Not even with regards to wrestling...it just isn't worth it.
chillax137
One can only hope that if they get hit upside the head with a proverbial baseball bat often enough, perhaps they'll learn? After all, even the dumbest dog learns after a while, right? Nah, probably won't happen..
...how big is the school in question? I've been wondering recently whether the RIAA has ever gone after schools with big legal programs. Have they been avoiding a fight with students who might have a large number of friends training to be lawyers? I have visions of some professor who gets sufficiently aggravated that he assigns his entire class to bury the RIAA in legal briefs.
So what is the most likely outcome of the motion?
I am government man, come from the government. The government has sent me. -- G.I.R.
Personally, pedestrian rights in particular, I like traffic signal cameras. But a suit against the cameras was successful based on Minnesota law that they photograph the license plate but do not identify the driver. Same difference I would think.
"Many computers can be connected to the Internet with identical IP addresses as long as they remain behind control points."
Yes, we all know this is true from a technical perspective. However, the RIAA is not as dumb as to ignore it. From the depositions in the Lindor case (posted earlier by NewYorkCountryLawyer) they are also relying on the fact that Kazaa (and workalikes) apparently include the local IP in the protocol. So if I'm behind my router, and my IP is 192.168.1.1, but my router's IP is 123.45.6.78, then the RIAA will see BOTH addresses and know whether there's some NATting going on with a pretty high degree of certainty. However, if Kazaa reports the local IP as 123.45.6.78 as well, then it's highly unlikely any more than a single computer is behind that IP.
Reading the report, the "expert" here appears to be completely ignorant of this fact.
Also, some of this is really atrocious. Early in the report it cites an example of someone downloading child pornography sitting in a car by "hacking" a wi-fi network. Only at the end of the report does it admit that the network was unsecured. If you connect to 'linksys' are you "hacking" that network? Would you use that term No. No "hacking" (in any reasonable sense) is going on.
Is the "expert" a native English speaker? "Botnet, Trojan, and Back Door are example of malicious codes..." Aside from the grammatical atrocities, I have never heard of my fellow software engineers referring to software programs as "codes." A back-door is not a "code" or a program, nor are botnets. Bots are, Trojan (Horses) are, and they can open back doors. Precision, please?
Do look at the expert's biography page on the site shilling his book. Plenty of asserted qualifications and certifications, although I don't see any formal degrees listed anywhere. It also asserts that "One final note Jayson was chosen as one of Time's persons of the year for 2006." (hint: so were you). The grammar in the bio is even worse than in the expert brief. Do a search for his name and you'll find precious little at all.
I'm not saying that the RIAA is doing due diligence; the Lindor briefs leave a lot in question (although less than most slashdotters would like). However, fighting back with equally specious and unresearched information doesn't seem to be a much better strategy.
[ Yes, I am an alumni of OSU. ]
Are you an alumnUS? Or are you siamese twins?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Everything that the security expert says in his submission to the court is, of course, true. But in the same way as the RIAA's submission doesn't tell the whole story, neither does this.
Universities have large IP blocks, and - for the most part - are in no danger of running out of IP addresses (negating the need - but not necessarily the use) of NAT technologies to get around this.
So while all of the assertions are true - there is still a reasonable (if not completely deterministic) chance that the IP address of the P2P user can be tied to a person (or, at least, network account).
So.. while there is no guarantee that they'll be able to identify the correct person.. there certainly are reasonable grounds for further investigation.. and so, IMO, the judge should side with the RIAA on this one.
I am the maverick of Slashdot
I hope he attacked his claims with a chain saw... Christ! Enough RIAA. We get it, dont illegal trade your terrible music. We get it, but we dont give a shit.
...I don't necessarily agree with this, but most ISP's have similar clauses in their TOS: You are responsible for whatever your equipment puts out/takes in over the network connection. That's a contract between the ISP, the customer, and no one else. I'm not sure what makes Starbucks (for instance) not liable if a wifi customer downloads kiddy porn, but a person who owns an open WAP gets their PCs confiscated by the cops. The person is, reasonably, a suspect.The RIAA are like sharks, seeking out a lone victims and quickly eviscerating them, particularly the weak or the slow, and those already leaving a tempting blood-trail in the water.
By contrast, the defendents are starting to behave like dolphins, which individually will easily fall prey to sharks, but as a group may band together to rapidly ram the sharks in the gills or other sensitive organs until they break off, or eventually, due.
Give 'em another jab in the gills boys, and we'll see if the sharks will learn to stay away.
why aren't judges protecting the people?
The law is not really in the RIAA's favor here.
The RIAA has shown a history of fradulent law suits.
Why aren't people countersuing for malicious prosecution?
They're using their grammar skills there.
... since it parodies a well-known, wide-spread phenomenon: businesses with illogical business plans.
This expert's opinion is absolutely worthless as he is clearly no expert despite all his paper titles. He totally ignores the RIAA's "In a P2P network" preface. P2P doesn't work to share out files from behind a router using NAT except by port forwarding and therefore the IP address does uniquely identify a serving computer on the Internet in a P2P network. It could be argued that the owner of the router was equally guilty by aiding and abetting the P2P user by allowing the port forwarding.
By the way, after many years I've discovered a way to block file serving at the boundry using Cisco routers. If implemented by universities, the above situtation would never occur. The answer: use reflexive ACL with bypasses for university owned servers.
Everyone in the world needs to go and buy an 802.111/b/g/n (whatever) Wireless Access Point/Router. Give it an SSID of "FREEACCESS", broadcast SSID, no encryption or security. Then restrict it to only have access to the internet, and not your home network (however you would like to do it), and throttle the bandwidth to an acceptable limit. Now place the Access Point/Router in your front yard.
Magically you have given anyone in the world the ability to utilize "your" Internet IP Address.
The only thing you can get charged for now, is if they actually find the files on your PC. Even then, if you use Auto-Logon, or no password at all, anyone with access to your house physically could have done that on your PC...
Well you get where I am going with this...
I actually know someone who works with law enforcement to locate people who have downloaded child porn. It's a lot more complex then you think.
There are 3 steps
*Look at the neighborhood and see if there is potential risk, and/or shady behavior from the suspect(s).
*Check if the network is secured.
*Attempt to match the MAC address.
With open wireless connections popping up everywhere, there's a lot of potential for false positives. Holding the owner of the network accountable is just foolish.
Ya mean Oklahoma actually has "security experts"? Other than the rent-a-cops at the Indian casinos?
I can have as many as 40 computers running on my very basic home network. They will each and every one have the same IP address.
They will all have unique addresses. They will have (probably) a single PUBLIC address provided via NAT and advertised to the upstream network. Within your PRIVATE network, they will have unique addresses. This is the entire point of TFA.
If privacy had a tombstone it would read "We did it for your own good" . -- John Twelve Hawks
This is the problem with the legal system. At minimum, these tactics should be thrown out of court as SLAPP suits.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Which is connected to a wireless secure router.
I could have not secured it, in which case anyone could wargang it and download music without authorization.
Or it could be my son had a friend over who did it while he was upstairs in the bathroom - usually as a joke, teens do that a lot.
Or it could be the girlfriend of my son wanted to show him her cool blog which had music on it.
-- Tigger warning: This post may contain tiggers! --
Where the DAs say, "Anyone can convict the guilty. It takes a REAL prosecutor to convict the innocent."
"Reasonable doubt" does not mean moral certainty.
Your plate is on the car. The car matches the plate. The odds are overwealming that you, a friend, or family member, will have been behind the wheel -- with your express or implied consent.
This seems to me a "reasonable" argument for the state to make:
You aren't in court because you were the driver, you are in court because you are responsible for the use of your car. Vicarious liability in the United States
"Traffic Court" may not be a criminal court at all. Traffic Violations Bureau
You may be facing the streanlined procedures, lower burden of proof, and limited right of appeal of administrative law.
In a pre-technological society you learn to live with the uncertainties of eye-witness testimony.
Personally, I'd rather take my chances challenging the evidence of the camera then directlty contradicting the testimony of the village policeman or state trooper who everyone in town has known since the days he was a five-year old kid on a tricycle.
It certainly does "count" as a defense. In criminal proceedings, the burden of proof is upon the state to show that the defendant is guilty beyond a reasonable doubt. If the state cannot convincingly place the defendant at the scene of the crime (bad photo, no face)there is no "absolute proof", only circumstantial evidence and supposition. Entering evidence of an alternate supposition can and SHOULD raise reasonable doubt. The state is making assumptions as to the identity of the driver. If there are equally possible alternate scenarios, the state cannot prove its case beyond a reasonable doubt.
Read about the Minneapolis case where the district court abolished such cameras. Clearly, greater legal minds than yours believe that the system is inherently unfair.
Minnesota courts don't seem to agree with you.
It is NOT the responsibility of the defendant to do the police work for the state. The defendant does not have to find the guilty party just because the state decides to be lazy and let cameras and computers do their work for them. The defendant ONLY has to introduce reasonable doubt as to his/her own guilt. Barring a convincing photo that shows the defendant driving the car, it will take very little to introduce that doubt. Remember, the defendant does not have to testify on his/her own behalf, so he/she cannot be compelled to identify the driver. He/she merely needs to call a witness that can testify that there is more than one individual with access to the vehicle. If the state cannot place the owner with the car, there is reasonable doubt.
Think about it this way. The state wants to convict you of a crime by simply saying, it could be you. With our legal rights, they must say it has to be you.
> ... and once some of those computers go to class (or to sleep, for example,) ...
> take over the MAC address and ask for a new DHCP lease
Is it really necessary to ask for a new lease? I thought one can just take over both the MAC address and the IP address and use it. Shouldn't be a problem as long as the other computer is off. (or just take the IP address. Behind my NAT router at home I just assign static IP addresses and they of course work as long as they are in the same subnet. When in the distant past I asked to use my own laptop in the (university) department network the helpdesk guy just told me to make up an IP address in the network and there should be no problem.)