Slashdot Mirror
Oklahoma Security Expert Attacks RIAA Claims
NewYorkCountryLawyer writes "A group of Oklahoma University students has made a motion to vacate the ex parte order the RIAA had obtained compelling the university to turn over their names and addresses. In support of their motion was the expert witness declaration (PDF) of a computer security and forensics expert who essentially attacked the entire premise of the RIAA's lawsuit, characterizing the declaration upon which the RIAA based its motion as 'factually erroneous' and 'misleading.' Among other things he pointed out that 'An individual cannot be uniquely identified by an IP address,' and that 'Many computers can be connected to the Internet with identical IP addresses as long as they remain behind control points.' The students are represented by the same Oklahoma lawyer who recently obtained a award for $68,000-plus in attorneys fees against the RIAA in Capitol v. Foster."
...how big is the school in question? I've been wondering recently whether the RIAA has ever gone after schools with big legal programs. Have they been avoiding a fight with students who might have a large number of friends training to be lawyers? I have visions of some professor who gets sufficiently aggravated that he assigns his entire class to bury the RIAA in legal briefs.
"Many computers can be connected to the Internet with identical IP addresses as long as they remain behind control points."
Yes, we all know this is true from a technical perspective. However, the RIAA is not as dumb as to ignore it. From the depositions in the Lindor case (posted earlier by NewYorkCountryLawyer) they are also relying on the fact that Kazaa (and workalikes) apparently include the local IP in the protocol. So if I'm behind my router, and my IP is 192.168.1.1, but my router's IP is 123.45.6.78, then the RIAA will see BOTH addresses and know whether there's some NATting going on with a pretty high degree of certainty. However, if Kazaa reports the local IP as 123.45.6.78 as well, then it's highly unlikely any more than a single computer is behind that IP.
Reading the report, the "expert" here appears to be completely ignorant of this fact.
Also, some of this is really atrocious. Early in the report it cites an example of someone downloading child pornography sitting in a car by "hacking" a wi-fi network. Only at the end of the report does it admit that the network was unsecured. If you connect to 'linksys' are you "hacking" that network? Would you use that term No. No "hacking" (in any reasonable sense) is going on.
Is the "expert" a native English speaker? "Botnet, Trojan, and Back Door are example of malicious codes..." Aside from the grammatical atrocities, I have never heard of my fellow software engineers referring to software programs as "codes." A back-door is not a "code" or a program, nor are botnets. Bots are, Trojan (Horses) are, and they can open back doors. Precision, please?
Do look at the expert's biography page on the site shilling his book. Plenty of asserted qualifications and certifications, although I don't see any formal degrees listed anywhere. It also asserts that "One final note Jayson was chosen as one of Time's persons of the year for 2006." (hint: so were you). The grammar in the bio is even worse than in the expert brief. Do a search for his name and you'll find precious little at all.
I'm not saying that the RIAA is doing due diligence; the Lindor briefs leave a lot in question (although less than most slashdotters would like). However, fighting back with equally specious and unresearched information doesn't seem to be a much better strategy.
I think the RIAAs point is that whoever runs that router (and, presumably, the network connection) is responsible for the traffic it passes.
Like a Red-light camera: they send the ticket to the owner of the car, not necessarily the driver. (Of course, in that case, the owner can simply prove it was not them, and provide the name of the driver, and the ticket will be re-assigned.)
I don't necessarily agree with this, but most ISP's have similar clauses in their TOS: You are responsible for whatever your equipment puts out/takes in over the network connection. I'm not sure what makes Starbucks (for instance) not liable if a wifi customer downloads kiddy porn, but a person who owns an open WAP gets their PCs confiscated by the cops. But I wish the 'immunity' applied to anyone.
The problem seems to be growing the awareness of these basic facts among the judiciary: cases like this can only help in that regard, I'd think. Those of the legal mind are fond of informing laymen that the law is complex and ever-changing and that only one who is properly trained could possibly comprehend its intricacies. I personally believe that the law is often more complex than it needs to be (and that is certainly no accident) but, okay, I'll buy that argument. As an engineer I cheerfully admit that the law is an arcane mystery, and I would certainly never set foot in court without proper representation.
However, the truth is that the global network and the technologies behind it are pretty goddamn complex as well, and change more often than the average trial lawyer changes his boxers. Gross oversimplifications and prevarifications regarding network technology, such as those pulled out of thin air by the RIAA's so-called "expert witness", have so far resulted in several severe miscarriages of justice. Unfortunately, while it is a necessity to have legal representation in a technical case, there seems to be no corresponding requirement that the legal beagles involved have a clue about technological underpinnings of said case. Given how successful the RIAA has been with the testimony of Mr. Linares, it's apparent that expert witnesses are of no help when the people making the legal decisions don't have the mental knowledge base to tell the wheat from the chaff.
The higher the technology, the sharper that two-edged sword.
And I got news for you, that was heard in an RIAA conference room.
Only thing, they're not good listeners, as you may have noticed already.
Ray Beckerman +5 Insightful
Like a Red-light camera: they send the ticket to the owner of the car, not necessarily the driver. (Of course, in that case, the owner can simply prove it was not them, and provide the name of the driver, and the ticket will be re-assigned.)
Or, as in the case of Minneapolis' red-light cameras, the entire process is deemed unconstitutional because it presumes guilt rather than innocence.
The only surefire protection against Microsoft infections is abstinence. - The Onion
I hope this is a troll.....
Red light cameras increase the accident rate as often as they decrease it. Also, the real dangerous drivers that actually run the middle of the red light and T-bone innocent drivers, aren't paying attention. Before red light cameras they weren't paying attention in a situation where their life was at stake, now they aren't paying attention in a situation where their life plus a $100 ticket is at stake. It isn't a deterrent to the real problem.
The people who actually get tickets are the ones that don't even see the red light. If it changes while you are in the intersection, you are running it. When traffic is heavy, sometimes you get caught in it. The alternative is to wait back at the line for a huge clearing and go if the light hasn't turned yellow yet. I know of many intersections where there is no left turn signal and at rush hour, the only time to turn left is at the yellow when oncoming traffic stops. If people were to obey the letter of the law, it would take an hour to turn left.
There are also plenty of cases where the yellow duration is set at less than the legal minimum for an intersection of the type it is installed at. Sometimes, conveniently, they fix the timing three months after the camera is installed and claim that the reduction in fines is from the camera itself, while it is really from the adjustment of the timing.
In summary, red light cameras mostly ticket people who are not a threat to anyone and they unfairly target those who have one on their drive to work. Some people are scrutinized 500 times a year and not allowed to make a single mistake while others never get a look from a camera because of where they live.
I live near Buffalo, NY. Buffalo is considering putting red light cameras downtown and desyncronizing the lights on Delaware Avenue. They want people to hit more red lights. Buffalo doesn't like to raise property taxes because it is politically unpopular and nearly 50% of downtown land is tax-free. Buffalo loves "alternative revenue streams", our sales tax is around 9% (due to several recent hikes), we recently started charging sales tax for airport parking, the residents are still mad about a bunch of fees that have been newly assessed like a "garbage user fee" that used to be paid for with tax money. The Mayor even admits that revenue is part of the reason they are being considered.
They are neither free to own or operate, over their lifetime very few will pay for themselves in the fines they are able to inflict.
This is untrue. There are companies that will install the cameras for free, operate them for free, and only ask for a cut of the ticket money. There is zero chance that the city will lose money and I'm sure the chance that the operating company will lose money is also slim. In California, many red light cameras are operated by Lockheed Martin. In 2001, they were sued for camera placement in San Diego and had to refund a bunch of tickets after it was discovered that they had the cameras installed primarily in intersections where the yellow was too short or there was some other design flaw increasing the liklihood of someone running the red. No cameras were installed in the top 10 most dangerous intersections. Also, if you go to court to fight a citation, a CHP officer stands in to "represent the policies of the vendor". You never get to question your actual accuser.
...I don't necessarily agree with this, but most ISP's have similar clauses in their TOS: You are responsible for whatever your equipment puts out/takes in over the network connection. That's a contract between the ISP, the customer, and no one else. I'm not sure what makes Starbucks (for instance) not liable if a wifi customer downloads kiddy porn, but a person who owns an open WAP gets their PCs confiscated by the cops. The person is, reasonably, a suspect.All you have proof of is that something owned by a particular individual was used in the commission of a crime. You do not have proof that that individual was the guilty party.
But that is enough for the police to arrest (or at LEAST question) you. It's enough to get you put on trial.
If the item is a common item (a Yellow #2 pencil), then there is loads of doubt. Was it MY Yellow #2 pencil, or one of the MILLIONS of others that are made each year? Even if it was mine, anyone could have taken one from by desk/bag/etc.
When an item is specific (Make, model, color of car, with a specific license plate), there is little doubt as to the owner. When, in addition, that item is secure from use without a specific key (like a car), then it is reasonable to assume that if that item is being used, it is being used by its owner (or someone the owner trusts). Therefore, it's reasonable to assume that any MIS-use of that item was done by the owner.
What do you propose? That the cops start sending tickets to random people in the same town, instead of the owner of the car? The owner is the only piece of information they have, until and unless the owner tells them who was actually driving.
All you have to do to get around this is is move the camera and make sure that it has the resolution to photograph the actual suspect, and then you will have enough evidence.
And I've agreed elsewhere that they should do this.
But until they do....
Money for nothing, pix for free
This officer also told me that these cameras are the safest way to enforce red lights. It's exceptionally hard for an officer to catch these people, because the officer 1) has to be able to see the light, 2) has to be in the front rank of cars, and 3) often as not would have to run the light themselves, which would be more dangerous than just letting the guy go. You can put an officer at each corner of the intersection, but that's manpower intensive
Or you can equip the intersection with a camera, but have it manned by a single officer who uses it to identify who to pull over, and as evidence against them. This dodges all 3 issues:
1) The police office does not have to see the light. The camera provides the evidence.
2) The police officer does not have to be in the front rank of cars. He can be stationed anywhere.
3) The police officer does not have to run the light himself. He can even be safely stationed out of sight, past the intersection.
4) It is not manpower intensive. It can be done by a single officer.
And as a bonus, when the camera is not being manned it can used to send out notices to people who ran the light. Sort of a hey, did you know you ran this light, and had it been manned you would have been charged.
Point is I don't have anything against camera assisted enforcement, I have a problem with automatic camera enforcement that targets the owner of a vehicle, where you are only even notified of a violation you may not even know has happened months after it happened, where you are responsible even if you weren't driving. (responsible for either paying the ticket or nominating someone else to pay the ticket.)