Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Is RIAA's Linares Affidavit Technically Valid?

Posted by kdawson on Mon Jul 02, 2007 10:51 PM
from the helping-out-the-judge dept.
NewYorkCountryLawyer writes "In support of its ex parte, 'John Doe,' discovery applications against college students, the RIAA has been using a declaration by its 'Anti-Piracy' Vice President Carlos Linares (PDF) to show the judge that it has a good copyright infringement case against the 'John Does.' A Boston University student has challenged the validity of Mr. Linares's declaration, and the RIAA is fighting back. Would appreciate the Slashdot community's take on the validity of Mr. Linares's 'science.'"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Is RIAA's Linares Affidavit Technically Valid? 50 Comments More | Login /

 Full
 Abbreviated
 Hidden
More | Login
Keybindings Beta
Q W E
A S D
Loading ... Please wait.
  • It's not a sworn statement, so it doesn't count as an affidavit. If Linares was really behind this document, it would be a sworn statement.
    • Re:misleading slashdot headline (Score:5, Interesting)

      by rtb61 (674572) on Monday July 02 2007, @11:48PM (#19726705) Homepage
      Not necessarily, it allows a walk away statement ie. he can walk away from any distortions. One example is the exaggeration that the P2P users, have no connection with each other, or knowledge of each other.

      Of course P2P users can know each other really well and can know exactly with whom they are exchanging content they are fully legally entitled to, also in joining a specific P2P network, they are forming a new association, based upon shared expectations of what they mutually expect from this new relationship, an extension to that is the sharing of a part of their personal and private space i.e. a part of their hard disk drive storage space in their personal computer and their files that they have stored their, and upon a mutual understanding of not exploiting that trust and abusing that relationship by using it in a false, deceitful and fraudulent manner.

      The second major lie is of course that 'users' can be identified by their IP address, and hugely misleading fabrication, the only way one user, human being, can be identified by an IP address, is if that IP address was embedded in a device inserted in their body, even then it would be impossible to say that the IP address response was not being generated by another electronic device that had no association with that user at all. An IP address provides a temporary, non fixed, transitory, addressing protocol, so that electronic devices can effectively exchange data across a shared interconnected network. Many devices can exactly the same IP address, they can even connect at the same time, but that will cause network problems for those devices and problems for any other devices attempting to communicate with them. However it terms of routing network traffic, many millions of devices a currently connected to the Internet with exactly the same IP address beyond the default IP address of routers. The lie is again carried over to where Media Sentry, identifies the 'individual' what a crock, this lie is even extended to the ISP, that somehow the ISP can identify who is using the electronic device at the time.

      It would also seem that the RIAA claims copyright on file names, if heaven forbid, you have file names that in part, or whole, including misspellings, match with file names that the RIAA or Media Sentry might possibly association with works they are claiming protection for, you are somehow infringing copyright.

      That closing bit is most telling, we have no idea who is committing the copyright infringement, finally the truth, but we want to prosecute somebody, anybody and everybody based upon a, we say so basis, and a temporary IP address issued by an ISP that is of sufficient security and legal documentation and verification of identity as is necessary to manage a $25 a month Internet account (seriously how much technical effort and expense do you put in to manage and record and track that cheap an account especially hundreds of thousands of them).

      [ Parent ]
      • Re:misleading slashdot headline (Score:5, Insightful)

        by TubeSteak (669689) on Tuesday July 03 2007, @12:58AM (#19727107) Journal

        Not necessarily, it allows a walk away statement ie. he can walk away from any distortions.
        Here's point 2 from his declaration:

        As Vice President Anti-Piracy Affairs I am responsible for evaluating to online strategies for the RIAA, including oversight of the investigations into online infringement of copyrighted sound recordings. As such, this Declaration is based on my personal knowledge, and if called upon to do so, I would be prepared to testify as to its truth and accuracy.
        "I am responsible for evaluating to online strategies for the RIAA"

        Is he an expert? In what? His credentials?

        Before anyone can discuss the content of his Declaration, it seems to me that it would be prudent to evaluate whether or not it should carry any weight at all. After skimming the Declaration, he seems to be making a lot of assertions that I think a Judge would normally expect to come from an expert.

        In other words:
        What qualifies him to testify as to [the Declaration's] truth and accuracy"?
        [ Parent ]
  • The companies behind the RIAA... (Score:5, Informative)

    by Barkmullz (594479) on Monday July 02 2007, @11:07PM (#19726411)

    I do not feel particularly qualified to validate Mr. Linares's claims. However, over the years I have 'forgotten' that the RIAA is just a trade organization, comprised of many different companies. It was interesting to read through the list of plantiffs and put a face on who the RIAA really is. Here they are if you did not RTFA:
    • Arista Records, LLC
    • Warner Bros. Records, Inc.
    • Atlantic Recording Corporation
    • Virgin Records America, Inc.
    • UMG Recordings, Inc.
    • BMG Music
    • Capitol Records, Inc.
    • Sony BMG Music Entertainment
    • Motown Record Company, L.P.
    • Maverick Recording Company
    • Elektra Entertainment Group, Inc.
    • Laface Records, LLC.
    • Interscope Records
    This may not be a good thing, as my hatred will now be diluted
    • I don't see EMI on the list. Are they there under a different name? Or do they deserve our business because they *don't* belong to the pigopolists?
      • Re: (Score:3, Informative)

        According to the wikipedia, EMI is part of the BPI [wikipedia.org] (Britains version of RIAA)

        However so are some of the companies that are also part of the RIAA...
      • Re: (Score:3, Informative)

        They're there as Capitol Records.

        -uso.
    • Re: (Score:3, Insightful)

      However, over the years I have 'forgotten' that the RIAA is just a trade organization, comprised of many different companies.

      How is it that this 'trade' organization isn't illegal? I can understand an industry organization that sets technical standards,

  • "Individual"?? (Score:5, Insightful)

    by paxundae (1031998) on Monday July 02 2007, @11:18PM (#19726475)
    The term "individual" isn't valid, but legally it may be close enough. IANAL. An IP address where files are available is identified, not an individual. That IP address may represent a single traditional computer system, a series of computers behind a router, or even an open wireless access point. The fact that you can trace activity to an IP address does not mean you can trace activity to an actual real person. You can figure out who pays for access to the internet using that IP address, but that doesn't necessarily mean that much. However, legally, it may, if the duty to ensure that an IP address is not used for illegal activities rests with the person who pays the subscription fee instead of the person who uses the address. This may be reasonable...those who pay for access are probably the least cost avoiders (actually, the ISPs may be the least cost avoiders, but we don't want them shutting down every service they can detect).
    • Re:Provable ID problem (Score:4, Insightful)

      by Technician (215283) on Monday July 02 2007, @11:53PM (#19726723)
      The fact that you can trace activity to an IP address does not mean you can trace activity to an actual real person.

      That is the blaring hole in the arguement in the PDF on Paragraph 12 where they compare IP addresses to telephone numbers. They claim that phones sharing one line are like a party line. Only one can make a call from one number at a time. They missed entirely using ports on a router so multiple users behind a router can make a call all at once from the same phone number. The number does not identify the individual any more than call from the political campaign center identifies the individual making the call. You may try to call them back and sue the individual for harrassment, but identifying the individual by the phone number is a problem.

      His declaration under penalty of purgery under the laws of the United States that the foregoing are true and correct should have had peer review so they would indeed be true and correct. They are not and is easly proven so. The following is easly proven. Not all IP address have a direct connected single user computer just like not all phone numbers are to a single person renting an apartment. Enter routers and trunked/ISDN lines and his example falls apart. He should be careful what he signs as true and correct. It could cost him.
      [ Parent ]
      • Re:Provable ID problem (Score:4, Insightful)

        by The Rizz (1319) on Tuesday July 03 2007, @12:45AM (#19727035)

        Only one can make a call from one number at a time. They missed entirely using ports on a router so multiple users behind a router can make a call all at once from the same phone number. The number does not identify the individual any more than call from the political campaign center identifies the individual making the call. You may try to call them back and sue the individual for harrassment, but identifying the individual by the phone number is a problem.
        Actually, I would say IP = phone number is a perfect analogy, and fits precisely with your logic. How? Look at any company with a large phone system, such as corporate offices, call centers, or (most familiar to most people) hotels. There are dozens if not hundreds of calls coming and going simultaneously - all of which connect through the same phone number. If you receive a call from someone inside one of these systems, you (usually) get the same number on caller ID regardless of who called you, or from what internal location. You can trace it back to the building's switchboard, but from there it is impossible to trace further from outside the system. Likewise, when you call to one of these systems, you call a general number and any further routing is done by the system on the other end by giving either a name or extension number (analogous to a port number).
        [ Parent ]
  • It been done... (Score:5, Informative)

    by HaeMaker (221642) on Monday July 02 2007, @11:24PM (#19726527) Homepage
  • Inaccurate statements (Score:5, Insightful)

    by Sparr0 (451780) <.moc.liamg. .ta. .0rraps.> on Monday July 02 2007, @11:33PM (#19726587) Homepage Journal
    In point 12, an IP network is compared to the phone network, and it is stated that only one computer can use each [implied: visible] IP at a time. Given the prevalence of NAT, this is not only technically untrue but also quite reliably false.

    In point 12, it is stated that an ISP or college can identify the user of an IP address. This is untrue as the "user" could be no more than a MAC address, which can change. And even if true, the context seems to imply that this remains true in hindsight, which is false unless logs are kept.

    Point 15 states that human review is involved in the case of EACH infringer, which is blatantly untrue given the history of automated (and wrong) cease and desist letters.
    • Re:Inaccurate statements (Score:5, Insightful)

      by MechaBlue (1068636) on Tuesday July 03 2007, @01:23AM (#19727249)
      The last sentence of point 7 is false. In the days before Napster, a variety of other means were used. One was to submit a list of files to a centralized search engine, which would allow users to find materials on the computers of others. Modern P2P programs provide substantial improvements around usability and performance; however, the functionality that they provide was available and in common use pre-P2P boom.

      Item 8 states that the majority of the traffic on P2P is pirated material and also implies that the "vast majority" of content shared via P2P is pirated audio. Is there data to back this up? I suspect that video, photos, and programs (e.g., games) makes up a large amount of illegal P2P traffic. It feels like a rhetorical device used to paint the RIAA as a tragic victim.

      Item 9 is incorrect. The ISP can not know who the infringers are. They can only know whose account is attached to that IP number. NAT routers are a possible workaround. Also, some services allow for multiple simultaneous IP addresses. For example, Telus requires that visible MAC addresses be registered.

      By registering 2 MAC addresses, Telus will let users have two IPs at once. If Alan has a single NAT router connected, that leaves 1 free registration slot. If Bob, someone completely unknown to Alan, were to get the username and password for Alan's account, it would be possible for Bob to register his NAT router to Alan's account. If Alan only uses 1 device (i.e., 1 IP), there is a good chance that he'll never discover that Bob was piggybacking his account. If Alan needs the second IP, then he'll probably overwrite Bob's MAC without noticing there is a problem. Even if Alan notes that there is a problem, it's unlikely the MAC address could be traced to Bob because Bob could change the MAC address on his device and because of the difficulties of tracking the MAC address of a device from manufacturer to end user.

      Item 9 also feels like a rhetorical device used to paint the RIAA as a tragic victim. The scope and value of piracy is hotly debated. http://arstechnica.com/news.ars/post/20070212-8813 .html [arstechnica.com]

      Item 11 implies that searching is sufficient to tell if a file is a copyrighted song. This is not always the case; unless the file is downloaded, its contents can not be known. I think that "examines" needs to be rigorously defined. (This ties in with the parent's comments on item 15.)

      Item 12 assumes that computers are single user. This is not the case with most modern OSes. It would be possible for someone to log into an unsecured computer and use it for sharing files over P2P. The IP of the computer used to share via P2P may be known but the user can not be. It also assumes that the computer has not been compromised via malware.

      Item 14 states that files are downloaded. However, it does not provide any methodology for determining if the files contain copyrighted audio. Metadata can be falsified. How are logs created and handled? Are they screenshots? (This ties in with the parent's comments on item 15 again.)

      Item 16 states that "...the infringer's ISP quickly and easily can identify the computer from which the infringement occured...". It may be able to provide an IP address but that's not a sure thing (there have been past incidents where the wrong person was identified). They definitely can't prove that a MAC address belongs to a computer that is owned and controlled by the identified account holder. The MAC address is configurable. It's not possible for an IP address alone to be capable of identifying a computer, even if the IP is static.

      Adam decides to open his own business selling socks online and decides to house the server in his home. He upgrades his account to a server account with 1 static IP and sets up his business on that IP. After 3 months with no sales, Adam packs it in and downgrades his account after downloading the complete discography of NKOTB
      [ Parent ]
      • Re:Inaccurate statements (Score:4, Interesting)

        by arth1 (260657) on Tuesday July 03 2007, @02:26AM (#19727611) Homepage Journal
        Also, further to point 11. The copyrights are for the particular performance. There may be many performances of one work, even by the same artist, and the copyrights held by different people. I have downloaded songs directly from an artist's site, where the song also exists on RIAA labels. A search matching the artist and title won't prove that it was a performance their clients hold copyrights to. They may not even know whether other copies exist, who holds the copyright to them, and what the distribution rights are. And if they do, they're showing willful neglect if they prosecute without establishing and documenting this first!

        [ Parent ]
      • Re: (Score:3, Informative)

        By registering 2 MAC addresses, Telus will let users have two IPs at once. ... If Bob, someone completely unknown to Alan, were to get the username and password for Alan's account, it would be possible for Bob to register his NAT router to Alan's account.
        This is a highly fringe case, and Telus isn't even in the US (as far as I know). Most people will be tied to a wire, but in the case of a wireless ISP in the US where multiple devices are allowed and the user let slip his username and password, it certai
    • Re: (Score:3, Insightful)

      Pretty much every sentence in that Linares document has problems. As it's late, I'll pick on just one:

      6. "... millions of people illegally use online media distribution systems to upload or dowload copyrighted material."

      Let's see... "media", means wh

  • Ok, let's break it down. (Score:5, Insightful)

    by spotter (5662) on Monday July 02 2007, @11:57PM (#19726741)
    IANAL or a law student, just a future CS phd (hopefully RSN).

    1) First Linares acknowledges that a route can have an IP address, then he says "Two computers cannot effectivly function if they are connected to the Internet with the same IP address".

    This is not true. i.e. routers and NAT. Multiple Computers can have the same effective IP address to the internet. While they can track it down to the NAT device, they cant go further.

    2) They assume the network provider maintains a log of IP addresses. This is not a given. A Good guess perhaps, but not a fact.

    3) While its good practice that they download files and humanly verify the contents, the list of files can't be verified to be all infringing content. Unless they actually downloaded said file themselves, its an assumption that the file is named/labeled correctly. He says this later when he says that it only "suggests" that there were many copyright files. (Not being a lawyer, don't know the implication).

    4) They claim an ISP can identify the computer being used. This is inaccurate. They can identify the customer, but most customers are behind routers (aka NAT) so they have no ability to identify which computer.

    5) They claim expedited discovery is "critical" to stopping piracy. I can't believe they believe that expiding discovery will have any dent on piracy.

    6) They claim that infringment of non public works greatly harms it when released, I believe there's evidence to the contrary (i.e. widely distributed albums have debuted at number 1 or other times higher then anyone expected).

    7) unsure why expidited discovery impacts if they can serve defendants. If it happens quickly or over a long period of time, what difference does it make?

    8) They now claim ISPs destroy logs, but if discovery is going on, are they allowed to?
  • Spoofing? (Score:4, Interesting)

    by squarefish (561836) * on Tuesday July 03 2007, @12:12AM (#19726833)
    It is possible to spoof email, MAC, and IP addresses, but I don't know the likelihood of being able to spoof the IP while participating in file sharing with bit torrent or limewire.
    It is also very possible to spoof caller id.
    Are these good arguments?
    I think there are enough holes in their statements to bring it into question, but this stuff is very technical and may be difficult to explain in court, although the MPAA is trying to do the same, albeit poorly.
      • Re: (Score:3, Insightful)

        1. The RIAA may not ever find an IP address or MAC address on a SUBNET, because it may be classless.
        2. "I cant imagine that address spoofing to share copyrighted files is in any way something worth worrying about." That's like saying "I don't think getting b
  • Feedback (Score:5, Insightful)

    by wrook (134116) on Tuesday July 03 2007, @12:21AM (#19726879) Homepage
    Free advice from a non-lawyer. Not only that, but I only have time to scan the document quickly, however here are some points that I think might be relevant:

    1. The word "piracy" is repeatedly used. I don't believe this is a standard legal term (outside of naval encounters). The word is not defined in the document. I think the intent is to equate the term "piracy" with "copyright infringement", but to spin it imply other things. One could probably attack this term successfully.

    2. Point 8 is a logical fallacy. Whether or not record companies authorize P2P distribution of music is completely unrelated to the conclusion that P2P networks are used primarily for copyright infringement. One would first have to show that the vast majority of content falls under the record companies' copyrights.

    3. "Distribution" has a specific legal definition in copyright law (or it does in my country, anyway). P2P copying may or may not fall under that definition. This is extremely important. They are trying to imply that P2P copying is a more serious offense than copying in other ways.

    4. Points 9 an 10 bother me slightly, but I can't put my finger on why. They are implying that the P2P users are anonymous and thus can escape lawsuits from copyright holders. This is probably an important point in their case. I suspect they are trying to show that P2P users are intentionally hiding because they are doing something they know is wrong. This is why it is OK to remove that anonymity. It is important to stress that whatever the motives of the defendant, it is the plaintif's job to show that an infringement occurred *and* that the defendant was involved before an injunction is granted. The anonymity of the defendant is immaterial to that point.

    5. Point 11 states that Media Sentry can identify files being offered. It can not. It can only identify the *names* of the files being offered. The name of a file does not constitute anything more than circumstantial evidence that the file contains what they think it contains.

    6. As has been stated numerous times before Point 12 is just false. An IP address identifies a machine, not a user. Any number of users may access that machine. Other machines may route through that machine and masquerade as it. The owner of the machine may not even be aware that someone else is using it for this purpose.

    7. Point 13 doesn't make any sense at all. They indicate no mechanism for Media Sentry to identify copyrighted works. Or even if one assumes that all the works available through the P2P network are copyrighted, there is no mechanism for determining who the owner of that copyright is. The document seems to imply that all users of the P2P network can do this and since Media Sentry uses the same mechanisms, it can do it too. But users can not generally do this. They would have to provide some explanation for the mechanism they are using.

    8. Point 16 states that the IP address can identify where the infringement occurred. This is incorrect. It merely shows one step of the way. In order to identify where the infringement occurred, they would also have to show that the packets were not then transferred to a third party. This information is not actually stored anywhere on the computer, so it might be impossible in practice to say for sure where the infringement occurred.

    9. Point 17: How is Verizon's concession in any way relevant to a judges decision? Does Verizon get to make precedent?

    10. In point 18, they use the terms "distribute" and "make available". Again, these have very specific legal meanings. They have not described how the alleged actions of the defendants are equivalent to these legal terms. Even if they have documented copying, this is different than the above terms (at least in my country).

    11. Again point 18, they have stated that the Defendant made illegal copies available. They have no way of determining this. They merely suspect that the Defendant's computer was used to *relay* copies (or pa
      • Re: (Score:3, Insightful)

        Not hardly. Everybody knows what it means. It's held that meaning for hundreds of years. You're a smart person, and if a buddy tells you that they have a pirated version of a DVD, you'll know exactly what they mean. The courts are full of smart people, too.
        Yes, "piracy" has its meaning that has been there for hundreds of years and no, "making a copy of a CD" is NOT it. "To pirate" is to be part of organised para-military criminal unit that sails the seas and destroys all other ships in sight killing the cre
      • Re: (Score:3, Insightful)

        You seriously think that hundreds of years ago (say the 1800's) people said "Watch out for pirates!" and meant "People copying CDs"?!?

        That is the funniest thing I've ever heard.

  • by macraig (621737) on Tuesday July 03 2007, @01:18AM (#19727213) Homepage

    "... and additional data that track the movement of the files through the Internet."


    Note that, throughout his statements up to this point, Linares has repeatedly reasserted that MediaSentry doesn't use any techniques not enabled by the software and medium and not available to any other user of the system. It's obvious he wants to preserve for MediaSentry and, by extension the RIAA, that no "illegal" or unethical techniques were employed to gather data.

    Right here, with this sentence, he contradicts himself. I think it's rather obvious that this sentence describes an activity that other P2P users cannot do, even if they chose to try. The very ambiguity of it, and his failure to clarify it, is noteworthy.

    Dig deeper right there; "X" marks the spot, as Blackbeard might say.
  • by xenobyte (446878) on Tuesday July 03 2007, @04:13AM (#19728033)
    They download files suspected of violating their clients rights, but they have no idea whether the file really is what it claims to be, nor whether the copyright owner actually has licensed the work to be shared by P2P networks but only to be used for personal enjoyment, not for law enforcement purposes and similar. Remember, the copyright owner can make such limitations, which actually are tame compared to some of the limitations RIAA routinely puts on their 'property'.

    In my opinion just one file illegally downloaded by RIAA invalidates their entire legal process. In civilian law there are no loopholes that allow for breaking some laws in order to enforce others - and that's a very good thing.
  • Okie (Score:3, Interesting)

    by Sycraft-fu (314770) on Tuesday July 03 2007, @04:25AM (#19728081)
    Here are the things I'd point out as grossly wrong in the document.

    #6 claims that "similar online media distribution systems emerged and attempted to capitalize on the growing illegal market Napster fostered," followed by examples. This statement is provably incorrect in two ways. The first is that most, probably all, of these networks are not designed for media sharing, they are designed for file sharing. I only personally have knowledge of Bittorrent, eDonkey and DirectConnect but in all those cases the software is designed to share any and all files a user wishes, with no special exclusivity for media. Some, like the eDonkey variant eMule can restrict searches to various types of files (such as just video or music) but it does so only via the extension of the file. Others, like Bittorrent, have no such capability at all since search isn't an included part of the protocol. Bittorrent is just a distributed HTTP mechanism, searching is added through other means.

    The second is that they are designed and/or primarily utilized for illegal purposes. Bittorrent, being highly popular, is the best example. It was designed simply to allow peer-to-peer downloading of files from websites to take the load off of a single server. It is currently extremely widely used for legitimate purposes. One of the largest would be the patch mechanism for Blizzard Entertainment's (a subsidiary of Vivendi Games) MMORPG World of Warcraft. The official patch mechanism form Blizzard uses Bittorrent so as to lessen the load on Blizzard's own servers. Another high profile use would be Linux distribution, nearly every Linux distro's preferred method of distribution is Bittorrent.

    #9 claims that the RIAA members lose massive amounts of revenue to P2P copying. However there is no proof of this offered, and indeed I am aware of no proof out there. The only empirically valid, peer reviewed study I am aware of at this point is a 2005 study conducted by UNC Chapel Hill and Harvard (found here [unc.edu]) which found: "Using detailed records of transfers of digital music files, we find that file sharing has no statistically significant effect on purchases of the average album in our sample. In specifications that identify the effect of file sharing on sales relatively precisely, we reject the hypothesis that file sharing is responsible for the majority of lost sales." To the extent the RIAA has offered any figures at all it is based off of the assumption that every copy made is money lost, at full retail value. This is of course false because it fails to take in to account several factors:

    1) The music producers do not receive the full retail price for each album.
    2) Some people who made a copy of the music, never would have purchased it had it not been available for free. They simply were unwilling or unable to spend the money, and as such nothing has been lost.
    3) Some people may have bought some of the music they had downloaded, had they been unable to get it for free, but not all of it. For example a university student with a disposable income of less than $100 per month would clearly not purchase 100 albums costing in excess of $10 each, even if they downloaded that many. Thus while some sales may have been lost, not all of them have.
    4) Some people may have bought more as a result of their downloading. They download songs as a sort of "virtual window shopping" and when they find ones they like, they purchase the CD. Thus sales are actually gained.

    The RIAA's model for calculation could be mathematically stated as L = D * R where L is the amount of loss in dollars, D is the number of downloads presumed to have taken place and R is the average retail price. This is clearly overly simplistic and thus incorrect. A real formula would look more like L = D * P1 * W - D * P2 * W where L is the amount of loss in dollars, D is the number of downloads presumed to have taken place, P1 is the percentage of the time people did NOT bu

  • by Joce640k (829181) on Tuesday July 03 2007, @04:57AM (#19728235)
    IP addresses don't identify a person, only a junction point in the network (router).

    To use their telephone analogy: If you dial a "1-800" there isn't a single telephone and single person answering it, there's a whole network of telephones and many operators to answer them. The Internet works exactly the same way, if anything this "routing" of connections is even more common than in the telephone network.

    IP addresses are actually in short supply (there's only a few hundred million of them...) so most people don't even have the option of having single IP address = single computer.

    Then there's WiFi.... most home broadband connections are supplied with a wireless router and these routers are unsecured by default. Anybody within a half mile radius can connect and use the internet connection. These people will have the same IP address as the legitimate owner of the router. This practice of using other people's connections is very common in highly populated areas (I personally know two people who do it...)

    Even if password access is enabled, the standard "WEP" encryption can be broken in a matter of minutes using freely downloadable software (type "wep cracker" into google and you'll get you a whole list of them).

    So...premise 12 is wrong. Without it the rest of the document is moot.

      • If there are several WiFi access points available, Windows will pick one almost at random unless you tell it otherwise (which not everybody knows how to do...)

        This leads to people install WiFi in their house via "home installation kits" but they're really
  • Comments on the affidavit (Score:3, Interesting)

    by bbernard (930130) on Tuesday July 03 2007, @09:07AM (#19730065)
    In my opinion as a network and network security professional, the affidavit takes some liberties with the truth of IP networking. Most blatantly it ignores the technologies of NAT and PAT, and assumes that the IP address presented to the Internet belongs to a single computer, and that this computer is owned and operated by the person who the IP address was assigned to. To me, this is the crux of the whole argument: You simply can NOT determine the identity of a USER by the IP address shown to the Internet. You can only identify the owner/subscriber of the connection to the Internet. You MUST do further evidence gathering to complete the discovery process and identify a person.

    Here are my thoughts paragraph by paragraph. I hope they're helpful. If not, I hope they're at least not dry. FULL DISCLOSURE: I've never actually used any P2P network software, but then again when I was in college "gopher" was a cool utility.

    6. "At any given moment, millions of people illegally use online media distribution systems to upload or download copyrighted material." By who's count? Where did this number come from? How many millions of people are on the Internet? Is he saying that such a huge percentage of the users of the Internet are "at any given time" ALL illegally sharing files?

    8. "Thus, the vast majority of the content that is copied and distributed on P2P networks is unauthorized by the copyright owner" This statement is far too broad. Again, what evidence does he have? Is he further stating that the vast majority of the files on P2P networks are music files? Again, by what evidence?

    12. "Users of P2P networks...can be identified by using Internet Protocol ("IP") addresses because the unique IP address of the computer offering the files for distribution can be captured..." This is factually incorrect. While the IP address being presented to the Internet can be determined, this IP address may represent any number of distinct computers due to technologies such as Network Address Translation (NAT) and Port Address Translation (PAT). If the "unique IP address" of the actual computer can still be identified by the P2P client (which I can not speak to having never actually used P2P software) that addresses is not necessarily permanent either. The technology of Dynamic Host Control Protocol (DHCP) allows for the temporary assignment of IP addresses to computers. This means that the IP address of the computer in question may have changed between the time of the alleged distribution of copyrighted materials and the time of the investigation of that. Further still, and IP address is assigned to a computer, not to a person. This argument does not, in any way, indicate any correlation between IP address and person. It is more akin to identifying a driver based on a photograph of the license plate of the car. Yes, you may know who owns the car, but you don't know who was driving. For that matter, you don't know if somebody lifted the license plate and put it on a different car.

    12. "Two computes cannot effectively function if they are connected to the Internet with the same IP address at the same time." This does not account for methods of hijacking an IP address, nor does it account for the NAT or PAT technologies discussed earlier.

    12. "This is analogous to the telephone system where each location has a unique number." In so far as you can identify the "owner" of the telephone number, but you still haven't identified who placed the call.

    16. "Once provided with the IP address, plus the date and time of the infringing activity...can identify the computer from which the infringement occurred (and the name and address of the subscriber that controls that computer)." There is an assumption here that there is no NAT or PAT occurring on the network. More correctly, what can be identified is the subscriber to whom the IP has been assigned. That IP may represent a single computer or a network of computers. That network may include publicly accessible connections
  • I think we need to say more about NAT (Score:3, Informative)

    by maird (699535) on Tuesday July 03 2007, @01:36PM (#19733823) Homepage

    Late arrival, sorry. I agree with all of the comments about the existence of NAT demonstrating point 12 is not true but none closed the circle for me.

    It is a fact that IP addresses do not have to be unique across the entire Internet in order for IP routing to function. Translating routers permit this to be the case and, therefore, the declaration is factually incorrect in its attempt to characterize IP routing in point 12. But I think that you need to say more in order to truly debunk point 12. NAT is a border technology but at some point IP addresses do have to be unique for much of what people use the Internet for and that is why I think you need to say more than just that NAT means IP addresses don't have to be and frequently aren't unique.

    Consider a case where my node address is 192.168.1.1 (a RFC 1918 private IP address commonly used on a translated network). Assume I use a NAT router. Assume you also use a NAT router but we are not using the same NAT router. Let your IP address also be 192.168.1.1 then. This configuration will function to your and my satisfaction. But, in this scenario I cannot send IP packets to your computer, there is no IP route to it from my host. Yet, despite this undeniable fact, we can share files with each other using most P2P technologies. Therefore, uniqueness of IP addresses appears irrelevant to the functionality of P2P technologies making much of point 12, as written, irrelevant - in addition to just being wrong. Nevertheless, in order for MediaSentry to even have a list of IP addresses for the RIAA to ask the identity of then they must be observing P2P clients that ultimately have had packets reach the public, routable Internet. Therefore, you still need to say more about point 12 since it is end-user identity that is at issue.

    Point 12 is attempting to assert that an IP address is a suitable proxy for end-user identity. Plainly my true identity in the IP arena is 192.168.1.1, as is yours. So, 192.168.1.1 is ambiguous as an identity. There has to be a disambiguation that happens somewhere since we are successfully sharing files even though we have the same ultimate identity. Therefore, even though the existence of NAT demonstrates that much of point 12 simply isn't true and irrelevant, that isn't really the point. Can the IP addresses that you do see on the outside (i.e. the one MediaSentry must see) uniquely identify someone. The IP addresses observed by MediaSentry are undeniably unique IP addresses.

    Ironically, point 12 appears to address this by shooting itself in the foot with phone analogy: "in a particular home there may be three or four different telephones, but only one call can be placed at a time to or from that home". Absolutely true, but there may also be three or four people living in that home and knowledge that a call was placed from that number to another number, or vice-versa indicates nothing about which individual placed that call. Further, someone may be visiting and ask to use my phone. I may receive a call for a neighbour and go get them to take the call at my home. There may even be a burglar that makes a call while present in my home. IOW, the number itself is a point where multiplexing takes place and the target of the multiplexing is transparent/invisible to the network. NAT does the same thing for IP networks but can do an additional thing the phone can't. A NAT router can (metaphorically) take multiple calls at the same time (potentially more than sixty thousand) and each one has the same multiplexing potential as the phone example.

    The point where multiplexing takes place, the phone number, does not identify a user (it identifies a subscriber). The phone company cannot sell service to a specific user, only to a specific subscriber (for the family, visitors and burglar reasons above). The IP address as seen by MediaSentry does not identify a user, it identifies a subscriber (for the same reasons as for the phone). Therefore, point 12 actually uses the phone analogy to conclusively demonstrate th

    • Re: (Score:2, Funny)

      I think the RIAA is really bad. Do I get my mod points now?
    • I think I understand each word in that sentence individually, but as a sentence they make no sense.
    • Re: (Score:3, Funny)

      The person is NewYorkCountryLawyer. Therefore, I think he expects people who think the RIAA's tactics are horrible to give him technical arguements he may use.

      Now, given the prevaling sttitude on slashdot about the compensation accorded all intellectual

      • Re: (Score:3, Funny)

        by Anonymous Coward
        Seeing as we're not paying you, could you please not comment?
    • by Kokuyo (549451) on Tuesday July 03 2007, @01:51AM (#19727423)
      'This person' just happens to be one of those lawyers who's constantly trying to put the RIAA in its place and takes the time to keep us informed. He also takes the time to explain the relevant processes of law to us nerds.

      Don't you think it's a hilariously good idea to come to us when he doesn't understand 100% how P2P networks work? Aren't we exactly the ones who know best why RIAA's claims are stupid? So let's think this through: A lawyer who happens to understand law (gee, what a coincidence...) asks techies whether the technical interpretation of the 'bad guy' holds true or not.

      I don't see your problem. Would you rather he pull a Matlock on the judge and try to get the jury to shed a tear for the poor victim? That guy is doing a hell of a job.
      [ Parent ]
    • Re:Don't feed the lawyers (Score:5, Informative)

      by sconeu (64226) on Tuesday July 03 2007, @12:40AM (#19727011) Homepage Journal
      It wasn't Linares. It's Ray Beckerman, aka NewYorkCountryLawyer.

      Sheesh, if you won't RTFA, at least click the submitter's name before you go all conspiracy.
      [ Parent ]
      • Hey, I'll reply anyway. (Score:5, Informative)

        by khasim (1285) <brandioch.conner@gmail.com> on Monday July 02 2007, @11:25PM (#19726537)
        The biggest mistake is that they're trying to imply that an IP address is tied to a specific person at a specific point in time.

        It is not.

        It may be tied to a specific computer. Or a specific router / firewall. Or even a specific UNSECURED wireless access point.

        But it is NOT tied to a specific person.

        Their second biggest mistake is claiming (without any evidence) that each file being "pirated" represents a lost sale. So the courts need to work REALLY REALLY FAST to stop the money being lost.

        Their third biggest mistake is that the machine with the IP address, that is associated with the "piracy" is 100% under the conscious, knowing control of the person who is being charged. As opposed to your neighbor using your unprotected wireless access point to download files without your knowledge.

        Anyone have any others?
        [ Parent ]
        • Re:Hey, I'll reply anyway. (Score:5, Insightful)

          by banuk (148382) on Monday July 02 2007, @11:44PM (#19726665)
          As opposed to your neighbor using your unprotected wireless access point to download files without your knowledge.

          Why does it have to be unsecured wireless? We all know how insecure WEP is and isn't it plausible that someone hacked your WEP? The key thing I'm trying to say is that you have to prove guilt. How can they prove it was my computer it could have been a hacked WEP and the only way they'd have access to my router is for them to hack ME.
          [ Parent ]
        • Re: (Score:3, Insightful)

          Yes but you, as a client of some ISP, are responsible of what goes through your internet line. I'm not sure how far that responsibility goes, that's some judge to find out I think. It would be silly if I was doing something illegal using my internet line a

        • Re:Hey, I'll reply anyway. (Score:5, Insightful)

          by Wavicle (181176) on Tuesday July 03 2007, @12:14AM (#19726837)
          It may be tied to a specific computer. Or a specific router / firewall. Or even a specific UNSECURED wireless access point.

          Agreed.

          Furthermore Mr. Linares knows, or should have known this is true. It would have been completely negligent for him not to do so. Wireless routers for home users which allow a single IP address to service 20+ individual computers and ship unsecured by default can be purchased at any electronics dealer, including Walmart, for less than $70.

          Furthermore Mr. Linares knows, or should have known, that IP redirector (or "bounce") programs have been a staple of internet anonymity for at least two decades. These packet bouncers were commonly used to anonymise IRC connections and were often illegally installed on other computers without the computer operators knowledge. Therefore these computers which have been identified could have been hijacked using an internet tool that is at least 20 years old. Mr. Linares could not reasonably be ignorant of them.

          Mr. Linares must have known that his statements regarding the reliability of IP addresses were false and self-serving, and he intentionally misrepresented this to the court under penalty of perjury.

          I'm just sayin' that I think there should be a law against intentional misrepresentation to the court, and maybe some penalties as well.
          [ Parent ]
        • Re: (Score:3, Interesting)

          It may be tied to a specific computer. Or a specific router / firewall. Or even a specific UNSECURED wireless access point. But it is NOT tied to a specific person.

          This is a valid point. If they have not demonstrated that a particular IP address was assign
          • Re: (Score:3, Insightful)

            This is also irrelevant. For a subpoena its sufficient that it be assigned to a particular individual. There will be time later to argue whether or not the assigned user was in control of the equipment using that IP address, though this is certainly a wort
          • Re:Hey, I'll reply anyway. (Score:5, Insightful)

            by mrsteveman1 (1010381) on Tuesday July 03 2007, @12:41AM (#19727015)
            What you suggest is unreasonable and probably illegal. WEP is broken to a few minutes, and you can't demand users trash WEP only equipment.

            I'm all for authenticated wireless but it is nearly impossible to implement on a scale like this unless we use verisign certificates and a public auth server that is free. Most APs can't do it anyway at the moment, and neither can many consumer devices, most can't even do WPA. Linksys has a for-pay auth setup they provide but this is nowhere near being universally compatible.

            I would argue it is not the consumers problem anyway and most consumers barely understand how Wi-Fi works, much less an integrated 802.1x wireless authentication system using public servers. Not only will it fail to accomplish its goals, going after individual users does not help the situation in any way.
            [ Parent ]
              • Re: (Score:3, Insightful)

                "Consumers don't understand how it works" is a perfectly valid defence if you're trying to sue me for what a joyrider got up to in my car after stealing it, and my excuse is that I thought a basic lock would be enough.
    • Re: (Score:3, Insightful)

      To answer this question:

      Recently there was a bit of a buzz on campus after word got out that some of our grads just starting at the top law firms were breaking the previous earning caps, and making as much as 135K a year in their first year. After hiring
    • by shark72 (702619) on Tuesday July 03 2007, @12:47AM (#19727047)

      "How exactly does Bittorrent "Capitolize" on anything? Its free software. No Ads, No fees, ect. Is the RIAA objection to pirates DONATING to open scource projects?"

      This is the quote to which you refer:

      Notwithstanding the court's decision enjoining Napster, similar online media distribution systems emerged and attempted to capitalize on the growing illegal market that Napster fostered. These include KaZaA, eDonkey, iMesh, Ares, BitTorrent, DirectConnect, and Gnutella, among others.

      If you're confused, it may be because you're reading it too literally. When you see "BitTorrent" in the above, mentally replace it with "BitTorrent tracker sites" (ie: The Pirate Bay). Many of them are commercial endeavors making thousands upon thousands of dollars in profit each month (just because they provide a free service does not mean that they don't have a profit motive). Facilitating piracy is a big business, and business is good.

      HTH.

      [ Parent ]