Judge Orders TorrentSpy to Turn Over RAM 726
virgil_disgr4ce writes "In an impressive example of the gap of understanding between legal officials and technology, U.S. Magistrate Judge Jacqueline Chooljian 'found that a computer server's RAM, or random-access memory, is a tangible document that can be stored and must be turned over in a lawsuit.' ZDNet, among others, reports on the ruling and its potential for invasion of privacy."
HD (Score:5, Informative)
-gb
link is broken (Score:5, Informative)
Re:What's the problem? (Score:5, Informative)
Torrentspy was contending that they had no record of user's IP addresses, since they don't do any IP logging. The Judge has ordered that since, even though there is no logging, the IPs are available in the RAM for a period of time, that constitutes a recording and they were ordered to capture that information from the RAM in a more permanent spot.
This is new because it's the first time that volatile RAM has even been considered as evidence in that manner.
Re:HD (Score:5, Informative)
It's basically some wild legal theory invented to provide a method of giving the MPAA the discovery information they want. The bright side is that the judge has decided that the individual IP addresses may be redacted to prevent TorrentSpy's users from being targeted.
Re:invasion of privacy (Score:5, Informative)
Re:What's the problem? (Score:5, Informative)
Re:Blank RAM (Score:5, Informative)
Don't count on it. In the UK, under the Regulation of Investigatory Powers Act, anyone can be required to turn over the password to decrypt any encrypted data they have that is needed for certain legal purposes... even if the "encrypted data" is just random bits, with no significance and not derived from any meaningful data. You are presumed guilty if you won't (or can't) supply the appropriate password.
If this case happened in the UK, the RIP Act would appear to make you guilty by default if you couldn't supply a password that "decrypted" whatever data was in the RAM when it was next powered up to turn it back into whatever they think was there before. And given that these are people who don't appreciate the volatile nature of RAM, I wouldn't hold out much hope of explaining to the judge why it's not possible to comply with their ruling.
Aren't you glad that our inept legislators and your incompetent judges work in different jurisdictions?
all well and good but.... (Score:4, Informative)
Re:link is broken (Score:4, Informative)
Re:What's next? (Score:3, Informative)
"Broadband modems should still be classed as modems, since they use complex waveforms to carry digital data. They are more advanced devices than traditional dial-up modems as they are capable of modulating/demodulating hundreds of channels simultaneously."
Re:invasion of privacy (Score:4, Informative)
Re:What's the problem? (Score:3, Informative)
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure
Completely doable.
I bet this poor page is in for one hell of a
Re:Blank RAM (Score:5, Informative)
Re:What's the problem? (Score:2, Informative)
Re:What's the problem? (Score:5, Informative)
Oh, and whoever moderated this informative, please never ever use mod points again.
[1] Main memory in all mainstream machines is DRAM.
Oh my. I think you are a fellow old-timer. (Score:5, Informative)
Nowadays, BosstonesOwn (794949), RAM is made out of capacitors and they have to be "refreshed", that is, some circuit re-reads/re-writes the same values all over many times per second. One second without refresh, and all the data is gone for ever and ever and ever.
BEFORE: a flip flop has an input, a clock, and an output. when you put 0 in the input and pulse the clock once, the output is now 0; if you put 1 in the input and pulse the clock, the output now has 1. This is how one bit of memory is stored. Also know as SRAM, this kind of memory is fairly large in terms of integrated circuits (like 20 transistors in-die), is reasonably fast, and it's still found in L0/1/2 caches of microprocessors, in quantities in the range of Megabytes.
NOW: you have a capacitor, if you put 1 in its input (that is the same pin as its output) it retains this one for a fixed period of time (T). if no-one tries to read this bit in, like, T/2, a circuit in the memory reads this bit, and if it's 1, writes again 1 in its input. Also known as DRAM, this kind of ram is smaller per-bit (one capacitor in-die, 40-60 times smaller than a bit of SRAM), but the memory itself has to add in the end the size of the refreshing circuit, it's slower (because read cycles must be synched in time with refresh cycles), and is found in the "RAM" socket of your motherboard, in quantities in the range from hundreds of Megabytes to Gigabytes.
So, DRAM _really_ clears, i.e., if unplugged when plugged again it's all beautifully zeroed.
Ok??
Perception (Score:3, Informative)
Ruling makes sense (Score:3, Informative)
(IANAL)
Re:What's the problem? (Score:3, Informative)
DRAM stores ones and zeros by storing charges on a tiny capacitor. If enough charge is stored, it reads back as a one; if too little charge is stored, it reads back as a zero. Ones are changed to zeros by draining the charge (attaching the capacitor plate to ground). Zeros are changed to ones by storing more charge (attaching the capacitor plate to Vcc). Due to technological limitations in the fabrication of the capacitors, the stored charge on them will dissipate over time - on the order of microseconds. Milliseconds after you remove power (or stop refreshing them), memory will start to become corrupted. Seconds after you remove power, all data will be gone. Within minutes of removing power, not even the most sophisticated probing of the part would be able to tell a one from a zero.
And I have no idea whatsoever where you got that idiotic 01->10->11->00 progression concept. Please wipe that from your mind.
Re:What's the problem? (Score:2, Informative)
the D in DRAM (Score:3, Informative)
Re:What's next? (Score:4, Informative)
Re:What's the problem? (Score:1, Informative)
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure
It's not always true. And depends on the ram.
To bad moderators here don't actually follow links instead just mod down when enough people try to prove it wrong.
Re:What's the problem? (Score:2, Informative)
A document stored in RAM is not a tangible document.
A document stored in RAM is a volatile document.
Yes! It volatilizes!
If i power off the PC then
Re:What's next? (Score:4, Informative)
"Since they carry digital data over a digital medium, I would disagree. They aren't "modulating" anything."
The 'cable' is coax, which is an analog medium, not digital. The 'cable modem' modulates (QPSK/QAM, etc) the bits into an analog signal that then again is modulated into a fixed channel (usually 5MHz wide) and puts it onto the coax...
There really is a lot of 'modem' (MOdulator DEModulator) activity going in in a cable modem...
Re:What's next? (Score:4, Informative)
Nope...Altering the pitch? Only FM does purely that (frequency modulation), and even telephone modems have used more advanced method than that for any speed over 1200 bps...
PSK = Phase shift keying: modulates the phase
AM = Amplitude modulation (...)
QAM (as used in both your telephone modem and also in cable modems) = Quadrature _AMPLITUDE_ modulation... modulates the IQ (amplitude and phase together)...
http://en.wikipedia.org/wiki/Modulation [wikipedia.org]
"In telecommunications, modulation is the process of varying a periodic waveform, i.e. a tone, in order to use that signal to convey a message, in a similar fashion as a musician may modulate the tone from a musical instrument by varying its volume, timing and pitch."
Re:What's the problem? (Score:2, Informative)
7. Methods of Recovery for Data stored in Random-Access Memory
Contrary to conventional wisdom, "volatile" semiconductor memory does not entirely lose its contents when power is removed. Both static (SRAM) and dynamic (DRAM) memory retains some information on the data stored in it while power was still applied. SRAM is particularly susceptible to this problem, as storing the same data in it over a long period of time has the effect of altering the preferred power-up state to the state which was stored when power was removed. Older SRAM chips could often "remember" the previously held state for several days. In fact, it is possible to manufacture SRAM's which always have a certain state on power-up, but which can be overwritten later on - a kind of "writeable ROM".
DRAM can also "remember" the last stored state, but in a slightly different way. It isn't so much that the charge (in the sense of a voltage appearing across a capacitance) is retained by the RAM cells, but that the thin oxide which forms the storage capacitor dielectric is highly stressed by the applied field, or is not stressed by the field, so that the properties of the oxide change slightly depending on the state of the data. One thing that can cause a threshold shift in the RAM cells is ionic contamination of the cell(s) of interest, although such contamination is rarer now than it used to be because of robotic handling of the materials and because the purity of the chemicals used is greatly improved. However, even a perfect oxide is subject to having its properties changed by an applied field. When it comes to contaminants, sodium is the most common offender - it is found virtually everywhere, and is a fairly small (and therefore mobile) atom with a positive charge. In the presence of an electric field, it migrates towards the negative pole with a velocity which depends on temperature, the concentration of the sodium, the oxide quality, and the other impurities in the oxide such as dopants from the processing. If the electric field is zero and given enough time, this stress tends to dissipate eventually.
The stress on the cell is a cumulative effect, much like charging an RC circuit. If the data is applied for only a few milliseconds then there is very little "learning" of the cell, but if it is applied for hours then the cell will acquire a strong (relatively speaking) change in its threshold. The effects of the stress on the RAM cells can be measured using the built-in self test capabilities of the cells, which provide the ability to impress a weak voltage on a storage cell in order to measure its margin. Cells will show different margins depending on how much oxide stress has been present. Many DRAM's have undocumented test modes which allow some normal I/O pin to become the power supply for the RAM core when the special mode is active. These test modes are typically activated by running the RAM in a nonstandard configuration, so that a certain set of states which would not occur in a normally-functioning system has to be traversed to activate the mode. Manufacturers won't admit to such capabilities in their products because they don't want their customers using them and potentially rejecting devices which comply with their spec sheets, but have little margin beyond that.
A simple but somewhat destructive method to speed up the annihilation of stored bits in semiconductor memory is to heat it. Both DRAM's and SRAM's will lose their contents a lot more quickly at Tjunction = 140C than they will at room temperature. Several hours at this temperature with no power applied will clear their contents sufficiently to make recovery difficult. Conversely, to extend the life of stored bits with the power removed, the temperature should be dropped below -60C. Such cooling should lead to weeks, instead of hours or days, of data retention.
Re:What's the problem? (Score:3, Informative)
Re:Over Simplified Headline... (Score:4, Informative)
She moved to the U.S. at 16, started dating her producer's son at 17. She then proudly went around telling everyone how great the sex was - afterall, it's legal in England from 16. In California where the californicating was happening, the age of consent is 18. Everyone sat around wondering how long it was before he got arrested as a child molester because of her pride in her relationship.
Places where oral sex is illegal: Alabama, Arizona, Florida, Idaho, Kansas, Louisiana, Massachusetts, Minnesota, Mississippi, Georgia, North and South Carolina, Oklahoma, Oregon, Rhode Island, Utah, Virginia and Washington D.C.
In Georgia those charged and convicted for either oral or anal sex can be sentenced to no less than one year and no more than 20 years imprisonment.
In Nevada it is illegal to have sex without a condom.
In Willowdale, Oregon it is against the law for a husband to talk to dirty in his wife's ear during sex.
In Washington State there is a law against having sex with a virgin under any circumstances (including the wedding night!).
In Fairbanks, Alaska it is illegal for mooses to have sex on the city sidewalks.
http://www.journalism.sfsu.edu/flux/gSpot/sexLaw.
Not a new document (Score:3, Informative)
Sounds reasonable to me, even if technically impractical (you can't realistically store every change to memory).
Re:What's the problem? (Score:4, Informative)
From the first line of TFA:
In a decision reported late Friday by CNET News.com, a federal judge in Los Angeles found (PDF) that a computer server's RAM, or random-access memory, is a tangible document that can be stored and must be turned over in a lawsuit.
Note the "can be stored" bit.
If you'd read the PDF of the court order you'd have noted the judge understands quite well that the RAM is volotile and that he was asking the relevant parts be stored. Specifically, he wants the ip addresses stored.
The story headline should have read "judge orders torrentspy to store IP addresses".
RTFD (Score:5, Informative)
And you have been misinformed if you RTFA.
The judge's decisions responds to most of the comments posted here, and the lawyers comments naively repeated by the author of the article.
Instead, read the decision (RTFD) that the article links to.
Although she mistakenly says websites have RAM, she definitely knows what RAM is, if you read her analysis about why the RAM should be turned over. She doesn't want the chip, she wants the ip address that temporarily pass through the website server's RAM.
Based on existing case law from other copyright cases, whatever passes through a computer's RAM is a tangible copy, if only a temporarily one. According to the rules of discovery, the defendant must produce this copy because it is within their control. It is within their control due to the fact their provider uses the a web server (Microsoft's), and this server has the capability of logging ip address that temporarily pass through the computers RAM.
So "turning over the RAM" actually means "hand over the documents that are temporarily stored in the RAM by simply turning on the logging function of the webserver." The judge is simply following existing case law and discovery procedures.
Re:What's the problem? (Score:5, Informative)
Err....no. (Score:5, Informative)
Sure, forgetting about the whole row and column stuff, and the sense amps...
However, due to the natural resistance of silicon there is always some leakage current leaving the capacitors.
Incorrect. Capacitors lose charge because dielectrics are not perfect insulators, and thus some current actually leaks through from one plate to the other.
This means that RAM left alone for more than a few tenths of a milisecond will lose enough voltage to drop to a logical 0
Disturbingly wrong. Most manufacturers specify that a row of DRAM must be refreshed at least every 64 milliseconds. In fact, Wikipedia cites a pdf saying that some information can be retained for up to minutes in a cell of DRAM - though you will get some bit errors.
TO prevent this, RAM is constantly refreshed- the ram chip will spend spare cycles writing its own value to itself.
Actually, the memory controller will issue a refresh command to the DRAM chip. This is probably what you were thinking about before...a row refresh must happen every 7.8 microseconds or so (depending on the RAM chip). But, that's because the refresh operation only refreshes a single row. The DRAM chip usually has an internal address counter, so you just say "refresh the next row" and the DRAM chip already knows what the "next row" is, and afterwards it increments it so the next time you issue the refresh command, it refreshes the next row. If you execute these refresh operations every 7.8 microseconds, then in 64 milliseconds you will refresh every row of memory on the DRAM chip.
Oh, and by the way, reading from any cell of DRAM will refresh the entire row that cell is on, because reading from DRAM is a destructive operation. Therefore, there's actually a row of latches at the bottom of the columns, and the values from those latches are placed back into the capacitors while the bit of interest is being shuffled out onto memory bus.
Writing to a cell also requires reading the entire row, which means that writing also refreshes that row.
Re:What's the problem? (Score:3, Informative)
http://72.14.253.104/search?q=cache:PxTwoO6oZzMJ:
Note that this paper is from 1996, is from a symposium, and deals mainly with magnetic media. There are absolutely no citations in the part that talks about solid-state memory (lots of cites in the magnetic part though), so I am skeptical. If it could be done, he could have easily presented proof.
And now it's been ten years, with device area getting cut in half just about every two years. In modern DRAM, the charge storage is so minute that any accumulated oxide stress effects would be lost in the noise.
(While I'm at it, 00 -> 01 -> 10 -> 11, WTF?)
Agreed - mostly (Score:3, Informative)
DRAM, however, consumes "large currents" every time it charges a row of capacitors. However, the large current is very brief (on the order of several ns) but happens frequently and periodically (on the order of several us).
DRAM is smaller, simpler and power hungry BECAUSE of all the refresh's required.
Er, it's power hungry because of the refreshes, but it's smaller because it's 1 capacitor and 1 transistor, as opposed to several transistors.
As far as simpler....I wouldn't go that far. SRAM is WAY simpler to interface to than DRAM, because the SRAM doesn't need an intelligent memory controller which understands how to burst large amounts of data, and how to handle the latency for the first access. Oh, yeah, and don't forget that the memory controller needs to send refresh commands periodically to the DRAM...
Re:the D in DRAM (Score:2, Informative)
First of all, nowadays dynamic RAM doesn't even have a real capacitor for each bit, but it uses wires as (real small but cheap) capacitors. The capacitors are so small that when the RAM reads a bit it is destroyed, each time something is read, it has to be rewritten too. The reading circuit ensures this.
Because of leakage, they have to be refreshed thousands of times a second, or charge (and information) would be lost.
Add to all that the fact that a forensic method that tries to read very small charges on the storage nodes once the RAM is powered down, would require that the chip is open, some metalization is taken off and some really clever way to read terribly small charges is implemented _off-chip_. The wires you need to contact are something like 200nm away from each other.
I think it's not possible.
Re:What's the problem? (Score:4, Informative)
Because the guy is making up bullshit. It is obvious to anyone who knows anything about electronics or computers. DRAM is made up of capacitors which do store charge, but it leaks away in a matter of seconds or minutes based on the quality and size of capacitor. SRAM is made up of transisters and loses all its state as soon as power is lost.Neither one of these would retain any data whatsoever without power after even a small amount of time, say 15 minutes.
There is flash memory, but no one will use it as RAM because it goes bad after only a few thousand state changes--would probably only last a few seconds on a modern computer. There are also magnetic forms of memory used in chips, but from what I understand it is still experimental and bulky, though it was used in some ancient computers (before the days of microchips).
Re:What's the problem? (Score:5, Informative)
Reminds me of an old DOS product (Score:4, Informative)
Cool little product.
Re:What's the problem? (Score:3, Informative)
Following the order requires the separation of the RAM from the computer which destroys the data.
anyways, as far as logging, that's also very difficult to do. Lets say that 25% of the operations of a given computer are to manipulating memory and that the clock of this hypothetical computer is 1 billion cycles per second. So that means 250 million bytes per second, which in turn is already beyond the performance ability of hard drive storage devices. That's 21.6 trillion bytes per day. Plus how long do you have to retain the data?
This doesn't include things that happen in various buffers and caches (L1/L2, etc.) nor the fact that the mere act of writing to the hard drive changes information in memory. (and yes, 1GHz is pretty low and a single core, etc.)
I could have sworn there was a law that requires judicial orders to be grounded in the realm of reality.
But then again.....
is the ruling about physical RAM at all? (Score:5, Informative)
The whole argument is there in the first place because TorrentSpy seem to allege they don't have logs because the logs are not on disk, but in RAM, which is transient and not an electronic medium.
So, to my IANAL eyes the ruling says "if you are in the US, and you have been issued a court order to store all your electronic communications, you better do so and don't come up with excuses which are lame technically."
I respectfully decline to comment on whether this ruling is good, bad or ugly.
If you only gonna read ONE comment, read this o (Score:4, Informative)
A: No, f****** moron. The judge simply says that information that exists in RAM can be retrieved.
Q: What's this all about?
A: It goes down like this:
1. TorrentSpy has been slapped with an order to log traffic
2. TorrentSpy claims that since their servers have no hard drive (only RAM) there "are no logs"
3. Judge calls bullshit. The logs exist and can be transferred to other media. TorrentSpy must do this cause they are legally obligated to do so.
As usual, the article summary misrepresents the story. TorrentSpy claims that it can't turn over certain data because it was never logged. The judge ruled that since the data in question existed in the RAM, TorrentSpy was in possession of said data and must preserve it for discovery, i.e. start logging it. The judge in no way ruled that they must physically turn over the RAM chips.
Q: But a defendant cannot be compelled to create new documents for the plaintiff, even if the new document would just be a compilation and/or summary of other documents.
A: That's just it: the information allready exist. It just need to be stored "permanently" (read: for years instead of miliseconds).
Q: Wouldn't this mean that TorrentSpy has to change the HW configuration of their servers?
A: Yes, It basically means that using RAM-based servers without permanently logging traffic is not the legal loophole once believed.
This is not the first time that a company/organization has been ordered to change the way their system works. In the SonicBlue/ReplayTV case [2002] the court ordered ReplayTV to create the technology to record information about subscribers for purposes of determining how much of ReplayTV usage was violating and the law.
Q: Is there no way out of this? Will the MAFIAA have their way?
A: The judge doesn't say that the logs have to be stored electronically... Nor that they have to be stored chronologically or otherwise in a logical, searchable manner.
Re:What's the problem? (Score:2, Informative)