Analysis of MediaSentry Wins Music-Download Suit

An anonymous reader writes "A Dartmouth professor's analysis of MediaSentry problems helped win a New Hampshire woman's RIAA music-download lawsuit. 'Since all of Plaintiffs' claims are based on the assumption that MediaSentry's software and computer configuration are trustworthy and free of errors, and this log clearly represents a failure of the MediaSentry software to perform the operation it claims to describe, the reliability and validity of the MediaSentry method should be questioned,' wrote professor Sergey Bratus in his report, dated May 30. 'In my opinion, these materials leave critical aspects of MediaSentry's evidence collection process undocumented. In my opinion, they express unwarranted assumptions regarding both software and network technologies involved, and attempt to create an illusion of evidence-supported certainty where it does not exist.'" The full report (PDF) is available online. It's worth noting that this victory was not the outcome of a court ruling; rather, a settlement was reached that did not require the defendant, Mavis Roy, to pay anything to the RIAA.

No computer, no crime!

[Geoffrey.landis]

Interesting, In this one, unlike the Misisippi case, apparently the person sued by the RIAA "said she didn't have a computer in the house at the time."

Whereas in the other case, the computer itself was not an issue.

Fighting fire with dynamite

[TitusC3v5]

Is there any chance that MediaSentry's practices are a violation of some provision within the DMCA?

One thing to remember

[techno-vampire]

This is an out-of-court settlement, not a ruling by a judge. It doesn't set a precedent to be used in later cases. I'd almost bet money that as soon as the RIAA's landsharks found out what the professor's report said, they fell all over themselves offering a settlement to make sure it never came up in court. That means that they can continue to use the same type of "evidence" in other cases and hope the defendant caves.

RoyMNH0977 post

[Windrip]

Re: traceroute logs:

It is apparent from the log that the operation has failed for the MediaSentry software, as the log shows neither the addresses nor names of the intermediary hosts nor realistic timings of packet round-trips between them and the MediaSentry computer. The fact that this standard operation has failed suggests flaws, or "bugs", in either the MediaSentry software, or in its system or network congurations, or both.

Karma for the post of this log. That should provide a few minutes of fun. I can only image what Dr. Bratus thought when he saw it.

Re:Of course a settlement was reached

[Brian Gordon]

Like someone staring down the barrel of a multi-million-dollar judgment cares..

Re:One thing to remember

[Xest]

It also means the word needs to be spread on this so that everyone can challenge the RIAA in the same way forcing them to either accept complete defeat or allow it to be tried in court and er, end up being forced into accepting defeat.

I've always wondered why this sort of defence hasn't been tested before. Effectively all MedaSentry are providing is a screenshot and/or text files showing that their IP was being used for downloading copyright material. Of course, generating such a screenshot in photoshop that is impossible to tell apart from an authentic screenshot is trivial, similarly any old joe can knock together a text file that suggests such and such an IP was downloading some data at a certain time.

Hell you don't even have to do that, you could create an offline network setup to mimic the IPs involved in the first place.

This is the problem I have with computer crime cases in general, and in fact, even computer forensics. Even if you confiscate a PC and do DNA analysis on the keyboard to see if person x is the guy who use this computer to commit crime y can you ever reall prove someone didn't just plug a different keyboard in the computer to commit the crime?

There's a need to catch criminals who use computers for sure, but I'm concerned in computer crime cases the level of evidence required is so rediculously weak, and so easily rigged or faked compared to normal crimes that if it continues I wouldn't be suprised if we end up with a plethora of wrongful convictions coming to light over the next few decades. Of course, companies like MediaSentry are only degrading the level of "evidence" that is apparently acceptable too - if we can't really, truly prove people guilty in many computer crime cases from forensic analysis when you have access to the physical machine what kind of joke is it if you're going on an IP address and nothing more?

I hope eventually as judges and politicians become more IT literate this trend reverses, if it doesn't then it's going to be a sad future for justice as the level of evidence becomes ever weaker yet the use of electronic devices and hence the amount of electronic crimes increases. We're going to end up with a lot of innocent people in jail.

Re:Finally!

[TheRaven64]

Depends on the ISP. Mine doesn't reassign IP addresses very often; I've had the same one for two years no. If they get an IP address and a timestamp synchronised to the nearest year then it's sufficiently valid.

Re:Legalese shenanigans always a mess

[sabt-pestnu]

IANAL. Let's say that first, shall we?

Assuming she didn't declare bankruptcy, the estate would be reduced by the amount of the debt. If the estate could not cover the debt, it would be declared insolvent. Here's one answer [answers.com] with respect to credit card debt.

Beyond that, the reasonable extension is "the estate declares bankrupcy". Not even moths-in-the-wallet. Unless there was some contract specifically including the inheritors (as in the case of credit card debt on a joint account), I believe the debt is not inheritable.