Slashdot Log In
Safeguards For RIAA Hard Drive Inspection
Posted by
kdawson
on Sat Apr 21, 2007 10:54 PM
from the under-watchful-eyes dept.
from the under-watchful-eyes dept.
NewYorkCountryLawyer writes "In SONY v. Arellanes, an RIAA case in Sherman, Texas, the Court entered a protective order (PDF) that spells out the following procedure for the RIAA's examination of the defendant's hard drive: (1) RIAA imaging specialist makes mirror image of hard drive; (2) mutually acceptable computer forensics expert makes make two verified bit images, and creates an MD5 or equivalent hash code; (3) one mirror image is held in escrow by the expert, the other given to defendant's lawyer for a 'privilege review'; (4) defendant's lawyer provides plaintiffs' lawyer with a 'privilege log' (list of privileged files); (5) after privilege questions are resolved, the escrowed image — with privileged files deleted — will be turned over to RIAA lawyers, to be held for 'lawyers' eyes only.' The order differs from the earlier order (PDF) entered in the case, in that it (a) permits the RIAA's own imaging person to make the initial mirror image and (b) spells out the details of the method for safeguarding privilege and privacy."
Related Stories
[+]
Judge Says RIAA Can't Have Hard Drive 233 comments
NewYorkCountryLawyer writes "A Texas judge has refused to allow the RIAA untrammelled access to the defendant's hard drive in SONY v. Arellanes. The court ruled that only a mutually agreeable, neutral computer forensics expert may examine the hard drive, at the RIAA's expense, and that the parties must agree on mutually acceptable provisions for confidentiality."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Initial image by agreed experts, not RIAA (Score:2, Informative)
Re: (Score:3, Interesting)
And I agree, it does actually sound pretty reasonable.
Regardless, anyone who gets a subpoena from the RIAA should be smart enough to
Re:Initial image by agreed experts, not RIAA (Score:5, Informative)
Re:Initial image by agreed experts, not RIAA (Score:5, Funny)
1) *.mp3
2) *.avi
3) *.mpg
RIAA is interested in (Score:3, Interesting)
1) kazaa.log
2) spyware.log
3) $sys$sonyrootkit.log
Re:Initial image by agreed experts, not RIAA (Score:5, Interesting)
Or if you're real paranoid, just get a laptop body + huge HDD + wireless and bury it in your wall and store your shit on that. Just manually mount the (encrypted) remote volume and supress NFS logging and there's zero evidence that you ever had any files.
Just remember to encrypt everything anyway. And use ext2fs to avoid a journal leaving any "suprises" behind.
And what about disk-copy utilities that duplicate a disk, timestamps and all, except you leave out certain important things (like ~/music/) from the copy? Actually, best to have some classical or nerdcore music, lest the absence of anything prove suspicious.
I guess what I'm saying is, there are many, many ways to foil the MAFIAA. You just have to implement them beforehand, and calmly cover every angle. Trying to do something *after* getting subpoenaed is a bad idea, because then you're hurrying. And as you say, one tiny mistake is all it takes, and people tend to make mistakes when they hurry.
Re: (Score:3)
Yeah, but its the lusers they go after, just like with child porn.
Re:Initial image by agreed experts, not RIAA (Score:5, Insightful)
A subpoena is supposed to not cause undue harm or burden. Since due process has not actually taken place (e.g. argue against it in court), the harm and burden is supposed to be limited. Preventing someone from using their computer is, IMHO, an undue harm and burden. This is the principle our laws came from (not that the laws actually implement it very well).
In the "old days" (when such principles were established), evidence was generally written on paper. An order to preserve evidence would mean not destroying those papers. That would not have been an undue burden in most cases. Someone doing more stuff with papers is generally going to be buying more paper, or at the very least doing more writing in the remaining blank spaces of paper.
The computer of today does not fit an analogy of paper. Perhaps the CDROM backups might. Using a computer typically does involve deleting old data and using the space for new data.
But there is an even more extreme situation here. Microsoft Windows is so vulnerable to exploits that several things can end up destroying evidence, or exacerbating the burden. Infectious programs may cause damage or filesystem corruption. Spamware and spyware may be so pervasive that the only option is to wipe the disk and re-install the OS. It has happened to several of my friends and family (in many cases I've been the one to diagnose the problem and carry out the cure which first involved booting Linux to run "dd" to be damned sure the drive was wiped clean, before booting the Windows install disk to start all over). I actually recommend to people that they re-install Windows every 3 months if there are no visible signs of infection (or immediately if there are).
Is it really the intent of the court to tell someone they must not clean out the infections in their computer, and must let the spamware keep popping up various ad windows, and must let their computer keep emailing spam to others on the internet? Will the court also extend that order to the ISP to prevent the user's account from being shut off due to all the spam coming through?
Courts do need to learn a whole lot more about technology. And they sure aren't going to get it in an ex-parte hearing, especially with RIAA lawyers.
IMHO, when a court has issued a subpoena that does cause harm and burden by preventing someone from using their computer, at least for more than a day or two, that court has overstepped its authority. Note that this is an opinion, not a description of how lawyers and judges have currently structured things (which is really wrong because of their lack of knowledge about technology). Fixing it, though, is going to be a tough issue for the future.
But do keep in mind that lost evidence can be very easily the result not of the user, but of things beyond the user's control, at least if they keep using their computer. Tell me what you would think if a subpoena ordered you to shut your computer off, and not run it or use it at all, for 30 days, until they can get a bit image of the drive made (whether you did anything suspect or not)?
Re:Initial image by agreed experts, not RIAA (Score:5, Interesting)
The inner volume can be hidden, and the creators believe that it is robust enough that it can not be identified if you don't know it is there.
http://www.truecrypt.org/ [truecrypt.org]
Re: (Score:3, Funny)
Works even better if you can get that clock in the bottom-right to blink "12:00"... the judge will just say "yeah, my VCR does that, too" and dismiss the case.
Re:Initial image by agreed experts, not RIAA (Score:4, Informative)
Verbatim, from the new court order:
1. Kimberly Arellanes ("Defendant") shall make her computer hard drive available for imaging by Plaintiffs on or before March 21, 2007 [emphasis mine]
Clearly the court order says that Sony gets to do the initial imaging.
Step 2 is, "an expert in computer forensics selected by the parties shall make two (2) verified bit-images". That's the second set of images. The initial image is done by Sony.
Re: (Score:3, Informative)
Re:Initial image by agreed experts, not RIAA (Score:4, Insightful)
How I read it, it's basically:
1) Plaintiff, don't worry, you'll get access to the drive by March 21
2-3) Defendent, don't worry, here's how we'll do it---first, you get to delete your private files
IANAL, but that's how I read it. The summary's a bit confusing, and seems to suggest that #1 in the document has to occur before #2, which really doesn't make sense, as the GP points out.
Re: (Score:3, Interesting)
Besides being more private, it's also damn
Re:Initial image by agreed experts, not RIAA (Score:4, Interesting)
TrueCrypt is pretty neat, but that brings up a question. If you encrypt your entire hard drive, what happens when your computer is taken as evidence? Can you be required to divulge the decryption key? IANAL, but I assume that you can be held in contempt of court (or something) by refusing to offer it up, leading to criminal charges, fines, and/or jail time. In any case, I doubt you can just give the RIAA the bird and say "Nah nah, can't touch this" because your stuff is encrypted.
Does anyone know the details about this? I doubt encryption helps you when it comes to legal matters, unless maybe you can plead the Fifth. After all, by giving up the decryption key you may be incriminating yourself
Anyone know?
Re: (Score:3, Informative)
A friend of mine got pulled in by the big guns out here in Australia a little while ago. It was kept very quiet (for which he was grateful) because they stormed into his house to find him sitt
Re: (Score:3, Funny)
Judge: "How do you plead?"
Defendant: "Ta-da-da-daaaaaa, ta-da-da-daaaaaa..."
(sorry, couldn't resist...)
Re: (Score:3, Informative)
Re: (Score:3, Funny)
--jeffk++
Some things I wonder about are.... (Score:5, Insightful)
1. Who pays for the neutral expert?
2. Who makes the deletion of the privileged files?
3. How are the privileged files going to be deleted?
How do you find an expert? (Score:2)
I'm sure if I suggest someone as a neutr
Re:Some things I wonder about are.... (Score:5, Insightful)
Are my computing habits putting me at risk if they should ask about my online activities? Should I be afraid? Should I be hiding stuff now?
I don't download music or movies, but how do I prove that without having to go through such huge measures as going to court? The existence of MP3 files on my hard drive does not mean I've been downloading. If I buy a used system that has music files on it, am I guilty?
My belief is that they don't have a right to look at it at all without hard evidence that I've been downloading illegally. The police are the only ones given the ability to search with probable cause only. Discovery for court purposes is one thing, do they search each defendant's home top to bottom to find any hidden hard drives? Do they 'interview' neighbors and friends to see if there is a missing hard drive they are just 'holding'?
To me, this whole hard drive evidence thing is illegal in itself. What if a virus infected my machine as was being used to pass illegally downloaded files? What happens if the defendant's lawyer declares all data on the disk to be private, other than the OS files?
Re:Some things I wonder about are.... (Score:5, Interesting)
do they search each defendant's home top to bottom to find any hidden hard drives?
I'd been thinking about this and had more or less decided it would be a good idea to by a wireless hard dive (like this: http://www.whatlaptop.co.uk/YRtBdcdoWel2Yg.html [whatlaptop.co.uk]). I might even really go wild and rip some of the plasterboard off a partition wall and wire it straight in to a ring main. Replace the plasterboard and repaint and you'd virtually have to pull the building apart to find it (unless you used RF direction finding) - and that's if you knew it was there. I can't imagine your average cop/lawyer realising.
But would it be a fire hazard?
Re:Some things I wonder about are....In One Case.. (Score:5, Informative)
Well, in one case they are demanding to image and search the hard drives and all MP3 players of the son of a defendant, who lives miles away, and claims to only have a desktop system at home that he uses for his job as a legal assistant (i.e. large amount of confidential files there). They're trying to do this because, having searched his mother's harddrive and found ABSOLUTELY NO EVIDENCE of illegal activity on it, and only assumed that they were given the wrong hard drive, and are now on the hunt for the correct one that they're sure exists.
In the RIAA's twisted logic, he has either taken his desktop (not notebook/laptop computer) to his mother's house miles away to do illegal filesharing on her Internet broadband account, and then taken it home again, or REMOVED HIS HARDDRIVE and transported it over and back to infringe on record company copyrights. This theory, they feel, allows them to now search his hard drive -- or, I would expect, anyone within 4 degrees of separation from the defendant -- and all music players as they wish. While I believe this was finally ruled unreasonable and unlikely to produce admissible evidence, they now are fighting their best to avoid paying his legal bills that he entailed explaining this bit of common sense to them.
So in answer to your question: Yes!
Re:Some things I wonder about are....In One Case.. (Score:5, Informative)
Details are absurd because Big Picture is. (Score:3, Insightful)
1. Who pays for the neutral expert? 2. Who makes the deletion of the privileged files? 3. How are the privileged files going to be deleted?
If media files are all the RIAA trolls are interested in, it would be easy enough to make a script to extract the
Digital Forensics - a tough issue (Score:5, Interesting)
Re: (Score:3, Informative)
Be aware that some file systems have counts of how often they've been mounted that increment even when you mount read-only, which is all it takes to m
Where's Mr. Tuttle when we need him? (Score:5, Insightful)
You just KNOW that the creepy bureaucratic gnomes who write up this stuff are going to have a hand in designing the "revised Internet" that's made the news lately.
Your computer has been used to violate article IV of the The Working Artists' Protection Act. Please unlock your front door, sit on the ground, place your hands behind your head and wait quietly. Attempts to flee, contact the press, or hire legal counsel is a violation of the P.A.T.R.I.O.T. III Act and may result in detention in an Overseas Protective Facility.
But "Metallica.mp3" is my financial records! (Score:4, Funny)
Use TrueCrypt! (Score:5, Informative)
Assuming you really do have something to hide, using an encrypted volume embedded within another encrypted volume could be very useful. TrueCrypt [truecrypt.org] supports nested encrypted file systems and since TrueCrypt uses no headers to demarcate its volumes, it is not possible to determine if an additional volume is embedded within a TrueCrypt volume. In effect, it provides plausible deniability of the existence of a 2nd embedded volume if you're forced by court order to decrypt the main volume. (stick some Creative Commons licensed mp3 files in the main volume though, just to throw the RIAA the middle finger a little more.)
Better yet, support non-RIAA artists at sites like Magnitune [magnitune.com]. The quality of music I've found there is proof positive that the RIAA no longer has a legitimate purpose in the music industry.
My tips for installing TrueCrypt [aggiegeeks.com] on Fedora Core 6.
Re: (Score:3, Informative)
Safeguards I use (Score:5, Interesting)
2.A good self destruct device (easy to built and arm) for the hard drive(renders it absolutely useless to any forensic expert,since it physically destroys the platters.)
3.I use an external drive to store the MP3 and other multimedia files on.Easily hidden,(like the old Varmit XL1000 CB Linear amps of decades past)
Anyone wanting to seize my machine will pay dearly for trying.I just don't give a damn anymore since I had the nervous breakdown last year.
That way,If the RIAA does get the machine,it will turn to scrap before they can get it 2 miles away.Paranoid? Sure,but with the corruption of the courts these days,these steps are needed.
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
I think not telling him would be excellent grounds for a reckless endangerment charge even if he's not injured. If he's killed you could potentially be charged with manslaughter or even murder. A really aggressive DA might even be able to argue first-d
I would have them remove... (Score:4, Interesting)
In the end they should receive any MP3 files that are on their list of infringing files, and Online Media Distribution System (P2P file sharing program, for the rest of us) files for the OMDS they've claimed they've identified (e.g. KaZaA) if present, AND NOTHING MORE!
As I understand it (IANAL), you are allowed to remove personal files that have no relationship to the case at hand. The RIAA can object if you try to protect files they say have a direct bearing on their case, however, they should find it an impossible task to justify why they need to see anything other than specified MP3 and/or OMDS files. Don't give them a byte more than they're entitled to.
And most importantly of all, perhaps, wipe all the unused file space. Let them try to prove why they deserve access to areas of the hard drive not included in any files.
how to deter the forensics crew (Score:3, Funny)
ln -s
ln -s
or maybe for more fun..
for file in `find
ln -s "$file" $HOME/$RANDOM.mp3
ln -s "$file" $HOME/$RANDOM.mpg
ln -s "$file" $HOME/$RANDOM.avi
done
Re: (Score:2, Insightful)
Re: (Score:2)
There is a recent article on the Toronto Sun website - it reminded me of the Slashdot as soon as I read it. Sam the Record Man still exists on Yonge Street, despite the implicat
Re: (Score:3, Informative)
Re: (Score:2)
Too bad I have no mod points.
Re: (Score:3, Insightful)
http://www.google.com/search?q=%22As+a+record+stor e+owner,+my+business+faces+ruin.+CD+sales+have+dro pped+through+the+floor.+People+aren't+buying+half+ as [google.com]
Dude, thats just sick... (Score:5, Funny)
You mean that people are actually ripping and sharing Christian rock??
Thats just *sick*.
Now with 3X MORE DRAMA!! (Must Read!!) (Score:3, Funny)
Re:I love this line... (Score:4, Interesting)
My vote: it's the troll. It's too stupid to do a parody of anything.
Re: (Score:2)
Re: (Score:2, Interesting)
And notice that it's an off-topic troll, to boot.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
oops wrong Re:Why a broken hash? (Score:5, Informative)
I'm wrong - in fact I get the feeling that it's now important that MD5 is NOT used. NIST (an authority when it comes to forensic investigations) do *not* recommend the use of MD5 checksums. The grandparent was perfectly correct. A decent summary (sorry PDF) is here [nist.gov]