TorrentSpy Must Preserve Data In RAM For MPAA

Transient writes "Reaffirming a magistrate's earlier decision, a federal judge has ordered TorrentSpy to begin keeping server logs as it defends itself against an MPAA lawsuit. In her opinion, Judge Florence-Marie Cooper interpreted federal discovery rules broadly. ' Judge Cooper took issue with TorrentSpy's argument that data in RAM is not "stored." She noted RAM's function as primary storage and that the storage of data in RAM — even if not permanently archived — makes it electronically stored information governed by federal discovery rules.' Given that TorrentSpy has limited access for users in the US, the ruling may be moot. But it does set a precedent for other, similar cases. 'Under this interpretation, any data stored in RAM could be subject to a subpoena, as at a basic level it is a "medium from which information can be obtained" just like a hard drive. '"

so hand them a stick of RAM

"Funny, the data was in there before I pulled it out of the server."

Re:so hand them a stick of RAM

When they install the software to read the full content of the RAM, the OS Requires a reboot before it can run for the first time.

Re:so hand them a stick of RAM

That sounds like a job for SELinux. Lock the system down so hard it doesn't allow root logins at all, and logins under the id that the servers are running under. Have all that become enabled, say, five minutes after boot, or that it starts enabled and must be disabled from the boot command line during boot.

Make sure the system responds with an error message that explains all this if you try to login as one of the protected accounts...that to login you have to reboot the server.

Re:so hand them a stick of RAM

Make sure the system responds with an error message that explains all this if you try to login as one of the protected accounts...that to login you have to reboot the server.

It might be easer to explain to the judge that sound is a moving pressure wave stored in air for a very short time from the time he says something to the time someone hears it. I need him to preserve the sound waves in his house from yesterday for permanent record. It may contain evidence of a copyright violation.

Re:so hand them a stick of RAM

strangely, the way I see the law, the judge is right on this. just because it is volatile, does not mean it is any less incriminating.

the problem here is(are) the law(s), not the judge's interpretation.

copyright is completely out of control, and *NO* reasonable discussion on any issue regarding rights for copyright holders has merit (IMHO) until the copyright terms are fixed - meaning, significantly reduced. I don't advocate copyright elimination - it is valid and useful thing to have - just that the tampering with the law by these big companies has given them exactly the opposite that they expected - they have people who don't take it seriously because it is so far skewed against the public interest.

On a long enough time scale, everything balances.

Re:so hand them a stick of RAM

That's assuming that the MPAA care about sifting that data - it's equally likely they just want to make the process of collecting the data so prohibitivley expensive that TorrentSpy can't continue, or to spread fear in their users that the noose is tightening. If they can achieve either of those aims they won't even need to use the data.

Re:Bah, move the servers offshore.

According to United Nations Convention on the Law of the Sea [wikipedia.org], passed in 1982, does not allow artificial islands to become sovereign nations. Sealand may have a valid claim to sovereignty before 1982, but any new attempts at creating a new nation will have to be based on a natural land mass.

Re:Bah, move the servers offshore.

Becasue someone just might be willing to provide the firepower to back it up?

That's just it, isn't it? Claiming of territory in space is governed by some UN treaty as I recall. But that doesn't matter. If I go and somehow colonize Mars right now, I'm vulnerable to anybody who might want to take it from me. The only solution is to arm Mars to defend it, at which point any aggressor can either fight and lose, or fight and lose far more than Mars is worth to them. Either case makes it illogical to try and capture Mars, and therefore they have to work with Mars, not just invade it.

This is precisely why the world politica is divided into two groups: Nuclear and non-nuclear powers. If a country is a nuclear power, the rules change, because that country can inflict substantial damage to you, more than the country itself is probably worth.

Re:Bah, move the servers offshore.

The real definition of sovereignty could very well be "has the ability to successfully defend from outside powers". Superman would be a sovereign individual, not bound to the laws of any country, because no country could enforce those laws upon him. Darfur is not sovereign because they cannot secure the land they claim as there own. So yes you are quite right that the world is divided into two groups, the sovereign countries and the countries who do as they are told. In that light, how could you blame Iran for wanting to have nukes?

Re:Bah, move the servers offshore.

You would drown. That's why so many of us live on land.

Soo....

...as the data that is put into RAM is read and erased, can they (Torrentspy) be charged with destruction of evidence?

Re:Soo....

I think the basic argument is that Torrentspy is saying they can't provide IP addresses because they don't log them, and the judge is saying if they are in RAM then discovery applies and they are required to log them since RAM is discoverable. Basically the judge is tellling them to log the IP addresses and that the argument that they are only stored in RAM is not a valid legal excuse.

Re:Soo....

The judge explicitly narrowed the ruling to apply only to a party to a litigation only for the pendency of the court action. Such a ruling is akin to the obligation parties to a litigation have to maintain relevant documents -- even suspending their document retention policies, if necessary. The entire rule of preservation is motivated by fair play.

If this turns out to be expensive, TorrentSpy can make the MPAA pay for it. I'm not going to guess how probable that would be, but the option is certainly there to have the MPAA pay a few bucks for worthless IP information.

Re:Soo....

How about if they have the contents of ram printed to paper every time the ram is refreshed.

The cost of paper may build up to something considerable after the first couple seconds...

Hippie FUD

Newsflash 2008, the Amazon is being deforested to keep up with the sudden increase in demand for paper.

Actually, no. Not at all. We get almost all of our paper from "tree farms" in the Pacific North West: Washington, Oregon, etc. The rest comes from Canada. As our need for paper increases, tree farmers plant more trees. Simple economics. There are more trees on the planet now than in the 1800s. Logging in the Amazon is very strictly controlled and licensed to have minimal impact on the environment. Of the ~100,000 sq km of forest lost between 2000 and 2005, only 3% was was from logging, more than half of which was illegal, and most of that 3%'s worth of lumber stayed in the country (so that's only ~1100 sq mi, ~600 sq mi of which was illegal, and most of it all stayed in the country).

The other 97% of deforestation is due to the locals and the Brazilian government. ~60% cattle ranches, ~30-33% agriculture (~30% subsistence, ~1-3% commercial), and ~3% urbanization. (I found a pretty good link here, which has a nice pie graph, which is where I'm pulling these numbers since I'm not at my home computer with all my bookmarks: http://www.mongabay.com/brazil.html [mongabay.com])

So anyway, stop blindly believing hippie FUD from the the 60s and do a few minutes' worth of research on Google. Shit, I just looked at the wikipedia article and even they have a pretty good section on Amazon deforestation. So yeah, go ahead and use all the paper you want, it's actually GOOD for the environment and has been for the better part of a century. (Oh, and totally unrelated, but if you're still believing the hippie FUD about nuclear power, you'll want to do research on that too. :p)

Re:Hippie FUD

I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant.
I will not make funny comments on /., lest someone takes it serious and writes a rant. ...

Re:Soo....

The court said 'No, a closer analogy is that you're transcribing them on self-destructing paper, and we can make you use regular paper and hand them over. We can't stop you from stopping to record them entirely, but as long as they're in memory, you have already actually recorded them in a legal sense. They are physically represented in property of yours.'.

They aren't considering that to record this information in durable form would make the system inoperable. If you had to tap into the memory bus to record every write operation to memory, you'd need to replace a huge striped RAID of drives every few minutes (I'm being generous) or slow the system down to practical unusability so that memory writes are no faster than a hard drive write, and still have to replace drives continuously.

Imagine the implications if it is determined that memories are stored by some measurable physicality in the brain. With such an advancement, under this precedent, memories become subpoena-able.

The government should fear this as the boilerplate "I do not recall" answers will then become impeachable testimony.

power failure

So can they convict me for destroying evidence because I turned off my computer?

Re:power failure

There is little doubt in my mind that that is the case. It does not matter what you did, but if it was intentional then it is a very serious crime to deny or destroy evidence.

If you "forgot" to pay your colocation bill and they turned off your servers, that might work. You could claim you couldn't pay the bill because of all the money you are spending on lawyers. :)

Evidence destruction ?

Does this mean that turning a computer off could be considered destruction of, or tampering with, evidence ?

Re:Evidence destruction ?

For data to exist in RAM, does it not also have to exist on the hard drive in some fashion also?

No. Data can come from any source, not just hard drives. The data going into this text box from my keyboard exists in RAM, but does not yet exist on a hard drive. If I submit it, it arrives in that server's RAM before it even touches the server's hard drive.

Re:Evidence destruction ?

#include <stdio.h>
int main() {
        char buf[255];
        puts("Enter something:");
        fgets(buf, sizeof(buf), stdin);
        return strlen(buf);
}

where on the disk did the contents of buf get stored (assuming we have no virtual memory)?

Re:Evidence destruction ?

where on the disk did the contents of buf get stored (assuming we have no virtual memory)?

It's impossible to say because your seven line program contains at least one bug. (I'm assuming that the presented program is C and not some imaginary language).

Firstly, although you've correctly specified that main() should return an "int" you are actually returning a value of "size_t" which may or may not be defined as "int", depending on the platform. Secondly, you haven't checked the return value of fgets(). On error, fgets() returns NULL. This isn't necessarily the same as the nul character so depending on the platform, strlen() may fail (possibly even catastrophically on certain machines, such as the DeathStation 5000).

You've used the strlen() function without including its proper header.

Lastly, although this isn't really an error but it does demonstrate your inexperience, you have enclosed "buf" in parenthesis in the sizeof expression. Remember, sizeof is an operator not a function. The only reason you would ever use parenthesis in conjunction with sizeof is if you were asking for the size of a datatype. For example "sizeof(int)" or "sizeof(*char)". Using parenthesis any other time would be equivalent to expressing a simple sum as "(1) + (2) == (3)". Not incorrect, but pointless.

A more correct program might be...

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
 
int main(void)
{
        char buf[255];
        int n
 
        n = puts("Enter something:");
        if ( EOF == n )
          exit(10);
 
        n = fgets(buf, sizeof buf, stdin);
        if ( NULL == n )
          exit(20);
 
        return (int) strlen(buf);
}

Remember, C isn't for amateurs. That's why high-level languages were invented. To demonstrate how difficult it is to effectively program in C, I've deliberately left a bug in of my own as well as a potentially confusing design issue. See if you can find them.

White Board

Does this mean they can subpoena the contents of the white board in conference nine at 7:23 AM on June the 13, 2005?

Why can't the court grasp the transient nature of the content of RAM?

-Peter

Re:White Board

But this white board erases itself when you turn off the lights.

Re:White Board

Does this mean they can subpoena the contents of the white board in conference nine at 7:23 AM on June the 13, 2005?

More like an order that the white board be placed under constant surveillance creating a continuous, timestamped, and legible video record from now on.

You CAN Preserve a White Board

Does this mean they can subpoena the contents of the white board in conference nine at 7:23 AM on June the 13, 2005?

YES, if the court gives you notice that you must preserve everything that is written on the whiteboards in all conference rooms, then they will expect you to have it preserved, and produce it when ordered.

Take a picture, log the contents, don't erase it - whatever you need to do to preserve the information. Saying "But I erased it!" isn't going to fly when you are subject to a prior order to NOT erase it.

Why can't the court grasp the transient nature of the content of RAM?

It sounds like the company was saying "But I really don't have it, it's just in RAM". That doesn't mean you don't have the information.

Note that this is a prospective discovery order - YOU WILL HAVE THE INFORMATION IN YOUR POSSESION, I REALIZE IT'S TRANSITORY AND YOU NORMALLY DON"T PRESERVE IT, BUT YOU CAN PRESERVE IT, AND I'M ORDERING YOU TO PRESERVE IT.

What's so hard about that?

Silly

Sort of like the uncertainty principle. In order to "store" RAM to a permanent medium, RAM will change to write itself to the medium. This reminds me of when I testified and tried to explain that from a programs perspective, VM looks just like RAM, just slower. I never managed to convince the prosecutor. Clearly the legal system hasn't a clue about tech.

Just a thought...

Doesn't Vista encrypt some of it's data in RAM (DRMd media etc)? If Apache was modified to set the memory used for logs to be DRMd, would this make the data inaccessible?

hehe

tail -f /dev/mem > memlogs.txt I say have fun with that one.

Wait, what?!

If RAM can be subject to subpoenas, and it's illegal to destroy information that may later be subpoenaed, which is my understanding is true thanks to Sarbanes-Oxley, that means that all computers used by all companies must keep a permanent record of the contents of computer RAM at any given time.

I guess it's time to buy stock in storage companies. I wonder if this also applies to cache RAM? There could be an infinite loop in there somewhere...

Need more disk space now?

So... you have to be able to log everything that is in ram as well now

so we need faster processors and bigger hard drives to handle the extra load.

A normal log may not be that big, but when you get to a few months full of RAM logs for a busy server... I think this precedent will get overturned when they find out just what they are asking for.

I want to to write down every single thought you have for the next 10 weeks...

Re:Need more disk space now?

I want to to write down every single thought you have for the next 10 weeks...

Boobies.

What about costs?

I am surprised that the costs issue was not addressed. Generally, and if I recall, that if there are costs on on electronic discovery, that cost can be shifted on to the requesting party.

For this the costs would be expensive.

There are two ways to archive this:
    1. By snapshotting the ram.
    2. By rewriting the server code.

By snapshotting the ram, it would require a program with root access to snap this and lots of data to be archive.

By rewriting the server code, it would take months to rewrite it properly and test it. Then they would to license the IP2location database to perform lookups on the IP address filter out US addresses. I suspect that this filtering would require one or two more computers to perform this.

Not surprising

'Under this interpretation, any data stored in RAM could be subject to a subpoena, as at a basic level it is a "medium from which information can be obtained" just like a hard drive. '"

Which makes sense. Imagine that I do all my shady accounting on some Post-Its, then turn their contents into a bunch of spreadsheets and a ledger that look legit. If my accounting documentation is subpoenaed and I don't produce those Post-Its, and the court finds out about their existence, I am in deep shit for destruction of evidence and/or failure to keep required records. I certainly wouldn't get far with a claim that the Post-Its were a "temporary storage medium" or something.

I believe the fact that TorrentSpy is being compelled to keep server logs by the MPAA is fucked up on a few levels. I just wanted to point out that the last part of the summary is not as profound or earth-shaking as it might seem.

Re:Not surprising

Except it is nothing like post its. It is more like you are using an etch a sketch to do your accounting and every new calculation, you shake it. Now you are required to write everything down.

Worse yet, what about a digital calculator.....you can't use one. You need to have one that prints out, etc.

Let's be clear

What the judge is saying is that just because you keep a file in RAM and not on on disk, you can't claim you aren't "storing" that data.

Um, isn't this some pretty heavy spin???

From TFA:

TorrentSpy fought the MPAA's request, arguing that privacy laws in the Netherlands--where the servers are physically located--prevented it from maintaining and disclosing the logs. The site also argued that the log data wasn't available, since it existed only in RAM, and as such, was never stored.

The magistrate judge didn't buy that argument, and in her opinion reaffirming the magistrate's order, neither did Judge Florence-Marie Cooper. Judge Cooper took issue with TorrentSpy's argument that data in RAM is not "stored." She noted RAM's function as primary storage and that the storage of data in RAM--even if not permanently archived--makes it electronically stored information governed by federal discovery rules.

TorrentSpy: "We could log that information, but we choose not to."

Judge: "Choose to do so from this point on."

RAM isn't exactly relevant. This isn't some kind of temporary storage situation. This is a deliberate decision on the part of the software author. Now if you want to claim rights are being trodden upon, be my guest. But claiming that all RAM is now state's evidence is a stretch.

Re:Um, isn't this some pretty heavy spin???

I agree that the intent may have been to force TorrentSpy to turn on logging. However, the judgment was written in a very broad fashion - broad to the point that nowhere is it mentioned to "just turn on the damn logging". Instead, it is a ruling that states that data in RAM is governed by federal discovery rules, and as a result, needs to be preserved.

While it is unlikely that always logging ALL data in RAM will become a federal requirement, it is quite possible that this will turn into one of those things that everybody has to violate in order to function. The result of this will be that someone, somewhere will be permanently fucked by a ruling based on this. Yes, the law might be changed after this, but only after someone's life has been permanently fucked with.

Remember the high-school senior who got a blowjob from a 15 year old? He's doing time, because a law designed to catch sex offenders was badly written. The law was changed in response to his conviction, but it was too late for him. He's still in jail, the football scholarship is now out of the question, and he will have a criminal record.

I'm paranoid because too many lawyers and politicians and people in general have abused bad laws for their own gain.

judges are not dumb

Folks, From TFA, we see the following, "[Torrentspy] argued that the log data wasn't available, since it existed only in RAM, and as such, was never stored". The judge, being nobodies dummy, accurately noted that this isn't an impediment to logging that data in the future and has ordered them to do so. Funny jokes about handing over DIMMs aside this is a totally reasonable concept. How many of you all think it's actually impossible to log a number that is in RAM? Are all you /. l33t programmers incapable of writing a variable out to a file?

This isn't about RAM, folks

Oh, I'm sure, many of you are going off on this whole RAM thing as if that was the point. What you are missing is that this ruling was meant not really believing that RAM is the key, but the fact of the matter that, for torrentspy transactions, they do not, for just the exact reason this lawsuit began, log connection information, even though that information does pass through the RAM of the system. They focused on RAM as it is, in this case, the only memory device that is realistically capturing any connection information. That connection information is what the prosecution wants. Ergo, this order is, for all intents and purposes, forcing torrentspy to adjust their software to capture the connection information. That's really all it is. The courts, I'm sure, are aware of the transitory nature of RAM, and, through this order, are only addressing that the memory in RAM be captured. The reason they bring this up is because torrentspy, all along, claimed they have no logs that capture connection information, so potential downtheroad supoena's of torrentspy users cannot occur, plsu an audit trail of abuses cannot be captured. This ruling basically says 'Nice try guys, but you now need to close up that loophole'. Seriously, you all go off on the nature of RAM and stupidity of non-technites, but you fail to grasp what this ruling is really about, enforced logging of details that should be captured but the fact that it isn't is 100% an attempt to cover up any illegal activity going on with their servers/services abd leaving no trail to trace. If this was read for what it really means 'Court orders torrentspy to modify software to capture all connection info', which would be more outside the realm of the court to order, it wouldn't even raise an eyebrow save for the tinfoil hat privacy types. But that is outside the mandate of the court, so they just said what they need and now it's up to Torrentspy to figure out how to do it.

I can see a different problem.

The ruling is that TorrentSpy must, in future, maintain records of IP information. How is that meant to help prove or disprove the case that the MPAA are trying to prosecute, which must, by definition, have already occurred? This is not discovery - but an imposition on the way the software is to be re-written. Or can the MPAA say that they think that TorrentSpy will commit an offence sometime in the future and they now want to have the means to prove it?

Summary sucks

The summary of this article sucks, most of the comments here are nothing more than ravings based on a bad summary.

The judge wants them to start logging IP addresses. But a judge can't just order anyone to do anything they feel like, there has to be some precedent or law saying they can. This judge said in legal terms, stuff in RAM is stored data. Then he applied rules based on law that covers stored data.

It's like if a company has a policy to burn documents every night, but the judge orders them not to burn documents until the end of the case. There's no expectation that burnt documents can magically be unburnt.

Just Suppose...

Just suppose it's encrypted data in RAM? Shall they be given the still encrypted contents?

How about giving them a complete memory dump of RAM, letting them sort out what the data is that interests them? Can the judge require them to preserve it in pretty formats?

This whole order is such an overreach by this judge, and the US Judicial system, that an immediate halt should be put to it this very instant.

And just suppose, btw for the sake of argument, that the country were TS is located prohibits export of personal data due to privacy laws? Then who wins?

This Just In

TorrentSpy has announced that to comply with the MPAA Puppet^W^W impartial judge orders, all of its servers' RAM cards will be replaced by WOM cards. WOM, or Write Only Memory, is the latest cutting edge technology designed to ease the learning curve of geek challenged courts and remain compliant with discovery demands. All digital access information to their website will be safely stored in the WOM cards, readily surrendered to the courts. TorrentSpy has also announced implementation of the Fair Use Circumvention Kit at a later date but has declined to provide further details, despite curious snickering under their breaths.

RAM log

Your honor, a tiny portion RAM log of the time in question

2007.08.28 15:40 set bit 1243434
2007.08.28 15:40 set bit 1243435
2007.08.28 15:40 cleared bit 1243436
2007.08.28 15:40 set bit 1243437 ...

Obviously guilty!

Rank this Judge

Do you want to rank this judge's performance in a public manner? Visit The Robing Room [therobingroom.com] and let your thoughts be heard. Just be sure to get her name and state correct. Judge Florence-Marie Cooper, Federal Judge, California.

Who is responsible?

In the case of TorrentSpy, this question may be moot. But consider a case in which the provider of a service is not the same as the manufacturer of the application used to provide that service.

In spite of all of the ramblings to the contrary, it isn't technically difficult to add a logging feature to a piece of s/w to collect and store IP addresses, or other sorts of data currently only held in RAM. This assumes that the operators of the service can either modify that s/w themselves, or contract the vendor of said s/w to add this logging feature. In the case of proprietary s/w, with licensing provisions prohibiting reverse-engineering or modification, the latter may be the only recourse.

Now, lets suppose the operators of TorrentSpy contact the vendor, request that logging be added per the court's request and the vendor replies, "No".

Re:Put down the crack pipe and pick up a book

That's unfortunately part of the problem. I've dealt with plenty of "justice" people, from District Attorneys to Police Officers, that think they know what technology is all about. This judge is confident in her understanding of how computers work, and no justice-evading "thief" is going to outsmart HER. I'll bet the judge can't even program her VCR.

Re:Put down the crack pipe and pick up a book

Gotta explain in 5-year-old terms.

"Your honor, that's like asking someone to save ev