Safeguards For RIAA Hard Drive Inspection 276
NewYorkCountryLawyer writes "In SONY v. Arellanes, an RIAA case in Sherman, Texas, the Court entered a protective order (PDF) that spells out the following procedure for the RIAA's examination of the defendant's hard drive: (1) RIAA imaging specialist makes mirror image of hard drive; (2) mutually acceptable computer forensics expert makes make two verified bit images, and creates an MD5 or equivalent hash code; (3) one mirror image is held in escrow by the expert, the other given to defendant's lawyer for a 'privilege review'; (4) defendant's lawyer provides plaintiffs' lawyer with a 'privilege log' (list of privileged files); (5) after privilege questions are resolved, the escrowed image — with privileged files deleted — will be turned over to RIAA lawyers, to be held for 'lawyers' eyes only.' The order differs from the earlier order (PDF) entered in the case, in that it (a) permits the RIAA's own imaging person to make the initial mirror image and (b) spells out the details of the method for safeguarding privilege and privacy."
Initial image by agreed experts, not RIAA (Score:2, Informative)
it (a) permits the RIAA's own imaging person to make the initial mirror image
IANAL, but having RTFA, I'd say that statement's a bit misleading. It actually states that an expert agreed upon by both parties will make two copies, make an MD5 hash of the copies, then the defendant has the opportunity to justify that some files are private and nothing to do with the case, and once that's settled:
Plaintiffs shall have access to the Escrowed Image of the hard drive, minus the files as to which privilege has been asserted
Seems pretty reasonable to me. Wouldn't make a lot of sense if they gave them access to the drive minus these files, if they had already initially had access to the whole thing.
Re: (Score:3, Interesting)
And I agree, it does actually sound pretty reasonable.
Regardless, anyone who gets a subpoena from the RIAA should be smart enough to swap out hard drives and install a new OS before the case even gets that far anyway. Assuming they have something to hide. Seems pointless really.
Re:Initial image by agreed experts, not RIAA (Score:5, Informative)
Re:Initial image by agreed experts, not RIAA (Score:5, Funny)
1) *.mp3
2) *.avi
3) *.mpg
RIAA is interested in (Score:3, Interesting)
1) kazaa.log
2) spyware.log
3) $sys$sonyrootkit.log
Re: (Score:2)
Re:Initial image by agreed experts, not RIAA (Score:5, Interesting)
Or if you're real paranoid, just get a laptop body + huge HDD + wireless and bury it in your wall and store your shit on that. Just manually mount the (encrypted) remote volume and supress NFS logging and there's zero evidence that you ever had any files.
Just remember to encrypt everything anyway. And use ext2fs to avoid a journal leaving any "suprises" behind.
And what about disk-copy utilities that duplicate a disk, timestamps and all, except you leave out certain important things (like ~/music/) from the copy? Actually, best to have some classical or nerdcore music, lest the absence of anything prove suspicious.
I guess what I'm saying is, there are many, many ways to foil the MAFIAA. You just have to implement them beforehand, and calmly cover every angle. Trying to do something *after* getting subpoenaed is a bad idea, because then you're hurrying. And as you say, one tiny mistake is all it takes, and people tend to make mistakes when they hurry.
Re: (Score:3)
Yeah, but its the lusers they go after, just like with child porn.
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
you should see what a felony conviction does for your life...
I doubt any of these would be felonies, only misdemeanors.
Not that it couldn't get you in trouble, mind you, but it's probably not as much trouble as a felony could cause.
I guess if you were the sort of person that expected to be sued by the RIAA for this sort of thing, you'd keep your mp3s and P2P working directory on an encrypted drive, one that looks like unused space on the drive so you can't prove there is an encrypted drive, though I doubt that would be very convincing. And in a civil case,
Re:Initial image by agreed experts, not RIAA (Score:5, Interesting)
The inner volume can be hidden, and the creators believe that it is robust enough that it can not be identified if you don't know it is there.
http://www.truecrypt.org/ [truecrypt.org]
Re: (Score:2)
Re: (Score:2)
And if you toss your "crashed" hard drive once a case is underway, you can expect the judge to treat it as destruction of evidence. Treating law enforcement and the judiciary as if they're stupid is never a good legal strategy.
Re: (Score:2)
Re: (Score:2)
Use an external disk for your warez then hide it (Score:2)
Re:Initial image by agreed experts, not RIAA (Score:5, Insightful)
A subpoena is supposed to not cause undue harm or burden. Since due process has not actually taken place (e.g. argue against it in court), the harm and burden is supposed to be limited. Preventing someone from using their computer is, IMHO, an undue harm and burden. This is the principle our laws came from (not that the laws actually implement it very well).
In the "old days" (when such principles were established), evidence was generally written on paper. An order to preserve evidence would mean not destroying those papers. That would not have been an undue burden in most cases. Someone doing more stuff with papers is generally going to be buying more paper, or at the very least doing more writing in the remaining blank spaces of paper.
The computer of today does not fit an analogy of paper. Perhaps the CDROM backups might. Using a computer typically does involve deleting old data and using the space for new data.
But there is an even more extreme situation here. Microsoft Windows is so vulnerable to exploits that several things can end up destroying evidence, or exacerbating the burden. Infectious programs may cause damage or filesystem corruption. Spamware and spyware may be so pervasive that the only option is to wipe the disk and re-install the OS. It has happened to several of my friends and family (in many cases I've been the one to diagnose the problem and carry out the cure which first involved booting Linux to run "dd" to be damned sure the drive was wiped clean, before booting the Windows install disk to start all over). I actually recommend to people that they re-install Windows every 3 months if there are no visible signs of infection (or immediately if there are).
Is it really the intent of the court to tell someone they must not clean out the infections in their computer, and must let the spamware keep popping up various ad windows, and must let their computer keep emailing spam to others on the internet? Will the court also extend that order to the ISP to prevent the user's account from being shut off due to all the spam coming through?
Courts do need to learn a whole lot more about technology. And they sure aren't going to get it in an ex-parte hearing, especially with RIAA lawyers.
IMHO, when a court has issued a subpoena that does cause harm and burden by preventing someone from using their computer, at least for more than a day or two, that court has overstepped its authority. Note that this is an opinion, not a description of how lawyers and judges have currently structured things (which is really wrong because of their lack of knowledge about technology). Fixing it, though, is going to be a tough issue for the future.
But do keep in mind that lost evidence can be very easily the result not of the user, but of things beyond the user's control, at least if they keep using their computer. Tell me what you would think if a subpoena ordered you to shut your computer off, and not run it or use it at all, for 30 days, until they can get a bit image of the drive made (whether you did anything suspect or not)?
Re: (Score:2)
Re: (Score:3, Funny)
Works even better if you can get that clock in the bottom-right to blink "12:00"... the judge will just say "yeah, my VCR does that, too" and dismiss the case.
Re:Initial image by agreed experts, not RIAA (Score:4, Informative)
Verbatim, from the new court order:
1. Kimberly Arellanes ("Defendant") shall make her computer hard drive available for imaging by Plaintiffs on or before March 21, 2007 [emphasis mine]
Clearly the court order says that Sony gets to do the initial imaging.
Step 2 is, "an expert in computer forensics selected by the parties shall make two (2) verified bit-images". That's the second set of images. The initial image is done by Sony.
Re: (Score:3, Informative)
Re:Initial image by agreed experts, not RIAA (Score:4, Insightful)
How I read it, it's basically:
1) Plaintiff, don't worry, you'll get access to the drive by March 21
2-3) Defendent, don't worry, here's how we'll do it---first, you get to delete your private files
IANAL, but that's how I read it. The summary's a bit confusing, and seems to suggest that #1 in the document has to occur before #2, which really doesn't make sense, as the GP points out.
Re: (Score:3, Interesting)
Besides being more private, it's also damned cool and lets you bring your programs, files, and everything with you no matter what computer you're on.
Re:Initial image by agreed experts, not RIAA (Score:4, Interesting)
TrueCrypt is pretty neat, but that brings up a question. If you encrypt your entire hard drive, what happens when your computer is taken as evidence? Can you be required to divulge the decryption key? IANAL, but I assume that you can be held in contempt of court (or something) by refusing to offer it up, leading to criminal charges, fines, and/or jail time. In any case, I doubt you can just give the RIAA the bird and say "Nah nah, can't touch this" because your stuff is encrypted.
Does anyone know the details about this? I doubt encryption helps you when it comes to legal matters, unless maybe you can plead the Fifth. After all, by giving up the decryption key you may be incriminating yourself
Anyone know?
Re: (Score:3, Informative)
A friend of mine got pulled in by the big guns out here in Australia a little while ago. It was kept very quiet (for which he was grateful) because they stormed into his house to find him sitting at his table drinking a coffee, all his PC's turned off. His TrueCrypted hardisks were useless as he "forgot" the complex key in all the excitement of having his door kicked in by a task force. Probably not legal but can they prove it?
Of course pleadi
Re: (Score:3, Funny)
Judge: "How do you plead?"
Defendant: "Ta-da-da-daaaaaa, ta-da-da-daaaaaa..."
(sorry, couldn't resist...)
Re: (Score:2)
I do know someone who tried this. The judge adjourned the hearing immediately and refused to continue until she got a lawyer.
Re: (Score:3, Informative)
IANAL either (so take this with a grain of appropriately sized salt)...
You can refuse to give out your key, but since this is a civil proceeding, the 5th amendment does not appl
Re: (Score:2, Interesting)
----
from the trucrypt website:
Plausible Deniability
In case an adversary forces you to reveal your password, TrueCrypt provides and supports two kinds of plausible deniability:
1. Hidden volumes (for more information, see the section Hidden Volume).
2. It is impossible
Re: (Score:3, Funny)
--jeffk++
Re: (Score:2)
Re: (Score:2)
I have code on my system that I think could be classified as trade secret sort of stuff, plus lots of private data such as genealogy info (birthdays, the dirty laundry on some relatives, etc), my tax data, the tax data for the people I assist with their taxes, copyrighted works of art, and code for a patent pending network security process that I just want to keep buried.
I also have work records for consulting jobs with banks & a couple of government groups.
Re: (Score:2)
And what if the files that my own compositions are in had DRM on them? Would they have to violate the DMCA in order to listen to them?
--jeffk++
Nothing reasonable about it. (Score:2)
The new order says agreed upon expert [makes the copy] and I agree, it does actually sound pretty reasonable.
What's reasonable about being threatened with the loss everything and your reputation at random? All to protect some big rich music publishers. Bin Laden is loving it.
Even if you can defend the witch hunt, this detail is still abusive. They are only interested in specific files and should be able to make a tool that extracts them transparently. Just imagine making a list of all the files that
Some things I wonder about are.... (Score:5, Insightful)
1. Who pays for the neutral expert?
2. Who makes the deletion of the privileged files?
3. How are the privileged files going to be deleted?
How do you find an expert? (Score:2)
I'm sure if I suggest someone as a neutral expert, the RIAA will discredit them and likely leave one of their guys as the only choice.
There may well be a market here though. I'm available for a small fee and largely neutral
Re:Some things I wonder about are.... (Score:5, Insightful)
Are my computing habits putting me at risk if they should ask about my online activities? Should I be afraid? Should I be hiding stuff now?
I don't download music or movies, but how do I prove that without having to go through such huge measures as going to court? The existence of MP3 files on my hard drive does not mean I've been downloading. If I buy a used system that has music files on it, am I guilty?
My belief is that they don't have a right to look at it at all without hard evidence that I've been downloading illegally. The police are the only ones given the ability to search with probable cause only. Discovery for court purposes is one thing, do they search each defendant's home top to bottom to find any hidden hard drives? Do they 'interview' neighbors and friends to see if there is a missing hard drive they are just 'holding'?
To me, this whole hard drive evidence thing is illegal in itself. What if a virus infected my machine as was being used to pass illegally downloaded files? What happens if the defendant's lawyer declares all data on the disk to be private, other than the OS files?
Re: (Score:2)
Remember that if you are involved in a case directly with the RIAA, you ar
CHILD PORN on the RIAA's Computer Systems (Score:2, Funny)
One could make the case to a judge that with all the drives the RIAA has unethically examined using their wide, pervasive and invasive techniques, there is a better chance than not that they have CHILD PORN on their own computers, and that a low-level forensic examination of the RIAA's computer disks would likely reveal CHILD PORN was there even if it is now erased. My understanding is that is a federal crime no matter HOW the CHILD PORN got on the RIAA's computers or whether the CHILD PORN on the RIAA's ha
Re: (Score:2)
Besides, the RIAA themselves likely never have actual possession of the media. Their attorneys or "forens
Re:Some things I wonder about are.... (Score:5, Interesting)
do they search each defendant's home top to bottom to find any hidden hard drives?
I'd been thinking about this and had more or less decided it would be a good idea to by a wireless hard dive (like this: http://www.whatlaptop.co.uk/YRtBdcdoWel2Yg.html [whatlaptop.co.uk]). I might even really go wild and rip some of the plasterboard off a partition wall and wire it straight in to a ring main. Replace the plasterboard and repaint and you'd virtually have to pull the building apart to find it (unless you used RF direction finding) - and that's if you knew it was there. I can't imagine your average cop/lawyer realising.
But would it be a fire hazard?
Re: (Score:2)
Re:Some things I wonder about are....In One Case.. (Score:5, Informative)
Well, in one case they are demanding to image and search the hard drives and all MP3 players of the son of a defendant, who lives miles away, and claims to only have a desktop system at home that he uses for his job as a legal assistant (i.e. large amount of confidential files there). They're trying to do this because, having searched his mother's harddrive and found ABSOLUTELY NO EVIDENCE of illegal activity on it, and only assumed that they were given the wrong hard drive, and are now on the hunt for the correct one that they're sure exists.
In the RIAA's twisted logic, he has either taken his desktop (not notebook/laptop computer) to his mother's house miles away to do illegal filesharing on her Internet broadband account, and then taken it home again, or REMOVED HIS HARDDRIVE and transported it over and back to infringe on record company copyrights. This theory, they feel, allows them to now search his hard drive -- or, I would expect, anyone within 4 degrees of separation from the defendant -- and all music players as they wish. While I believe this was finally ruled unreasonable and unlikely to produce admissible evidence, they now are fighting their best to avoid paying his legal bills that he entailed explaining this bit of common sense to them.
So in answer to your question: Yes!
Re:Some things I wonder about are....In One Case.. (Score:5, Informative)
Re: (Score:2)
http://www.truecrypt.com/ [truecrypt.com]
Re: (Score:2)
From the hypothetical point of view of a technologically knowledgeable guilty party, I would look for some way to store the copyrighted files steganographically in something that can reasonably be considered private, and request that it be deleted from the image. Then again, if I'm using
Details are absurd because Big Picture is. (Score:3, Insightful)
1. Who pays for the neutral expert? 2. Who makes the deletion of the privileged files? 3. How are the privileged files going to be deleted?
If media files are all the RIAA trolls are interested in, it would be easy enough to make a script to extract them. Standard tools like find and tar do exactly that and do it well. Fancier tools could be made to look for id tags if the RIAA is paranoid about people changing filenames. It is this list of files that should be agreed on and only that should be coppie
Re: (Score:2)
2. With MD5 hashes of everything and a redundant, untouched copy of the disk, it shouldn't matter to the plaintiffs who deletes the files. Hopefully, the respondent can get another computer expert to help out with their lawyer present and go through a list of files, including caches and swap files
Digital Forensics - a tough issue (Score:5, Interesting)
Re: (Score:3, Informative)
Be aware that some file systems have counts of how often they've been mounted that increment even when you mount read-only, which is all it takes to make a hash change. Hardware write blockers are not strictly necessary but are handy. Make sure the one you use has been through real testing, preferably your own.
Where's Mr. Tuttle when we need him? (Score:5, Insightful)
You just KNOW that the creepy bureaucratic gnomes who write up this stuff are going to have a hand in designing the "revised Internet" that's made the news lately.
Your computer has been used to violate article IV of the The Working Artists' Protection Act. Please unlock your front door, sit on the ground, place your hands behind your head and wait quietly. Attempts to flee, contact the press, or hire legal counsel is a violation of the P.A.T.R.I.O.T. III Act and may result in detention in an Overseas Protective Facility.
But "Metallica.mp3" is my financial records! (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Use TrueCrypt! (Score:5, Informative)
Assuming you really do have something to hide, using an encrypted volume embedded within another encrypted volume could be very useful. TrueCrypt [truecrypt.org] supports nested encrypted file systems and since TrueCrypt uses no headers to demarcate its volumes, it is not possible to determine if an additional volume is embedded within a TrueCrypt volume. In effect, it provides plausible deniability of the existence of a 2nd embedded volume if you're forced by court order to decrypt the main volume. (stick some Creative Commons licensed mp3 files in the main volume though, just to throw the RIAA the middle finger a little more.)
Better yet, support non-RIAA artists at sites like Magnitune [magnitune.com]. The quality of music I've found there is proof positive that the RIAA no longer has a legitimate purpose in the music industry.
My tips for installing TrueCrypt [aggiegeeks.com] on Fedora Core 6.
Re: (Score:2)
Yeah that 16GB Truecrypt volume with only 5 MBs of word documents in it don't look the slightest bit suspicious.
-Grym
Re: (Score:2)
Hey, encryption uses a lot of overhead.
Re: (Score:2)
You can just say, "yeah, I had a play around with TrueCrypt when I was feeling a little paranoid one day, but I never really use it."
Re: (Score:3, Informative)
Re: (Score:2)
That's easy. The judge will order you to provide the password. If you don't, he'll jail you for contempt. You can claim you've forgotten the password, but you'd better be really convincing because if the judge doesn't buy your story you could sit in jail for a long time.
In Unrelated News (Score:2, Funny)
Safeguards I use (Score:5, Interesting)
2.A good self destruct device (easy to built and arm) for the hard drive(renders it absolutely useless to any forensic expert,since it physically destroys the platters.)
3.I use an external drive to store the MP3 and other multimedia files on.Easily hidden,(like the old Varmit XL1000 CB Linear amps of decades past)
Anyone wanting to seize my machine will pay dearly for trying.I just don't give a damn anymore since I had the nervous breakdown last year.
That way,If the RIAA does get the machine,it will turn to scrap before they can get it 2 miles away.Paranoid? Sure,but with the corruption of the courts these days,these steps are needed.
Re: (Score:3, Insightful)
1.A loaded S&W .357 for use on the RIAA trolls trying to gain access to my house.(Under Ky Law I may defend my personal property using deadly force if I deem it necessary)
KY state law doesn't allow you to shoot a deputy sheriff for serving a search warrant. And that's what this would be.
2.A good self destruct device (easy to built and arm) for the hard drive(renders it absolutely useless to any forensic expert,since it physically destroys the platters.)
of course, now you've tampered with evidence (the small sound of an explosion may give it away), which is an actual crime as opposed to the copyright infringement which is not.
Re: (Score:2)
Re: (Score:3, Informative)
Is there any law that says you have to tell the guy taking the computer away there is a bomb in the computer? Whatever, it makes life interesting.
I think not telling him would be excellent grounds for a reckless endangerment charge even if he's not injured. If he's killed you could potentially be charged with manslaughter or even murder. A really aggressive DA might even be able to argue first-degree murder, saying that your decision not to tell him while leading him to the booby-trapped computer constituted premeditation.
So, yeah, there's a law against it.
Um, drop it... (Score:2)
WHAP! (Noise made as hard drive is dropped and violently falls onto floor)
Of course you would want to make your OWN image of the drive beforehand, and store it somewhere safe, like a safety deposit box at your bank or somewhere....
Re: (Score:2)
Re: (Score:2)
How much does a hard drive cost? How much does an RIAA lawsuit cost? It's easy to buy a $100 drive and make a copy on your own.
Make 10 copies. Put the hard drive in an ammo case and bury it in the woods. Give a copy to a friend. Copy it to a laptop hard drive and carry it in your pocket. Burn it onto DVDs and hang them on your Christmas tree. It's just data, zeroes and ones. Anyone who uses a compu
Re: (Score:2)
Why do they need the harddrive? (Score:2)
Having the data on your harddrive doesn't prove that you were distributing it.
The only way to prove that your were distributing it would be to catch you while you are distributing it.
I would have them remove... (Score:4, Interesting)
In the end they should receive any MP3 files that are on their list of infringing files, and Online Media Distribution System (P2P file sharing program, for the rest of us) files for the OMDS they've claimed they've identified (e.g. KaZaA) if present, AND NOTHING MORE!
As I understand it (IANAL), you are allowed to remove personal files that have no relationship to the case at hand. The RIAA can object if you try to protect files they say have a direct bearing on their case, however, they should find it an impossible task to justify why they need to see anything other than specified MP3 and/or OMDS files. Don't give them a byte more than they're entitled to.
And most importantly of all, perhaps, wipe all the unused file space. Let them try to prove why they deserve access to areas of the hard drive not included in any files.
All the more reason to use.... (Score:2, Interesting)
i.e. - VMWare, where the installation is hosted within a single file. For tin foil hat level security you may choose to keep the file on an removable device. The first hint that the RIAA is persuing you, you disconnect/erase the device/file.
Ooops, the cat's out of the bag now !
Trade group police? (Score:2)
Re: (Score:2)
Re: (Score:2)
Here's my safeguard... (Score:2)
Too bad (Score:2)
how to deter the forensics crew (Score:3, Funny)
ln -s
ln -s
or maybe for more fun..
for file in `find
ln -s "$file" $HOME/$RANDOM.mp3
ln -s "$file" $HOME/$RANDOM.mpg
ln -s "$file" $HOME/$RANDOM.avi
done
Re: (Score:2, Insightful)
Re: (Score:2)
There is a recent article on the Toronto Sun website - it reminded me of the Slashdot as soon as I read it. Sam the Record Man still exists on Yonge Street, despite the implication in the article that it doesn't.
Re: (Score:3, Informative)
Re: (Score:2)
Too bad I have no mod points.
Re: (Score:3, Insightful)
http://www.google.com/search?q=%22As+a+record+stor e+owner,+my+business+faces+ruin.+CD+sales+have+dro pped+through+the+floor.+People+aren't+buying+half+ as+many+CDs+as+they+did+just+a+year+ago.%22&hl=en& client=safari&rls=en&filter=0 [google.com]
Well, you cold have at least updated your 12 year old record store and 'last year'.
Next to you being an RIAA shill, if you DO have a store, you deserve to be out
Dude, thats just sick... (Score:5, Funny)
You mean that people are actually ripping and sharing Christian rock??
Thats just *sick*.
Agnostic mountain (Score:2)
Re: (Score:2)
It was one of those boutique record stores that sell obscure, independent releases that no-one listens to, not even the people that buy them...
I also once had a business idea that revolved around selling crap that nobody needs. I didn't go as far as to actually buy a boutique, but still I feel your pain...
Now with 3X MORE DRAMA!! (Must Read!!) (Score:3, Funny)
As a record store owner who has failed to diversify or pay attention to industry trends , my business faces ruin. CD sales have dropped throu
Re:I love this line... (Score:4, Interesting)
My vote: it's the troll. It's too stupid to do a parody of anything.
Re: (Score:2)
I do think it's likely that it's someone working for the RIAA.
It's a testament to their cluelessness that they would hire someone to write such a ridiculous shill-piece.
Re: (Score:2)
Re: (Score:2, Interesting)
And notice that it's an off-topic troll, to boot.
Re: (Score:2)
Second of all, how exactly is the CD dead? For some smaller labels and independent bands this may not be an issue, but I'd like to know one place where I can legally obtain CD-quality, DRM-less music downloads complete with high quality liner note scans of any major label artists (not that there are many who I like, but enough to justify buying the occasional CD). Because if such a thing existed, then I would have no need for CDs.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Re: (Score:2)
IAMAL nor a forensic investigator - but I believe that any investigator worth their salt wouldn't care and might even agree with your suggestion.
However MD5 is perfectly fine for checksum to verify file integrity. Remember - they are not talking about using MD5 to encrypt the data - they are using it to make a "finger print" of the image so that there can be no claim of tampering with the evi
oops wrong Re:Why a broken hash? (Score:5, Informative)
I'm wrong - in fact I get the feeling that it's now important that MD5 is NOT used. NIST (an authority when it comes to forensic investigations) do *not* recommend the use of MD5 checksums. The grandparent was perfectly correct. A decent summary (sorry PDF) is here [nist.gov]
Re: (Score:2)
Re: (Score:2)
I used to be with it, but then they changed what "it" was. Now, what I'm with isn't it, and what's "it" seems weird and scary to me.
Grampa Simpson's writers were good with that one as...u
Who moved my cheese? (Score:2)
It should be:
Shit happens.
Who removed my brain?