Analysis of MediaSentry Wins Music-Download Suit 51
An anonymous reader writes "A Dartmouth professor's analysis of MediaSentry problems helped win a New Hampshire woman's RIAA music-download lawsuit. 'Since all of Plaintiffs' claims are based on the assumption that MediaSentry's software and computer configuration are trustworthy and free of errors, and this log clearly represents a failure of the MediaSentry software to perform the operation it claims to describe, the reliability and validity of the MediaSentry method should be questioned,' wrote professor Sergey Bratus in his report, dated May 30. 'In my opinion, these materials leave critical aspects of MediaSentry's evidence collection process undocumented. In my opinion, they express unwarranted assumptions regarding both software and network technologies involved, and attempt to create an illusion of evidence-supported certainty where it does not exist.'"
The full report (PDF) is available online. It's worth noting that this victory was not the outcome of a court ruling; rather, a settlement was reached that did not require the defendant, Mavis Roy, to pay anything to the RIAA.
No computer, no crime! (Score:5, Interesting)
Interesting, In this one, unlike the Misisippi case, apparently the person sued by the RIAA "said she didn't have a computer in the house at the time."
Whereas in the other case, the computer itself was not an issue.
Legalese shenanigans always a mess (Score:5, Insightful)
Re:Legalese shenanigans always a mess (Score:5, Insightful)
The Jammie Thomas-Rasset [google.com] case is being pretty helpful.
It's helpful for everyone but Jammie Thomas-Rasset. Seriously, when you get a case brought upon you by the RIAA, you'd rather win and get on with your life rather than have to pay those bastards $1.9 million in installments until you die.
The Bands need to be asked.. (Score:1)
I will draw a correlation to Kathy Lee Gifford http://www1.american.edu/ted/kathylee.htm [american.edu] an
Re: (Score:2)
It's helpful for everyone but Jammie Thomas-Rasset. Seriously, when you get a case brought upon you by the RIAA, you'd rather win and get on with your life rather than have to pay those bastards $1.9 million in installments until you die.
Is the debt passed to her estate when she dies? I wouldn't want to "inherit" that...
Re: (Score:3, Interesting)
IANAL. Let's say that first, shall we?
Assuming she didn't declare bankruptcy, the estate would be reduced by the amount of the debt. If the estate could not cover the debt, it would be declared insolvent. Here's one answer [answers.com] with respect to credit card debt.
Beyond that, the reasonable extension is "the estate declares bankrupcy". Not even moths-in-the-wallet. Unless there was some contract specifically including the inheritors (as in the case of credit card debt on a joint account), I believe the debt is
Re:Legalese shenanigans always a mess (Score:5, Insightful)
I tend to agree with you. But, it is necessary to destroy the credibility that RIAA enjoys in court, as well as arguing the more fundamental aspects of "fair use" and "First sale", and more. I read the PDF, and it thoroughly destroys Media Sentry as a "forensics" tool, or even as a data gathering tool. More, the paper demonstrates that the people using Media Sentry to gather data don't even understand the data they are gathering, nor how to verify that data. In short, it makes idiots of everyone at RIAA, starting with the talking suits who brag their software up, right down to the "technicians" who are busting people on the web. Credibility and/or the lack thereof, means an awful lot in any court. When was the last time a judge took your word over that of a cop? This is the problem we have right now. RIAA presents itself in court as a freind of the court, and as an enforcer. It's all entirely improper, of course, but they currently get away with it.
Re: (Score:2)
1979 - But that was only because I was bullshitting and the cop honestly answered the question "Was I wearing sunglasses?" with "I don't recall".
Re: (Score:2)
Interesting, In this one, unlike the Mississippi case, apparently the person sued by the RIAA "said she didn't have a computer in the house at the time."
Ah ha, so she had a radio and not a computer? The RIAA will sue anyone for listening to music "for free"!
Re: (Score:2)
Wait for the MediaSentry ProtectionSquad to invade the house and plant a computer in there. Some tiny laptop.
And wait for the following lawsuit needing a professor, before it comes clear that the laptop was built after the start of the original lawsuit. ;)
Re: (Score:2)
Don't be silly. There are plenty of un-wiped laptops on Ebay!
Re: (Score:2, Insightful)
>Corporate banks have more weight than record companies.
In matters of copyright infringement, banks and record companies enjoy equal protection even though they have different risks.
In matters of theft, banks and record companies enjoy equal protection even though they have different risks.
Theft and Copyright Infringement are protected by different laws. Banks and record companies are protected by the same laws.
Of course a settlement was reached (Score:5, Insightful)
Do you think the RIAA wants to get a Judge to rule on that evidence?
What would happen to the other cases/business model if media sentry's data collection was ruled not a secure chain of evidence path?
Cockroaches fear the light.
Re: (Score:2)
Re: (Score:2)
Not that I blame her; the legal battling hasn't exactly worked out for Thomas.
Bit of a generalization don't you think, based on one piece of data?
Re: (Score:3, Interesting)
Re: (Score:1)
Re: (Score:2)
Well, I would certainly counter-sue. With a ton of charges, including being a mafia, Internet terrorism, and being an enemy of the state. Something will stick. :D
Me? (Score:4, Insightful)
that did not require the defendant, Mavis Roy, to pay anything to the RIAA
Sometimes, life is good and all is right in the heavens.
Fighting fire with dynamite (Score:5, Interesting)
Re: (Score:1)
It kinda seems a cop speeding to pull someone over, the cop is breaking the law by speeding, but has a duty to fulfill in catching someone else.
Re: (Score:2)
A cop is lawful representative appointed by a governing authority. MediaSentry is a corporation; unelected, unregulated, and, in quite a few states, banned from operation. It should have no enforcement capabilities at all.
What we are witnessing is a private industry adopting a vigilante approach to law enforcement, simply because it doesn't like what the law a
One thing to remember (Score:5, Interesting)
Re:One thing to remember (Score:5, Interesting)
It also means the word needs to be spread on this so that everyone can challenge the RIAA in the same way forcing them to either accept complete defeat or allow it to be tried in court and er, end up being forced into accepting defeat.
I've always wondered why this sort of defence hasn't been tested before. Effectively all MedaSentry are providing is a screenshot and/or text files showing that their IP was being used for downloading copyright material. Of course, generating such a screenshot in photoshop that is impossible to tell apart from an authentic screenshot is trivial, similarly any old joe can knock together a text file that suggests such and such an IP was downloading some data at a certain time.
Hell you don't even have to do that, you could create an offline network setup to mimic the IPs involved in the first place.
This is the problem I have with computer crime cases in general, and in fact, even computer forensics. Even if you confiscate a PC and do DNA analysis on the keyboard to see if person x is the guy who use this computer to commit crime y can you ever reall prove someone didn't just plug a different keyboard in the computer to commit the crime?
There's a need to catch criminals who use computers for sure, but I'm concerned in computer crime cases the level of evidence required is so rediculously weak, and so easily rigged or faked compared to normal crimes that if it continues I wouldn't be suprised if we end up with a plethora of wrongful convictions coming to light over the next few decades. Of course, companies like MediaSentry are only degrading the level of "evidence" that is apparently acceptable too - if we can't really, truly prove people guilty in many computer crime cases from forensic analysis when you have access to the physical machine what kind of joke is it if you're going on an IP address and nothing more?
I hope eventually as judges and politicians become more IT literate this trend reverses, if it doesn't then it's going to be a sad future for justice as the level of evidence becomes ever weaker yet the use of electronic devices and hence the amount of electronic crimes increases. We're going to end up with a lot of innocent people in jail.
Spy sappin' my MediaSentry (Score:1)
In this case, there's no reason a company like MediaSentry (even being the dicks that they are) would bully a poor woman arbitrarily. The focus of the lawyer was (rightly) to show that the MediaSentry records were not tampered with in bad faith, but w
Re: (Score:3, Informative)
If the DNA lab says that the victim's blood was found on your clothing, you can't just cry out "the records were falsified" without good reason to believe so.
Actually, you can. It is the responsibility of the forensic expert to demonstrate that there is a proper evidence chain and that every piece of software and hardware employed is approved for use in gathering evidence and can be held to the required standard. This is part of the reason why computer forensics evidence is expensive to obtain. Every step of the procedure has to be documented. MediaSentry didn't do this, they just ran a proprietary, unreviewed, uncertified, program and said 'look, magic 8-ba
Re: (Score:2)
The bar for civil case is much lower than criminal case. For civil case it is base on balance of probability.
Photoshop? Fake internal network? If that's the case it's simply equal to providing fake testimonial and evidence...everyone are supposes to not doing that because they have sworn-in, right? I mean, the professor is challenging about the accuracy of the evidence, not that they are created-out-of-nothing intentionally. These two are very different.
Re:One thing to rememberCALLING NYCLawyer (Score:2)
Well it's out in the wild now. Can New York County Lawyer's blog broadcasting this to the world be far behind?
Too bad this didn't get out a week earlier to help Jamie Thomas.
Who in their right mind would pirate these songs? (Score:2, Funny)
Re: (Score:2, Funny)
(tiptoes away quietly)
Re: (Score:1)
Re: (Score:2, Insightful)
Why not? I mean if you have taste that means that you enjoy music by these people, then it makes a lot of sense to download them. Or are you passing judgemtn on someone because their music tastes happen to be different from your own?
Rate (Score:1, Informative)
Holy shit, 100$/hour for writing that, 200$/hour for being in court!
RoyMNH0977 post (Score:5, Interesting)
It is apparent from the log that the operation has failed for the MediaSentry software, as the log shows neither the addresses nor names of the intermediary hosts nor realistic timings of packet round-trips between them and the MediaSentry computer. The fact that this standard operation has failed suggests flaws, or "bugs", in either the MediaSentry software, or in its system or network congurations, or both.
Karma for the post of this log. That should provide a few minutes of fun. I can only image what Dr. Bratus thought when he saw it.
Re: (Score:2)
However, it is not at all surprising that the trace failed. Routing ICMP (which is the protocol traceroute uses) isn't required, and is a security concern.
And, given this was for evidence, Media Sentry should have used a tool like tcptraceroute [wikipedia.org].
Re: (Score:2)
Uh, NO! The normal implementation of traceroute uses UDP.
Re: (Score:2)
Routing ICMP (which is the protocol traceroute uses) isn't required, and is a security concern
You are confusing traceroute with ping. A typical traceroute implementation sends a UDP packet with a time to live of 1 to a host. It then gets a 'TTL exceeded' error reply from a host one hop away and resends the packet with a TTL of 2. Eventually, it gets a reply from the destination address, and stops. You can do the same with TCP ACK packets, which helps for some firewalls configured by idiots which drop all UDP packets, but I don't know of any consumer-grade equipment which does this by default.
Re: (Score:2)
Re: (Score:2)
Bad PR? (Score:1)
Maybe the RIAA don't want the PR?
I don't think it would look good for them winning a settlement of *quick maths*.. 214 songs by $80000 equals 17.4 million dollars so soon after the Jamie Thomas-Rassett verdict.
court (Score:1)
Finally! (Score:5, Insightful)
The professor brings up the clear point I advocated in the first question to slashdot. There is no evidence whatsoever that Mediasentry had atomic calibrated clock information and the ISP did as well. All this evidence is based on a time stamp that could be anything, not to mention the role of Timezones. Without calibrated times at both the ISP and MediaSentry there is no validity to the evidence.
Re: (Score:3, Interesting)