Tuesday, 30 June 2009 18:57
Andy B
I have spent enough time doing IT security in the trenches of a Fortune 200 company to learn the limitations of protecting large corporate networks. In thinking about how a media company might try to stop online pirates from sharing their content, there are some interesting analogies to computer security. - First, it can't be stopped. Seriously - it really can't. That is the first thing that media companies need to understand and accept when considering their business strategies. Just like computer security - it is not possible to stop every virus, worm, rootkit, spyware, you-name-it from coming into your organization. There are too many attack vectors and too much complexity to dream of controlling and securing every one. Online piracy is the same - too many servers in overseas countries, too many technologies that hackers understand too well, and too much need for compatibility to close every hole in protection systems. Even for you HDCP "end to end protection" believers - you will never control the loop. It will always be broken. Step one is to admit there is a problem.
- Second, risk management is the name of the game. Once you've come to grips with the fact that online piracy cannot be stopped, the discussion shifts to how hard to fight it. Investing in DRM and other protection technologies has a cost. Going after pirates and lobbying lawmakers has a cost. Doing more of either costs more. Is the return on investment worth it? As in computer security, there is a "sweet spot" in which you have done the basic things that have a positive ROI, but beyond which the cost exceeds the return.
The question is where that sweet spot is - in other words how much insecurity/piracy can you tolerate. In my unscientific observations, it seems to me that media companies tend to invest in 100% control, which they are nowhere near achieving. Content piracy and computer security is asymmetric. You only need one person to crack DRM in one place and rip a digital copy for it to be available to anyone. On the other side it must be defended everywhere at all times. Does making copying non-trivial stop enough people from making casual copies for their friends to make DRM worthwhile? It appears media companies are convinced the answer is yes. Is it?
- Third, internalizing externalities. Media companies have gingerly accepted the need to venture into digital distribution in the last few years. We have seen Wal-Mart, Rhapsody, Napster, and of course iTunes get into the mix for downloading audio and video. There is a dirty underbelly to many DRM implementations that consumers are starting to become more aware of. When one of these services goes under (and no current service is established enough to be immune) consumers often lose all access to anything they purchased because the servers that told your computer you had the right to play the content just went away. It has happened, and will happen again. In the computer security world, this is usability. A program that is so tightly controlled that users prefer not to use it is not secure. It merely encourages users to find other, less-annoying alternatives. For example, instead of using the fancy new secure document retention system, users will just email each other Excel spreadsheets.
Amazon Kindles are a good example of the general problem - apparently there is a hidden limit that publishers can put on the number of downloads or devices that can be linked to an account. This limit is unknown to consumers who pay for e-books. If you get a new iPhone or Kindle, there is a good chance that some of your purchased content from Amazon cannot be transferred to the new device because of the hidden limits (unless cracked, of course). When considering the costs of media protection, the loss of customers due to these types of restrictions must be included. Many of these customers are likely choosing a more user-friendly (read: piracy) alternative.
There are other parallels that can be drawn, but I'll stop there. The essence of the idea is that media companies need to recognize that they are in the risk management business, which does not mean ratchet control to an unusable level because the pirates will still break the system and share the booty - and usability will cost customers. iTunes, Amazon, and other online distribution systems trending toward less DRM is a good start. However, more effort needs to be put into finding the right level of security to maximize the cost-benefit ratio and less effort into maniacally protecting un-protectable content. Some bloggers have suggested alternate business models for which piracy is not a detriment. Those business models generally rely on non-scarce (digital) content being used as a promotion of other scarce (tangible) goods. I don't think these business models have been explored enough, especially regarding music (thoughts for another post). They are starting to appear though, and will be worth watching.
|
Tuesday, 30 June 2009 18:21
Andy B
Well, I skipped from day two to two weeks after... I had a trip right after the verdict so all the post-decision punditry was left to those who do it best. Then I simply procrastinated. Here is an update, though, because I did want to walk through some of the things of note and give my $.02 on the "meaning" of the trial. First, many people have talked about the "why" and the "what now" that spring from the results. Quite obviously the jury believed that she was responsible for what the record companies claimed she did. There has been alternating focus on "the mysterious hard drive" (which I don't think had much to do with the verdict at all), the defense attorney aggressiveness, I was asked at the trial whether race might play a factor (Thomas-Rassert is Native American), and Thomas-Rassert perjuring herself. I am not going to try and guess what swayed the jury because it is a moot exercise. Bundled together, the story the plaintiffs told tying the user name, computer, song tastes, previous statements, and credibility of Thomas-Rassert together convinced the jury that more likely than not, she was guilty. Much more confusing to me is what people are trying to pull out of the trial. From Ray Beckerman's thoughts on how the trial "would" have gone (which seemed more wishful thinking than realistic to me) to an RIAA spokesman's equating the jury to a focus group (which I think reads way too much into a jury decision), I think everyone misses the point. As our Civ Pro professor noted repeatedly during the year - you can't predict or try to explain juries. They are not necessarily rational and you usually don't know what made them decide one way or the other. My conclusion: this trial means one thing - 12 people decided that, according to current laws, Jammie Thomas-Rassert infringed the plaintiffs' copyrights. That's it. No societal rejection on the validity of file-sharing. No commentary on the business models of record companies. The jury was asked a simple question and gave a simple answer. There is no more to it. The record companies didn't sue Thomas-Rassert for the money. They've known since the beginning that they couldn't collect a judgment. This trial was simply about PR and not giving up. If the record companies dropped the suit and allowed Thomas-Rassert to "win" they probably figured it would encourage others to resist settling copyright infringement suits. This was about the best evidence they could hope for - Thomas-Rassert did not have a wireless router, she controlled access to the computer so she couldn't believably claim someone else did it, and the "tereastarr" user name tied her to it. There was a PR risk that if they lost file-sharing would be "validated" but juries and court rooms are not places for policy discussion. They are to determine whether laws as they currently stand were adhered to. In an odd twist, the second trial likely supports a possible constitutional challenge to the copyright statute much more than the first. Thomas-Rassert couldn't pay $220,000, and she can't pay $1,920,000. So if you can't pay either, you might as well jack up the fines to eight times the original verdict to make it look ridiculous for a judge looking at the "excessive fees" clause of the Constitution. I'm not sure how much the difference would sway a federal judge, but in the court of public opinion $2 million seems much more out of touch than $220,000. I can't say that I am surprised at the verdict. During Thomas-Rassert's direct examination it seemed like the defense might be able to prevail, but on cross examination the plaintiffs just made her seem without credibility as they impeached her over and over again. I don't think this changes much in the world of online file sharing. It might stoke the fires of some peer-to-peer supporters but from a legal point of view there was not much in the way of interesting copyright law. I have some further thoughts on online file sharing for another post.
Wednesday, 17 June 2009 02:44
Andy B
Once again I will defer from giving the full rundown of the day's events news-style. It is being done several other places online (all four have on-site reps) better than I could if I tried. I enjoyed today for another reason. As the day wore on a profound appreciation for my excellent Civil Procedure professor grew and grew. First, plaintiffs lost one of the two "midnight motions" filed by defendants Monday because they failed to include a set of documents they intended to admit in their pre-trial evidence list as required in FRCP 26(a)(3)(A)(iii). Judge Davis had no patience for not following the rules and ruled that despite the relatively low level of prejudice defendants might suffer from allowing the documents, they would not be allowed. The second, and bigger, gaffe came from the plaintiff's expert. Now part of the issue here was that this is go #2 for this trial. The same expert testified at the first trial based off of the same report prepared for the plaintiffs. That report was duly disclosed as required, and the rules were followed. Then the fun started... In preparation for testifying today, Dr. Jacobson (the plaintiff's expert) decided to review the disk image of defendant's computer that he based his report off of. In doing so, he found evidence of the presence of an external hard drive that he had not previously noticed. Great deal, right? Dr. Jacobson had earlier testified that he believed an external hard drive was connected because of the time stamps on some files, but this was much better evidence and reinforced his opinion in the report that an external hard drive was connected at some point. Win, right? Well... not if this new evidence wasn't part of the report disclosed to defendants during pretrial discovery as required by FRCP 26(a)(2). That rule makes it clear that everything an expert says must be included in the expert's report and disclosed to the defense during discovery. Needless to say, judges don't like surprises - especially surprises that violate the Federal Rules of Civil Procedure. According to Dr. Jacobson and plaintiff's counsel, the new evidence was mentioned in passing last week (about the time it was noticed by Dr. Jacobson) and neither realized that it was undisclosed and improper. Dr. Jacobson because quite simply he doesn't know the rules because he is not a lawyer. Plaintiffs counsel didn't realize because... er... umm.... uhh... I'm not quite sure what their deal was. After Judge Davis gave both sides lunch to come up with short arguments plaintiff's counsel couldn't really explain it other than apologizing repeatedly and saying that it wasn't bad faith. The impact likely ended up being negligible. Before the lunch break right after first learning of the error, Judge Davis indicated that he was considering throwing out the entire testimony of the expert witness "because of [plaintiff counsel's] behavior." Plaintiff's attorney at the podium gasped and said "all of it?" to which Judge Davis flatly replied "all of it." That caused a Maalox-sponsored lunch break, to be sure. After having a lunch break to cool down Judge Davis merely required a jury instruction that the improper testimony was without basis and should be disregarded. Overall, bullet dodged by the plaintiffs. I am not sure what the plaintiffs' case would have looked like had Dr. Jacobson's testimony been wholly excluded. They had other similar evidence from other witnesses, but the glue holding it all together was the expert. How bad would you look if the jury was told "you know that witness you just listened to for almost three hours? Yeah, well forget everything he said. Plaintiffs broke the rules and therefore his evidence is to be disregarded." I know they can't un-hear the evidence, but it can go a long way toward removing that human face the record companies have been trying hard to put forward. So boys and girls, what did we learn today? We learned not to piss off judges. We learned to follow the Federal Rules of Civil Procedure. We learned to pay attention to how our witnesses are prepping for their testimony and when they come to us with new information we make damn sure it is proper. Overall, we learned that cases can be won and lost on procedure regardless of the facts of the case and the law. So during your 1L year when your Civ Pro professor tells you how important the stuff is - believe her/him.
Tuesday, 16 June 2009 11:55
Andy B
As we get ready to start day two, a couple of thoughts. - Ars tecnica has a good summary - more journalism focused than issue-focused, which is good. I met Nate (who wrote it) yesterday. Nice guy.
- We should know this morning whether the dogfight the defense has focused on over proving ownership of the copyrights will continue. I would be surprised if the defense wins their motion to limit the evidence that plaintiffs own or properly registered their copyrights.
- This is a civil trial. The burden of proof is "preponderance of the evidence" not the "beyond reasonable doubt" of a criminal trial. Accordingly, plaintiffs only need convince the jury that it was more likely than not that Thomas downloaded and distributed. The defense's opening statement yesterday focused on a "Thomas didn't do it" theme. You can certainly argue defenses in the alternative, but I think the defense will need to sell a single alternative story to the jury. I'm not sure it will be enough to say that whatever happened, Thomas didn't D&D. It was her PC, her modem, her house. She should be able to tell the jury why the songs found my MediaSentry were there. Otherwise the jury may have a hard time disbelieving the simplest story - the plaintiffs'.
Tuesday, 16 June 2009 00:08
Andy B
I won't rehash the details of the trial because it is being done several places including pro-defendant and pro-plaintiff blogs. However, I will point out some highlights and things that I thought were interesting. Opening Statements: Plaintiffs: focused on the harm to the plaintiffs. Real people being hurt, real damage. D tried to conceal crime. Defendant: "She didn't do it." Can't prove she did it, only prove that it was done. Can't show $3.6M worth of damage b/c can't show she was at the computer. Witness #1 - Wade Leak - Sony exec Interesting that he talked about the recording companies' business model. He stated that they only make money from recordings and that they don't make money off of concerts, radio, merchandizing, etc.. He also gave the "every download = lost sale" line (which, I don't care which side you are on, is flat-out ridiculous). Mr. Camara was very aggressive with objections early. Mr. Reynolds (I think he was up for Plaintiffs) did not seem very prepared. There were a lot of objections for lack of foundation because there were a lot of assumptions and they were skipping to the point a little too much when talking about the copyright registration documents and referring to some evidence that wouldn't be admitted until later witnesses. A long string of objections were sustained and Camara was looking like an evidence all-star for a while. Camara was really aggressive. There was also a strange segment where after several objections by Camara there was a sidebar about the certified copies of the songs proving copyright ownership. They broke up, but when Reynolds took the podium again, paused, then asked for another sidebar after one question which was successfully objected to. Plaintiffs looked really shaky for a while. As they got into the copyright registration discussion, Camara should have left well enough alone, though, and pushed on the objection front. He was overruled several times and got on Judge Davis' nerves because he kept interrupting the witness and opposing counsel with objections. Judge Davis actually stopped and scolded him later on - he really needs to watch that. During Leak's testimony, a couple of strategies seemed to come out. First, any time the witness said anything that implied Thomas downloaded files was objected to (and won), following the opening statement track suggesting that there was no evidence that Thomas was the person who did the downloads. Second, it became clear that the defense was going to fight the validity of the copyrights at every possible turn. The cross started on "work for hire" (which seems like a silly place to spend effort to me which is more likely to annoy the judge and jury than help the defendant's case) but mostly focused on what harm Jammie Thomas did to the record companies. Then there was the exchange that led to Leak saying that $150k per song was appropriate (and also was what led to Judge Davis scolding Camara for interrupting the witness). Witness #2 - Chris Connelly - MediaSentry Connelly was the MediaSentry employee that did the investigation of Thomas on KaZaA. What I thought interesting was that if you listened to Connelly describe MediaSentry you'd swear they were a private investigation firm... even though plaintiffs swore in the pre-trial they weren't. I don't think the MediaSentry evidence had a chance of being suppressed, but I am not convinced MediaSentry did not conduct private investigation in Minnesota (Thomas' computer and identity was, after all, in Minnesota - which is what MediaSentry was investigating). Camara again tried being aggressive with objections, focusing on Connelly not being an expert. He didn't win a single one, but kept pushing. I am a little confused about the "zero error rate" Connelly claims. As a computer scientist I know that zero error rates are simply impossible and such claims seem to backfire quite a bit. Simply put, you can't vouch for the entire system from the bottom to the top being perfect because your software is only one part of the system. Especially when you don't own the rest of the system (and don't even know where your data center is... which Connelly admitted to in cross). Software isn't perfect - it has errors, bugs, and claiming a "zero error rate" is pretentious and not smart. Especially when no one but you and your biased clients have tested it. One bug, no matter its impact on the output, destroys your credibility and MediaSentry's evidence is too critical to risk like that. Camara seemed to be building at something in the cross, but I am not 100% sure of what it was. There may be something in that MediaSentry only downloaded part of most of the files in question and most of their evidence collection isn't something a normal KaZaA user could do (maybe setting up an appeal of limine motion regarding wiretapping??). Also a line about why they didn't get the whole song and that they no longer work for the RIAA - those lines of questioning seemed like they could lead to something that would damage MediaSentry's credibility but they just sort of petered out... Either the defense is laying the groundwork for an argument I don't see yet or I am not sure where they were going with some of the cross. Sure they got some concessions and blunted the testimony a bit, but I have not yet seen anything that helps them on the fundamental questions they need to cast doubt on. Will they re-call Connelly or Leak?? (I saw Connelly afterward and he said he was heading home to NJ so I don't think so) I guess we'll see. Witness #3 - Heather Nessler - Charter rep Not a ton here. A couple of sustained foundation objections that were quickly remedied. Essentially walked through Charter's process of identifying customers for subpoenas. The cross focused on whether a customer would consider the subpoena notice letter sent to Charter customers as junk mail. Also questions over whether it was actually sent Federal Express or regular mail. Most substantive was making clear that Charter could only identify a modem, not who was using the computer behind it. Overall, I don't think there were any surprises. To me the most unexpected was how much Mr. Reynolds appeared to be bothered by Mr. Camara's aggressive objection strategy. Plaintiffs recovered on the next two witnesses, but they seemed genuinely affected during the first witness as they were repeatedly losing objections. Tomorrow we get to see Thomas on the stand. Will be interesting to see - this to me is where the trial will be won and lost. Will the jury believe Jammie? If so, she wins. If not... Overall, I think the defendants need to work on balancing objections with getting on the jury's (and at least as important the judge's) nerves. They need to limit their reaching arguments because all they have is credibility and they need to protect it. The plaintiffs need to keep hammering on the basic points and emphasize that the simple explanation is usually the right one. They can't let the defense's aggressiveness put them on the defensive, which I think is exactly what Camara is trying to do. Plaintiffs: show Thomas as someone who is just lying to try and get away with it. Defense: show Thomas as an unfortunate and vulnerable victim that just got caught up in the RIAA machine. Motions start at 8am, more updates tomorrow.
Tuesday, 16 June 2009 00:07
Andy B
(note: Not doing much editing or spell checking on these - not a ton of time. Apologize for any grammatical atrocities) Before voir dire and jury selection this morning in Capitol v. Thomas, Capitol made a couple of motions. The first (ok, not really a motion) was to state that they had obtained certified copies as requested from the copyright office, and that they would not 3-hold punch them as normal evidence papers because they were official certificates. Capitol's attorney (Oppenheim, I think) also took a shot at the defense by pointing out that they were exactly the same as the previous certifications in every way except that they were "on fancy paper." The second motion attempted to preclude Thomas from arguing that the copyrights covering the songs that were allegedly infringed are invalid. Capitol wanted to preclude any such arguments before the jury. Defendants stated that there was no intention of making an argument to the jury and the intent was a motion to dismiss, which would only be heard by the judge. Judge Davis (who, by the way I am liking more and more) agreed and told Capitol that the validity of the copyrights was a key component of the case and would be heard. Jury selection started as most probably do - with a bunch of people that don't much look like they want to be there. After general questions about jurors' use of the internet and knowledge of P2P file sharing systems, four jurors were excused because of the potential two week duration of the trial. Judge Davis did not seem impressed with jurors that tried to talk their way out by saying it would just be "inconvenient for work," noting that they received juror notices and knew. I missed the strikes, but knew juror #12 would not be there as soon as he started talking about technology outpacing artists and the words "business model" came out of his mouth. Juror #15 also answered a question with some sort of "technology changes" answer so he was the second juror I anticipated being struck, which he was. Others struck were #6 - young guy who "got a couple of CDs from a friend" that were downloaded and #3, whose kid was given a bunch of songs for his ipod from a friend. I will not be posting juror names or other information, but will give a brief outline of the demographics: 7 men, 5 women 2 college students, a criminal justice major and a pre-vet major. A bartender (was asked if he knew what an ASCAP license was - he didn't) Almost all have ipods or have family members. Most not sure where their kids/friends/spouses get their music. 1 used Limewire two years ago but quit because he "didn't want to get caught and be here"
Sunday, 14 June 2009 23:23
Andy B
Judge Davis has released his decisions for the Capitol v. Thomas pre-trial motions and they all went pretty much as I had expected. The big one was the motion to suppress MediaSentry's evidence. This was probably a long-shot to begin with, but I don't think it was very well argued. Thomas' only hope of actually winning that motion (and with it the case in one fell swoop) was to do a much better job of showing how MediaSentry violated the Minnesota Private Detectives Act. When pressed to describe how MediaSentry violated the MPDA, Camara didn't hammer home the essence of what MediaSentry does. In the brief the Thomas team listed the things that define the work of a private investigator: “investigating the identity, habits, conduct, movements, whereabouts, transactions, reputation, or character of any person; investigating the credibility of witnesses or other persons; investigating the location . . . of lost or stolen property; or obtaining through investigation evidence to be used . . . in preparation for trial of civil or criminal cases.” and said: "MediaSentry did these things when it investigated the identity of the user of the computer from which it downloaded the songs here at issue (the user that the RIAA alleges is Jammie Thomas) and when it obtained, through its investigation, evidence of copyrighted songs on Jammie’s computer. " Really? That is all Thomas' team can say? "MediaSentry did these things?" Come on! How about analogizing what MS does to a traditional PI? MediaSentry sent data to a computer in Minnesota requesting information that would help MediaSentry identify the person they sent the request to. Let's say that was a phone call. Could a private investigator in New Jersey have called friends, family members, employers, and other persons to investigate a person and be in compliance with the act? Could they call courts and police departments asking for information? The plaintiffs focused on MediaSentry being an out of state company and not operating in Minnesota. That argument was the primary basis of Judge Davis' denial of the motion. Thomas needed to pound home that MediaSentry was essentially "phoning around" asking for information about people. Another analogy to draw would have been a business that had no physical property in Minnesota. If a business never has a store or employee in Minnesota can they still operate in Minnesota? Judge Davis also mentioned in his order subdivision 5 of MN Statute 326.3381, which states that any PI organization that opens an office in MN must have a person in the MN office that meets the licensing requirements. Judge Davis interpreted this to mean that any organization that does not have a MN office is not subject to the act. I believe that is an incorrect interpretation, but again Thomas never did much to dissuade him. The reason is that if that were true, a PI on the border of MN that advertised and did significant work in MN would not have to be licensed in MN because they don't have an office in the state. That doesn't make any sense to me. What I think it actually means is that if you are a PI company based out of state and you open a MN office, you can't rely on someone in the other state to be licensed in MN - you have to provide someone in MN that can be licensed. I don't know the answers to most of those questions. However, Thomas made a pretty poor argument in convincing Judge Davis that the MPDA applies. Saying "MediaSentry did these things" doesn't cut it. How about drawing parallels and providing examples about how exactly MediaSentry "did these things?" How about discussing the harms and the precedent set if this evidence is allowed? Glazing over the best of your argument does not a winning brief make. The longer shot for Thomas was actually getting the evidence excluded. There is no law forcing the exclusion of the evidence even if it was obtained illegally, so such exclusion would have been merely on ethical or fairness grounds. Thomas needed to convince Judge Davis that there is danger in encouraging or even allowing such evidence into the court room because of the message it sends to future litigants about how they can conduct investigations of those they plan to sue. That might not have worked, but Thomas had no chance of winning without it and they hardly even tried to push the harms. As filed and argued, I agree with Judge Davis. Thomas didn't make a compelling argument for exclusion and the way that the civil system is designed, more evidence is better. You need to make a pretty good argument if you want something excluded and Thomas simply did not do that. An important point to remember for those that disagree with MediaSentry's practices is that moral does not equal legal. The legal system is set up to be the best it can be for most situations, and fairness isn't always part of the deal. A judge cannot exclude evidence simply because he finds a party's methods distasteful. He needs to follow the law and the rules of evidence, and in this case Judge Davis did that correctly given what was in front of him.
|
|