RSS

Computer Security Expert Testifies that the RIAA Can’t Identify Users by IP Address

Points out that “Many computers can be connected to the Internet with identical IP addresses as long as they remain behind control points such as routers, firewalls, proxy servers, or similar technologies.”

For all the RIAA’s usual mischief, like recent attempts to subpoena a guys former employer, and also amazingly to try and have him identify everyone who’s used his computer for the last 3 years(can you?), there have been a few bright spots of victory that we can all sit back and enjoy.

One of those recent victories was in the Capitol v. Foster case where an Oklahoma court ordered the RIAA to pay the defendant Debbie Foster some $68,685.23 in attorneys fees and costs. The judge in that case even went so far as to criticize the RIAA’s lawyers motives as “questionable,” and their legal theories as “marginal,” something many of us without legal degrees have known for quite some time.

Well now the same Oklahoma attorney who so nicely humbled the RIAA’s legal team is at work again defending some of the students caught up in the RIAA’s college campus crackdown.

In Arista v. Does 1-11, the RIAA is trying to subpoena the names and addresses of 11 Oklahoma State University students accused of copyright infringement, but several of the students are trying to vacate the order by arguing the fact that the RIAA’s use of IP addresses is based on the assumption that it’s a unique means of identification, which it’s not.

To assist in proving their argument that a person cannot be uniquely identified by an IP address they have enlisted the expert testimony of Jayson E. Street, CISO of Stratagem 1 Solutions in Oklahoma City, Oklahoma, and recognized computer security and forensics expert.

In a 15 page expert witness declaration submitted to the court, Jayson essentially attacks the entire premise of the RIAA’s lawsuit which is that an IP address can be used to uniquely identify an individual. He calls this assertion “factually erroneous” and “misleading,”

For the RIAA first argues that “Users of P2P networks can be identified by their IP addresses because each computer or network device(such as a router) that connects to a P2P network must have a unique IP address within the internet to deliver files from one computer or network to another.”

Jayson counters that “In my opinion, the above statement is factually erroneous.”

He continues by pointing out that “An individual cannot be uniquely identified by an IP address,” and that “…networks of networks can have many duplicate addresses.” due to the fact that all connected computers reside behind the same control, or access point.

The RIAA also argues that “Two Computers cannot effectively function if they are connected to the Internet with the same IP address at the same time.”

Jayson again calls their statements “factually erroneous” by pointing out that they can if they are located behind the same control points “…such as routers, fire walls, proxy servers, or similar technologies.”

The RIAA even goes so far as to try and compare the internet to the “…telephone system where each location has a unique number,” and whereby “…only one call can be placed at a time to or from that home.”

Jayson, much to his credit, take this statement to task, calling it “misleading” due to the fact that “A telephone network is a circuit-switched network ” that “…creates or removes a circuit or end-to end link between the two devices that wish to communicate.”

“The internet,” he points out, “is not a circuit-switch network. Instead, it is a packet-switched network.”

“In such a network individual packets are created by the end point devices and deposited onto the network with destination information, ” he says. “Control devices within the network can then decide which path the individual packets will take across the network. Not all packets will necessarily take the same path. As such in a given network, there can be many simultaneous communication stream that are presented through a single control point ana all logged as coming from a single IP address.”

How’s that for a rebuttal?

The RIAA’s singular most important method of “identifying” individuals, the IP address, is basically proven to be an “erroneous” and “misleading” means of proving that an end user is responsible beyond all doubt, thus allowing the merits of current and future lawsuits against individuals to be called into question.

Don’t you just love the smell of victory in the morning?

digg_url = ‘http://digg.com/security/Computer_Security_Expert_Testifies_RIAA_Can_t_Identify_Users_by_IP_Address’;

Looking for more stuff to watch or download?
Judge Lets RIAA Subpoena a Defendant’s Former Employer
Record Label Actually ASKS Fans to Share Its Music on the Pirate Bay
UK Music Piracy at an All-Time High
RIAA: ‘Lawsuits Can’t be the Only Solution to Piracy’
3 Quick Ways to Watch Movies for FREE!
3 quick ways to watch TV shows for FREE
BitTorrent torrent sites & search engines
uTorrent – A Beginner’s guide to BitTorrent downloading
Watch The Simpsons, The Office, Jackass, South Park, Lost, X-Men, and More, On-Demand For Free
News Tip? Comment? Suggestion? [email protected]



Jared Moya
I've been interested in P2P since the early, high-flying days of Napster and KaZaA. I believe that analog copyright laws are ill-suited to the digital age, and that art and culture shouldn't be subject to the whims of international entertainment industry conglomerates. Twitter | Google Plus
deleted
deleted

A fantastic site and brilliant effort. A great piece of work. 264890029

Boomer The Dog
Boomer The Dog

The security expert should know because those are the guys who are always pushing business to put in firewalls and proxies. At home what is one of the biggest things that ISPs tell users to do for security? That's right use a firewall. You can see what Jayson is talking about for yourself. Go to Panera Bread with a friend and your laptops and log on to their net. Go to www.ipchicken.com on both computers and likely you will see that both of you are using the same IP address. It's cool I've tried it before!

mountain_rage
mountain_rage

Not rocket science the route is the device that gains the main IP address and is now controlling the information traveling through that building. Your computer now resides behind an IP address assigned to you by the router. But the riaa will only see your routers IP address as that is the IP address that is sent across the web. Very interesting defense and should work well for big networks such as those found on campuses. It will however do little for a home network as it is obviously someone in the home who has done the file sharing and it comprises usually one of a couple computers. However if you have a wireless network this starts to make things interesting again as anyone driving by could potential piggy back on your network.

Zoness
Zoness

Yeah a lot of this is common knowledge and the RIAA knows that I'm sure they just don't want people to use it against them like Jayson did.

Signa
Signa

if i ever get sued thats so totally my defence. if they cant prove im guilty then they dont have a case. im sure some jack-ass lawyer would disagree but in a *rational* court of law it would be enough.

kdemetter
kdemetter

That's what i've been doing for a long time . My ISP only allows me to have 1 ip adress so i use a router . Basically every computer has a unique ip on that network ( internal ip ) but this gets translated into 1 external ip trough the router . Off course this won't protect you fom liability at home since they will simply go after the owner of the ip . But on a large network like a school network that might work .

NFSU2FREAK
NFSU2FREAK

what about static ip addresses then how do you track people if their ip address changes all the time.

Zoness
Zoness

Yeah a lot of this is common knowledge and the RIAA knows that I'm sure they just don't want people to use it against them like Jayson did.

Boomer The Dog
Boomer The Dog

The security expert should know because those are the guys who are always pushing business to put in firewalls and proxies. At home what is one of the biggest things that ISPs tell users to do for security? That's right use a firewall. You can see what Jayson is talking about for yourself. Go to Panera Bread with a friend and your laptops and log on to their net. Go to www.ipchicken.com on both computers and likely you will see that both of you are using the same IP address. It's cool I've tried it before!

mountain_rage
mountain_rage

Not rocket science the route is the device that gains the main IP address and is now controlling the information traveling through that building. Your computer now resides behind an IP address assigned to you by the router. But the riaa will only see your routers IP address as that is the IP address that is sent across the web. Very interesting defense and should work well for big networks such as those found on campuses. It will however do little for a home network as it is obviously someone in the home who has done the file sharing and it comprises usually one of a couple computers. However if you have a wireless network this starts to make things interesting again as anyone driving by could potential piggy back on your network.

Signa
Signa

if i ever get sued thats so totally my defence. if they cant prove im guilty then they dont have a case. im sure some jack-ass lawyer would disagree but in a *rational* court of law it would be enough.

kdemetter
kdemetter

That's what i've been doing for a long time . My ISP only allows me to have 1 ip adress so i use a router . Basically every computer has a unique ip on that network ( internal ip ) but this gets translated into 1 external ip trough the router . Off course this won't protect you fom liability at home since they will simply go after the owner of the ip . But on a large network like a school network that might work .

deleted
deleted

A fantastic site and brilliant effort. A great piece of work. 264890029

NFSU2FREAK
NFSU2FREAK

what about static ip addresses then how do you track people if their ip address changes all the time.

Leishtek
Leishtek

it is both your MAC address+IP address that identifies you on a computer network or online. Spoffing both, well that's mighty difficult. However, if someone were to perform a M.I.T.M. attack & surf over your connection to dL files, that is plausible. Heck, i've done it before!! dL all the stuff you want, and never be discovered. I like THAT a lot better than anyone knowing i'm ripping off their bandwith. hahah!







VyprVPN Personal VPN lets you browse securely