[FC-discuss] Tenenbaum Day 3: Witnesses

[Seth Johnson]

> http://recordingindustryvspeople.blogspot.com/2009/07/day-three-witnesses-in-sony-v-tenenbaum.html

 
Day three witnesses in Sony v. Tenenbaum


BY MARC BOURGEOIS

Wednesday, July 29, 2009


Antonio Franko

Wednesday's first witness was Antonio Franko, a high school friend of
Joels. He hasn't seen Joel for several years and was asked some basic
questions, about his use of a computer in Joel's bedroom, and about
Joel's music collection. In similar testimony to Mr. Chappel he stated
that he'd used the computer but never to use KaZaA or download music,
despite deposition testimony from Joel that he may have. He testified
also that Joel had a good sized music collection, including some
burned CDs.

Dr. Doug Jacobson

Most of the morning and a portion of the afternoon was testimony from
Dr. Doug Jacobson, the Plaintiff's expert witness. He began by going
over his qualifications and his curriculum vitae and was admitted as
an expert with no objection from Plaintiffs. He explained that he was
asked to produce a report for Plaintiffs about the MediaSentry data he
reviewed in this case, and eventually to issue a supplemental report
after examining a computer hard drive from Joel's Gateway computer.

He then began explaining how peer to peer networks work, and how KaZaA
works specifically. After describing technical details about peers,
supernodes, and IP addressing he moved on to the user experience of
the KaZaA application. He explained that users search in KaZaA for
files, then they can choose files from the results returned to begin
the files downloading on to their computer. He explained that the
users in the peer to peer network typically don't know each other, and
only identify one another by their IP address. He was asked to explain
some features of KaZaA 2.0, which he explained had an option to scan
for files that you may wish to share with the KaZaA application, and
that this was an option that would only occur after the user chose to
run it. He was asked if KaZaA could be used to listen to music from
other computers on the network. He explained that this could only
happen if the music was first downloaded from the other computer.

Dr. Jacobson then testified about the report he prepared on the
MediaSentry evidence. He testified that he had reviewed the
MediaSentry information and formed the opinion that Joel Tenenbaum had
used that computer, and that he had used it to copy and distribute
copyrighted files. His opinion was based on the evidence that
MediaSentry was able to start the download of 1000+ files and collect
MetaData and successfully continue the download for a subset of these
files. He examined the screenshots of the shared folder and stated
that all of the files listed were available for distribution. He
testified that the initiation process on all files serves the purpose
of proving that the file does indeed exists, and gathers the meta data
about the file for further evidence.

He then began to explain in more detail than Mr. Connelly some of the
information contained on MediaSentry's data log. He explained the
makeup of the request packets and response packets, including the
source and destination IP address on the packets, as well as some of
the header information such as the request of the file by its file
hash, and the header fields showing KaZaA username and KaZaA IP
address. He went into the most detail on a file where a request was
sent several times without a response to sublimeguy14's computer
before a response was recieved from a different user (nick_c). He
explained the packets in this case showed that the file started
downloading from someone else, but eventually finished downloading
with a transfer from sublimeguy14's computer. He stated from all of
his analysis that he had no doubts about the MediaSentry information
and believed that sublimeguy14 was distributing the entire file with
that hash code. He also stated his belief that all of the files were
available for distribution based on MediaSentry being able to obtain
the meta data for all of them.

He also testified as to a number of tracks about his belief that the
files came from the internet and were not ripped, based on the meta
data that MediaSentry was able to obtain. The format and completion of
the meta data was not consistent among many of the files, making him
form the opinion that they were not ripped by the same computer. He
explained that if they were ripped the meta data would likely have
been consistent from the same software performing the ripping on
multiple tracks.

Dr. Jacobson was asked whether or not he believed a wireless router
was involved in this case. He explained that in the case where a
router was involved the X-KaZaA-IP: header field would differ from the
source IP address of the data packet, with the former being a private
IP address. He explained that this address was identical in all of the
data packets from sublimeguy14's computer, which indicated there was
no wireless router. He also pointed to the partial file received from
nick_c which showed a 192.168.x.x IP address in the X-KaZaA-IP:
header, which he explained meant that nick_c was using a router to
connect his computer to the internet.

Mr. Reynolds asked Mr. Jacobson if he had any doubts or concerns about
the accuracy or methodology of MediaSentry, to which he replied that
he had none. He also testified that he had no concerns about hte data
provided by Cox Communications.

He was asked about the concept of pollution, which he explained was a
situation where a file name does not match what is in the content of
the file. He testified that he had no basis to believe that pollution
occurred in this case. His opinion is based upon the data lengths of
the files matching those of legitimate versions, and having proper
meta data. His opinion he stated was also supported by the finding
that those files that were completely downloaded did match what their
file names claimed that they were.

He was asked about the concept of IP spoofing, which he testified was
difficult to perform on the public internet and that he had no reason
to believe that it took place in this case.

After a brief break Dr. Jacobson then began testifying about his
forensic examination of a hard drive from a Gateway computer that Joel
owned. He testified that this computer was different than the computer
that Joel had in 2004 in his bedroom, he stated that he performed his
investigation about a month ago.

He explained his process of examining the hard drive, by recieving a
forensics copy of the drive and using the EnCase software to examine
it. He testified to several points he discovered during his
examination:

  * Windows had been reinstalled on the computer on 
    3/31/2009.
  * There were two registry files which could not be opened, 
    which he indicated was evidence that they were attempted 
    to be deleted.
  * The file sharing program LimeWire was on the machine, 
    and he believed it to be operable.
  * He found evidence of over 2700 music files in the C:\My 
    Music folder which LimeWire was sharing, but that this 
    folder itself had it some point been deleted.
  * He was able to identify several songs that were once in 
    the C:\My Music folder that were at issue in this case.
  * He found several hundred exact matches to files in the 
    C:\My Music folder that were being distributed by 
    sublimeguy14 at KaZaA
  * He also found a My Music folder under Joel's My 
    Documents folder, which contained a similar folder 
    structure and many of the files that were removed from 
    the C:\My Music folder.
  * He had formed the opinion based on the inconsistent meta 
    data in the files he found during the forensic 
    examination that they were downloaded and distributed on 
    the internet.

Upon cross examination Professor Nesson asked Dr. Jacobson was he was
being paid for his work. He stated that his rate in these cases was
$200 per hour, and that he had probably worked 40-50 hours on this
case. He testified that he has probably prepared about 300 reports for
the recording industry in these types of cases, but most of them did
not involve a forensic examination. He estimated that his total
earnings from his work for the recording industry to be in the range
of $100,000 - $120,000.

He was asked if he had any relationship to MediaSentry. He stated that
he did not have a relationship to MediaSentry, but he did discuss
their data handling protocols with them. He admitted that he had never
examined or tested their software. He was asked about the MediaSentry
statement that their software had a zero-error rate. He stated that in
the MediaSentry data that he had examined that he had never found any
errors, but admitted that a zero-error rate that is something that is
hard for software to achieve.

Dr. Jacobson was then asked why MediaSentry only downloaded 7 of the
files they found in the shared folder. He stated that it would have
been infeasible to download them all, because it would have taken a
long period of time. He was asked that for the remainder of the files
it would be impossible to know if they were the sound files they
stated they were or not, because there was no underlying file. Dr.
Jacobson agreed that an audio comparison could not be made, but that
it was still his opinion that all of the remaining files were present
for distribution.

Professor Nesson asked Dr. Jacobson that if a spoofed file was present
in the directory if it would look the same as the other files from the
meta data, to which he admitted that a spoofed copy could contain the
correct meta data as well.

Professor Nesson then returned to asking Dr. Jacobson about a company
he mentioned that he formed during his description of his credentials.
He asked about the product, such as to whom it would be sold and what
its purpose it was. Dr. Jacobson stated the market for the product was
any customer that wanted to control peer to peer traffic on their
network.

Dr. Jacobson was then asked about the InfraGuard group of which he is
a member. He was asked in basic detail about what it was, and asked if
copyright infringement had ever been discussed at an InfraGuard
meeting. He stated could never recall his chapter discussing copyright
infringement but that the chapters were each free to operate in their
own way.

Testimony then broke for lunch, after which Dr. Jacobson resumed
testifying. He was asked to describe the user friendly aspects of
KaZaA, and he described the process of searching for a file and double
clicking it to download. He asked what other active action needed to
be taken to distribute the file, which he said there was none, it just
happened after the download completed, the only active action was
double clicking the file for the initial download.

Professor Nesson then proceeded along a line of questioning about the
quality of music files found in the shared folder, and asked Dr.
Jacobson to compare them to the quality of music that would be found
on CDs. He stated that the MP3 files would be of lower quality, but
that most people could not tell by simply listening. He conceded on
further questioning that some people could likely discern the
difference in quality between the two. He then began to ask if someone
might download these lower quality files on the internet before
purchasing the higher quality CDs in the stores, but his line of
questioning was stopped based on sustained objections from Plaintiffs
that this questioning was out of the scope of the direct examination.

Professor Nesson then asked some questions about pirate rip groups and
asked if there was any malicious quality to the way these groups put
out music. This question as well as others in a similar line of
questioning were also stopped on sustained objections.

The examination then turned to the issue of the re-installation of the
operating system that Dr. Jacobson testified about. Professor Nesson
asked if htere was any evidence that the re-installation of the
operating system was for any malicious purpose, or if there was any
evidence that the number of music files was reduced after the
operating system was re-installed. Dr. Jacobson answered in the
negative to both of these questions. He was then asked about the two
registry files that the EnCase software was unable to open. Dr.
Jacobson previously testified that missing the data from these
registry files made it impossible for him to determine some things
about the configuration of the computer. Professor Nesson asked him
more specifically about which registry files were unable to be opened.
One was the NTUSER.dat file for the all users profile. Professor
Nesson asked about this file and its relation to a NTUSER.dat file in
the "joel" profile that was able to be opened, and asked if that meant
he should be able to find information about Joel's user account and
settings. Dr. Jacobson stated that what settings were stored in what
location would depend on the way in which the software was installed,
so he cannot tell for sure what exactly was in the registry file he
was unable to open.

Professor Nesson's final question concerned Dr. Jacobson's report that
750 music files were added to the machine in October of 2007. He asked
whether or not these files could have come from being added to the
iTunes library if Joel had begun using iTunes at that time. Dr.
Jacobson stated that he did not know if iTunes made a copy of files
that were added to the library, or what method it used to make a copy
if it did, so he could not say for certain.

Upon redirect Dr. Jacobson was asked about the report he prepared in
this case. He stated that it was twelve pages long, with several
hundred pages of attachments, and that it was quite lengthy for this
type of report.

He was asked directly about his testing of MediaSentry software. He
stated that MediaSentry used KaZaA, and that he had tested and used
KaZaA and he was also familiar with the theory of the type of capture
software MediaSentry uses.

He was again asked about the 25 files at issue in the case that were
not downloaded. He again stated that all of the files are consistent,
and what they purported themselves to be.

On recross Dr. Jacobson was asked if KaZaA contained Malware. He
stated that it would be more accurate to say that it contained Adware.
He was asked if the MediaSentry computers had adware on them. He
stated that he has not investigated their computers beyond what
MediaSentry has told him, which is that they keep their computers
clean.

JoAn Cho

Ms. Cho of UMG Recordings testified similarly to Mr. Leak of Sony in
regards to the UMG songs that were at issue in the case. I won't go
into great detail about her direct examination, because it was
essentially identical to that of Mr. Leak. Nothing was said that was a
great deal different than what Mr. Leak said. She echoed Mr. Leak's
testimony that only 13 of the numberous sound files they owned that
were found in the shared folder were being pursued because they wanted
to pursue a reasonable number.

Defendant's co-counsel Matt Feinberg cross-examined Ms. Cho. He asked
about the Doe suit that was filed in Georgia to serve a subpoena on
Cox Communications and also asked if Cox had ever challenged the
methods used to obtain subscriber information. She testified that she
was not familar with whether or not Cox had challeged the methods. He
asked about the number of lawsuits that the recording companies had
filed, to which she said she couldn't give an exact number filed. She
was also asked about her other worked performed for UMG, such as being
involved in other cases. Mr. Feinberg attempted to ask her what made
the number of songs they chose to sue on reasonable, to which she
stated she was not involved in making the decision on the number to
pursue, but that it was done by others at her company. He asked if
part of the reason for the lawsuits was to teach a lesson, to which
she stated that it in part was and was in part to receive
compensation. She was asked about legitimate online sales at the time,
to which she specified a few services, as well as testified about the
pricing of individual tracks available on iTunes both previously and
currently.

On redirect she was asked about the purpose of the Doe suits, which
she stated was a method by which they use to obtain subscriber
information. She was also asked about chain of title and described the
process of proving chain of title through various corporate documents
about recording contracts, copyright registrations, and mergers and
acquisitions.

Stan Liebowitz

Dr. Liebowitz Economist from the University of Texas. He described his
career history as well as books and articles he had written before he
was admitted as an expert in Economics with no objection. The heart of
Dr. Liebowitz's testimony focused on the fact that record company
sales had increased from 1973 through 1999 before dropping, after
which they have dropped consistently. He testified as to his opinion
that file sharing was the reason for this drop in sales, supported by
his research as well as his analysis of many other reasons why sales
might drop of which his economic studies had revealed none. He also
testified that he could not show the economic effect of Joel in
specific, but stated that file sharing as a whole had resulted in
great harm to the industry.

Professor Nesson began his cross examination of Dr. Liebowitz asking
about his report that the fundamental problem was the erosion of
property rights brought about by file sharing. Dr. Liebowitz agreed.
Professor Nesson read a portion of Dr. Liebowitz's book from 2001
where he stated that it could not yet be seen what effect file sharing
would have on music sales. Dr. Liebowitz stated that he agreed with
every word that was read from his book, but stated that it was written
in 2001, and his further studies since that time showed that time more
data has become available which supplemented his opinion that file
sharing had great harm.

The hour hit five o'clock and Plaintiffs wished to finish with this
witness, but Professor Nesson stated that he had quite a bit to go and
Judge Gertner released the jury for the day. The cross examination of
Dr. Liebowitz will resume tomorrow morning.


Plaintiffs indicated that they have three witnesses remaining,
including Joel, plus two depositions to read in. They anticipate they
will finish their case tomorrow. Professor Nesson indicate that he
would be able to present his entire case on Friday. Judge Gertner
indicated that closing arguments will be immediately after testimony
is concluded.


posted by Marc W. Bourgeois @ 7/29/2009 08:25:00 PM