Day three witnesses in Sony v. Tenenbaum

BY MARC BOURGEOIS

Antonio Franko

Wednesday's first witness was Antonio Franko, a high school friend of Joels. He hasn't seen Joel for several years and was asked some basic questions, about his use of a computer in Joel's bedroom, and about Joel's music collection. In similar testimony to Mr. Chappel he stated that he'd used the computer but never to use KaZaA or download music, despite deposition testimony from Joel that he may have. He testified also that Joel had a good sized music collection, including some burned CDs.

Dr. Doug Jacobson

Most of the morning and a portion of the afternoon was testimony from Dr. Doug Jacobson, the Plaintiff's expert witness. He began by going over his qualifications and his curriculum vitae and was admitted as an expert with no objection from Plaintiffs. He explained that he was asked to produce a report for Plaintiffs about the MediaSentry data he reviewed in this case, and eventually to issue a supplemental report after examining a computer hard drive from Joel's Gateway computer.

He then began explaining how peer to peer networks work, and how KaZaA works specifically. After describing technical details about peers, supernodes, and IP addressing he moved on to the user experience of the KaZaA application. He explained that users search in KaZaA for files, then they can choose files from the results returned to begin the files downloading on to their computer. He explained that the users in the peer to peer network typically don't know each other, and only identify one another by their IP address. He was asked to explain some features of KaZaA 2.0, which he explained had an option to scan for files that you may wish to share with the KaZaA application, and that this was an option that would only occur after the user chose to run it. He was asked if KaZaA could be used to listen to music from other computers on the network. He explained that this could only happen if the music was first downloaded from the other computer.

Dr. Jacobson then testified about the report he prepared on the MediaSentry evidence. He testified that he had reviewed the MediaSentry information and formed the opinion that Joel Tenenbaum had used that computer, and that he had used it to copy and distribute copyrighted files. His opinion was based on the evidence that MediaSentry was able to start the download of 1000+ files and collect MetaData and successfully continue the download for a subset of these files. He examined the screenshots of the shared folder and stated that all of the files listed were available for distribution. He testified that the initiation process on all files serves the purpose of proving that the file does indeed exists, and gathers the meta data about the file for further evidence.

He then began to explain in more detail than Mr. Connelly some of the information contained on MediaSentry's data log. He explained the makeup of the request packets and response packets, including the source and destination IP address on the packets, as well as some of the header information such as the request of the file by its file hash, and the header fields showing KaZaA username and KaZaA IP address. He went into the most detail on a file where a request was sent several times without a response to sublimeguy14's computer before a response was recieved from a different user (nick_c). He explained the packets in this case showed that the file started downloading from someone else, but eventually finished downloading with a transfer from sublimeguy14's computer. He stated from all of his analysis that he had no doubts about the MediaSentry information and believed that sublimeguy14 was distributing the entire file with that hash code. He also stated his belief that all of the files were available for distribution based on MediaSentry being able to obtain the meta data for all of them.

He also testified as to a number of tracks about his belief that the files came from the internet and were not ripped, based on the meta data that MediaSentry was able to obtain. The format and completion of the meta data was not consistent among many of the files, making him form the opinion that they were not ripped by the same computer. He explained that if they were ripped the meta data would likely have been consistent from the same software performing the ripping on multiple tracks.

Dr. Jacobson was asked whether or not he believed a wireless router was involved in this case. He explained that in the case where a router was involved the X-KaZaA-IP: header field would differ from the source IP address of the data packet, with the former being a private IP address. He explained that this address was identical in all of the data packets from sublimeguy14's computer, which indicated there was no wireless router. He also pointed to the partial file received from nick_c which showed a 192.168.x.x IP address in the X-KaZaA-IP: header, which he explained meant that nick_c was using a router to connect his computer to the internet.

Mr. Reynolds asked Mr. Jacobson if he had any doubts or concerns about the accuracy or methodology of MediaSentry, to which he replied that he had none. He also testified that he had no concerns about hte data provided by Cox Communications.

He was asked about the concept of pollution, which he explained was a situation where a file name does not match what is in the content of the file. He testified that he had no basis to believe that pollution occurred in this case. His opinion is based upon the data lengths of the files matching those of legitimate versions, and having proper meta data. His opinion he stated was also supported by the finding that those files that were completely downloaded did match what their file names claimed that they were.

He was asked about the concept of IP spoofing, which he testified was difficult to perform on the public internet and that he had no reason to believe that it took place in this case.

After a brief break Dr. Jacobson then began testifying about his forensic examination of a hard drive from a Gateway computer that Joel owned. He testified that this computer was different than the computer that Joel had in 2004 in his bedroom, he stated that he performed his investigation about a month ago.

He explained his process of examining the hard drive, by recieving a forensics copy of the drive and using the EnCase software to examine it. He testified to several points he discovered during his examination:
* Windows had been reinstalled on the computer on 3/31/2009.
* There were two registry files which could not be opened, which he indicated was evidence that they were attempted to be deleted.
* The file sharing program LimeWire was on the machine, and he believed it to be operable.
* He found evidence of over 2700 music files in the C:\My Music folder which LimeWire was sharing, but that this folder itself had it some point been deleted.
* He was able to identify several songs that were once in the C:\My Music folder that were at issue in this case.
* He found several hundred exact matches to files in the C:\My Music folder that were being distributed by sublimeguy14@KaZaA
* He also found a My Music folder under Joel's My Documents folder, which contained a similar folder structure and many of the files that were removed from the C:\My Music folder.
* He had formed the opinion based on the inconsistent meta data in the files he found during the forensic examination that they were downloaded and distributed on the internet.

Upon cross examination Professor Nesson asked Dr. Jacobson was he was being paid for his work. He stated that his rate in these cases was $200 per hour, and that he had probably worked 40-50 hours on this case. He testified that he has probably prepared about 300 reports for the recording industry in these types of cases, but most of them did not involve a forensic examination. He estimated that his total earnings from his work for the recording industry to be in the range of $100,000 - $120,000.

He was asked if he had any relationship to MediaSentry. He stated that he did not have a relationship to MediaSentry, but he did discuss their data handling protocols with them. He admitted that he had never examined or tested their software. He was asked about the MediaSentry statement that their software had a zero-error rate. He stated that in the MediaSentry data that he had examined that he had never found any errors, but admitted that a zero-error rate that is something that is hard for software to achieve.

Dr. Jacobson was then asked why MediaSentry only downloaded 7 of the files they found in the shared folder. He stated that it would have been infeasible to download them all, because it would have taken a long period of time. He was asked that for the remainder of the files it would be impossible to know if they were the sound files they stated they were or not, because there was no underlying file. Dr. Jacobson agreed that an audio comparison could not be made, but that it was still his opinion that all of the remaining files were present for distribution.

Professor Nesson asked Dr. Jacobson that if a spoofed file was present in the directory if it would look the same as the other files from the meta data, to which he admitted that a spoofed copy could contain the correct meta data as well.

Professor Nesson then returned to asking Dr. Jacobson about a company he mentioned that he formed during his description of his credentials. He asked about the product, such as to whom it would be sold and what its purpose it was. Dr. Jacobson stated the market for the product was any customer that wanted to control peer to peer traffic on their network.

Dr. Jacobson was then asked about the InfraGuard group of which he is a member. He was asked in basic detail about what it was, and asked if copyright infringement had ever been discussed at an InfraGuard meeting. He stated could never recall his chapter discussing copyright infringement but that the chapters were each free to operate in their own way.

Testimony then broke for lunch, after which Dr. Jacobson resumed testifying. He was asked to describe the user friendly aspects of KaZaA, and he described the process of searching for a file and double clicking it to download. He asked what other active action needed to be taken to distribute the file, which he said there was none, it just happened after the download completed, the only active action was double clicking the file for the initial download.

Professor Nesson then proceeded along a line of questioning about the quality of music files found in the shared folder, and asked Dr. Jacobson to compare them to the quality of music that would be found on CDs. He stated that the MP3 files would be of lower quality, but that most people could not tell by simply listening. He conceded on further questioning that some people could likely discern the difference in quality between the two. He then began to ask if someone might download these lower quality files on the internet before purchasing the higher quality CDs in the stores, but his line of questioning was stopped based on sustained objections from Plaintiffs that this questioning was out of the scope of the direct examination.

Professor Nesson then asked some questions about pirate rip groups and asked if there was any malicious quality to the way these groups put out music. This question as well as others in a similar line of questioning were also stopped on sustained objections.

The examination then turned to the issue of the re-installation of the operating system that Dr. Jacobson testified about. Professor Nesson asked if htere was any evidence that the re-installation of the operating system was for any malicious purpose, or if there was any evidence that the number of music files was reduced after the operating system was re-installed. Dr. Jacobson answered in the negative to both of these questions. He was then asked about the two registry files that the EnCase software was unable to open. Dr. Jacobson previously testified that missing the data from these registry files made it impossible for him to determine some things about the configuration of the computer. Professor Nesson asked him more specifically about which registry files were unable to be opened. One was the NTUSER.dat file for the all users profile. Professor Nesson asked about this file and its relation to a NTUSER.dat file in the "joel" profile that was able to be opened, and asked if that meant he should be able to find information about Joel's user account and settings. Dr. Jacobson stated that what settings were stored in what location would depend on the way in which the software was installed, so he cannot tell for sure what exactly was in the registry file he was unable to open.

Professor Nesson's final question concerned Dr. Jacobson's report that 750 music files were added to the machine in October of 2007. He asked whether or not these files could have come from being added to the iTunes library if Joel had begun using iTunes at that time. Dr. Jacobson stated that he did not know if iTunes made a copy of files that were added to the library, or what method it used to make a copy if it did, so he could not say for certain.

Upon redirect Dr. Jacobson was asked about the report he prepared in this case. He stated that it was twelve pages long, with several hundred pages of attachments, and that it was quite lengthy for this type of report.

He was asked directly about his testing of MediaSentry software. He stated that MediaSentry used KaZaA, and that he had tested and used KaZaA and he was also familiar with the theory of the type of capture software MediaSentry uses.

He was again asked about the 25 files at issue in the case that were not downloaded. He again stated that all of the files are consistent, and what they purported themselves to be.

On recross Dr. Jacobson was asked if KaZaA contained Malware. He stated that it would be more accurate to say that it contained Adware. He was asked if the MediaSentry computers had adware on them. He stated that he has not investigated their computers beyond what MediaSentry has told him, which is that they keep their computers clean.


JoAn Cho

Ms. Cho of UMG Recordings testified similarly to Mr. Leak of Sony in regards to the UMG songs that were at issue in the case. I won't go into great detail about her direct examination, because it was essentially identical to that of Mr. Leak. Nothing was said that was a great deal different than what Mr. Leak said. She echoed Mr. Leak's testimony that only 13 of the numberous sound files they owned that were found in the shared folder were being pursued because they wanted to pursue a reasonable number.

Defendant's co-counsel Matt Feinberg cross-examined Ms. Cho. He asked about the Doe suit that was filed in Georgia to serve a subpoena on Cox Communications and also asked if Cox had ever challenged the methods used to obtain subscriber information. She testified that she was not familar with whether or not Cox had challeged the methods. He asked about the number of lawsuits that the recording companies had filed, to which she said she couldn't give an exact number filed. She was also asked about her other worked performed for UMG, such as being involved in other cases. Mr. Feinberg attempted to ask her what made the number of songs they chose to sue on reasonable, to which she stated she was not involved in making the decision on the number to pursue, but that it was done by others at her company. He asked if part of the reason for the lawsuits was to teach a lesson, to which she stated that it in part was and was in part to receive compensation. She was asked about legitimate online sales at the time, to which she specified a few services, as well as testified about the pricing of individual tracks available on iTunes both previously and currently.

On redirect she was asked about the purpose of the Doe suits, which she stated was a method by which they use to obtain subscriber information. She was also asked about chain of title and described the process of proving chain of title through various corporate documents about recording contracts, copyright registrations, and mergers and acquisitions.

Stan Liebowitz

Dr. Liebowitz Economist from the University of Texas. He described his career history as well as books and articles he had written before he was admitted as an expert in Economics with no objection. The heart of Dr. Liebowitz's testimony focused on the fact that record company sales had increased from 1973 through 1999 before dropping, after which they have dropped consistently. He testified as to his opinion that file sharing was the reason for this drop in sales, supported by his research as well as his analysis of many other reasons why sales might drop of which his economic studies had revealed none. He also testified that he could not show the economic effect of Joel in specific, but stated that file sharing as a whole had resulted in great harm to the industry.

Professor Nesson began his cross examination of Dr. Liebowitz asking about his report that the fundamental problem was the erosion of property rights brought about by file sharing. Dr. Liebowitz agreed. Professor Nesson read a portion of Dr. Liebowitz's book from 2001 where he stated that it could not yet be seen what effect file sharing would have on music sales. Dr. Liebowitz stated that he agreed with every word that was read from his book, but stated that it was written in 2001, and his further studies since that time showed that time more data has become available which supplemented his opinion that file sharing had great harm.

The hour hit five o'clock and Plaintiffs wished to finish with this witness, but Professor Nesson stated that he had quite a bit to go and Judge Gertner released the jury for the day. The cross examination of Dr. Liebowitz will resume tomorrow morning.


Plaintiffs indicated that they have three witnesses remaining, including Joel, plus two depositions to read in. They anticipate they will finish their case tomorrow. Professor Nesson indicate that he would be able to present his entire case on Friday. Judge Gertner indicated that closing arguments will be immediately after testimony is concluded.

Commentary & discussion:

joelfightsback.com