Wednesday, September 17, 2008

Plaintiffs move to voluntarily dismiss UMG Recordings v. Lindor without prejudice, seek 'discovery sanctions'

In UMG Recordings v. Lindor, the RIAA has made a motion to voluntarily dismiss its case without prejudice, and for "discovery sanctions" against defendant and her counsel.

Plaintiffs' memorandum of law in support of motion for voluntary dismissal without prejudice
Exhibits A to I
Exhibits J to Q
Exhibits R to V

Commentary & discussion:
Broadband Reports
Ars Technica
gulli (German)
Excess Copyright
Numerama (French) (Greek)
Punto Informatico (Italian)
The iPod Observer
Privacy Digest
Digital Media Wire
Paragon Forums
Heise Online (German)
WinFuture (German)
Computer Base (German)
Silicon Alley Insider
Computer World
YouTube Robot
Bluetack Internet Security Solutions
Internet Patrol
Blog for One
White Noise
CD-R (Czech)
Info World
Hollywood Reporter ESQ
Tynan on Tech
Daily Online Examiner
Quart (Hungarian)
Free Software Daily
Scholars & Rogues
Legal Blog Watch
IP Notiz (German)
PC World
Remixtures (Portugese)
THR, Esq

[Ed. note. Many supporters have asked how they can help financially. Anyone who wants to contribute to Ms. Lindor can do so here and click "Donate". Anyone who wants to contribute to the Expert Witness Defense Fund, which helps people like Ms. Lindor with hiring experts and tech consultants can do so here. Anyone who wants to contribute to me, to help me with the work I do in my blogging and getting the word out, can do so here, clicking the "Donate" button. Another way to help out my blog is to make purchases of goods or services through the affiliate ads I post on the blog. If there are any merchants, products, or services not represented there which you would make a purchase from, let me know by posting a comment to this post, and I'll try to get affiliate ads posted for them. Thanks to all for the tremendous outpouring of support. -R.B.]

Keywords: lawyer digital copyright law online internet law legal download upload peer to peer p2p file sharing filesharing music movies indie independent label freeculture creative commons pop/rock artists riaa independent mp3 cd favorite songs intellectual property portable music player

To contribute to Marie Lindor's legal defense, see below.

The above donation button links to a PayPal account established by Marie Lindor's family for people who may wish to make financial contributions to Ms. Lindor's legal defense in UMG v. Lindor. Contributions are not tax deductible.


Igor said...

As far as I know Wright was never served with a law suit and thus not required to preserve any computer...or am I missing something?

Ben said...

The degree of personal vitreol directed at Ray in these papers is ridiculous. But one thing that goes beyond ridiculous and should get any sane judge to throw the book at these people is the assertion that he can sanction you for writing a blog.
They want Noerr-Penington privileges for themselves when they don't apply but can't seem to understand that this blog is exactly the kind of speech and activity the first amendment actually protects.
I can't wait to read your reply brief on this.

Anonymous said...

The RIAA is pushing another lie again.

Remember, because a Routable IP address was found on the computer, their expert claimed that the computer had to be connected directly, and not thru a router.

Now, there is a claim that there was 2 computers hooked up at the time in question, and therefore if that statement is true, what about your own expert claiming there was no router.

So, RIAA, which is it? If you now want to go with the 2 computers, and we did not get to check the second one theory, there is a couple of problems with your expert, who has already stated there was only one.

And RIAA, remember this: If there was 2 computers (and of course a router to make this all work), the router used could have been a wireless one and most likely would have been shipped by the maker in wide open mode. This means the original defense theory that someone shared her internet connecton via wireless could be true.

The username matching her last name means nothing. A neighbor sharing her connection might also know her last name and registered it as a P2P username to cover themselves.

Clearly RIAA's expert does not understand that Windows XP only stores the last IP used. That only proves the condition of the machine right before it was examined, and more importantly DOES NOT prove the condition of the machine, or what IP address was being used at the time they allege their files were being shared.


usagemayvary said...

wow ray, they already cite you, go figure.

Also, why are they citing the MGM vs Grokster case for inducement? Please correct me if I am wrong, but haven't other cases and judges already stated that inducement is not sufficient for a claim?

Unknown said...

This does not boad well.

I hope ray has some good legalese to answer their well polished shovel fulls.

Anonymous said...

When there is a contradiction in testimony, why is one side automatically deemed true and correct, while the other side is deemed false and misleading? Who is able to make the judgment of truth and falsity in a case of He Said, She Said? The RIAA Plaintiffs have clearly picked one side over the other, but does that make them right?

Also, as has already been pointed out, what requirement was Ms. Raymond-Wright under to preserve any "critical computer"? She has never been sued in this action.

And who is the arbitrator of whether or not deposition subpoenas were "intentionally" evaded? And what is the legal requirement to make one's self available to accept hostile service?

To this man, the RIAA Plaintiffs have triaged and parsed all the evidence so far, keeping what they feel strengthens their arguments, and outright dismissing everything that doesn't – and we're supposed to accept their version of things as the only right and true version despite no evidence to support their unproven allegations.

And why should this Defendant, who never owned or disposed of the now "critical computer" in the first place, which may have never had any evidence of anything on it, be punished, along with her counsel " or their intentional misconduct and to discourage others from engaging in similar behavior."?

And because the Plaintiffs now admit they have no case left "...because of the severe and irreparable harm Defendant, her family, and her counsel have caused to Plaintiffs’ case," why should they be allowed to dismiss without prejudice? The case should be dismissed With Prejudice since it can no longer be proven according to the Plaintiffs themselves.

Further Plaintiff lies and misstatements include:

Plaintiffs Discovered Substantial Copyright Infringement Through Defendant’s
Internet Account.
They never proved that it was the Defendant's Internet account. Misidentification of ISP accountholders is well known by now, especially when the RIAA submits IP/time-stamp information that matches no valid account at all, and the RIAA's methods are not at all proven to be error-free.

On August 7, 2004, MediaSentry, a third-party retained by Plaintiffs, detected an Individual. Come on now! It's long known that no "individual" was ever detected. In fact, if an "individual" was detected, why wasn't that "individual" sued from the beginning?

Plaintiffs made it clear from the beginning that they were seeking information central to their infringement claim and that Defendant had an obligation to preserve such evidence and to provide it to Plaintiffs. Just where and how far does this "obligation" extend? Is it a legal obligation? When does it start? Who does it cover? And just because the Plaintiffs say so, does that really make it so?

Defendant, her family, and her counsel intentionally provided false information, attempted to misdirect Plaintiffs as to relevant facts and events, and concealed critical information and evidence regarding the infringement at issue, all of which severely prejudiced Plaintiffs. Plaintiffs claim lies and concealment, as though Defendants have perfect memories and perfect records.

Plaintiffs were then forced to debunk this claim, too, and ultimately confirmed the
infringement did not occur through a wireless Internet connection as Defendant claimed.
And how was this "debunked"? Certainly not through a forensic examination of a hard drive? Plaintiffs now are contending that they have never seen the "critical computer" that performed the infringement, so how do they know what was connected to what? Answer: They Don't!

When Plaintiffs were finally able to inspect Defendant’s computer, however, they found a copy of Gustave Lindor, Jr.’s resume on the hard drive. And why are they allowed to read personal resumes off of a computer when they were ostensibly looking for illegally shared music? Is this even admissible?

Specifically, Ms. Raymond-Wright regularly brought her laptop to Defendant’s house during the summer of 2004 (id. at p. 65, line 18 – p. 66, line 20; p. 80, lines 8-10) and connected her laptop to Defendant’s Internet account using a wireless router. Excuse me, but now there IS a wireless router in the house? I thought that was debunked up above. What goes with these Plaintiffs anyway? Do they think that the judge has ADHD and won't remember what they claimed just a few pages earlier?

Because the infringement at issue did not occur through a wireless Internet connection, Plaintiffs do not believe the laptop was used to infringe Plaintiffs’ copyrights. How can Plaintiffs state with any certainty that the infringement detected from somewhere didn't involve a wireless Internet connection? This man doesn't believe they actually can prove this from the far end of the wire.

The best proof of whether she did so would be to examine her computer’s hard drive which would show, among other things, the existence of any P2P file-sharing programs and the presence of plaintiffs’ copyrighted sound recordings. Unfortunately, that #1357702 v3 den 15 information is now largely gone and permanently irretrievable. Plaintiffs are left to prove their case with the scant and piecemeal evidence remaining. By destroying the best evidence relating to the central issue in the case, defendant has inflicted the ultimate prejudice upon plaintiffs. This is not the "best" proof. It is the "only" proof, and the Plaintiffs have no case. And it's not even the only proof since P2P filesharing programs don't log transfers and don't indicate if the file of a given name now on the hard drive is the same file of that name that was there several years ago.

Defendant and her family’s misconduct undermines the administration of justice. Pot, meet Kettle!

forced Plaintiffs to seek the Court’s assistance on numerous occasions to obtain routine discovery. What this man has seen in following these cases is that the Plaintiffs have resisted discovery at every turn themselves. See previous paragraph for pithy, concise analysis of Plaintiff tactics.

Defendant’s counsel should be sanctioned for forcing Plaintiffs to take many unnecessary steps to obtain basic information, for making misleading statements, and for making baseless discovery objections and frivolous motions which he posted on his anti-recording industry blog. Ah, the real problem finally surfaces. Posting these motions on a blog warrants a half million dollars in sanctions. Good by free speech and open justice!

Similarly, Defendant’s counsel filed frivolous motions seeking, among other things, to preclude evidence (Doc. No. 69), to exclude Plaintiffs’ expert’s testimony. Plaintiffs have no "expert" testimony. Only hearsay, since they fought the reasonable requests to compel production of a proprietary contract with MediaSentry.

Defendant, her counsel, or both should be ordered to pay monetary sanctions to Plaintiffs because their misconduct demeaned the integrity of the judicial process and unnecessarily prolonged and increased the cost of this lawsuit. If we can't get the money one way we'll get it another way. And if we can destroy the ability of Defendants to gain talented and experienced representation in the process that's all to the good as well. And this is nothing more than an attempt to destroy all who oppose the RIAA.

would be ineffective as the critical evidence has now been destroyed. Boy this is a whopper! It insists that the critical evidence actually existed in the first place. Now that takes a Coleridgian suspension of disbelief to create something out of nothing!

Plaintiffs are requesting to dismiss this action without prejudice because, to date, they have insufficient information to determine who is the direct infringer. Oh, but didn't MediaSentry identify the individual?

While there is so much more that is so very wrong with the RIAA's view of the world one has to stop somewhere. This man sees so many questions, and no answers at all, in this RIAA Plaintiff filing.

The one thing that stands out from all of the is that: The RIAA Plaintiffs did not at the time they filed their suit, or any time afterwards, ever have the evidence necessary to prove their case. As such this was all a fishing expedition and they should have never been allowed to file it in the first place.

{The Common Man Speaking}

Jadeic said...

Insane though this may sound . the RIAA stance is drawing ever closer to demands that the minute you receive any inkling that you may be served for copyright infringement you not only need to mothball your own computer but quarantine all neighbours' computer hardware within a quarter mile radius and make damned sure that you have meticulously maintained your log of all licence plates for vehicles parked outside your house over the previous 12 months: those evil wireless piggy-backers are everywhere. Failure to do so is spoliation at best or at the very worst 'The Destruction Of Critical Evidence' which has 'Severely And Irreparably Prejudiced Plaintiffs And Undermined The Judicial Process' - it looks even scarier with capitals.


Anonymous said...

Odd question, and it may not matter, but why does the first page of the memorandum of law list Richard L. Gabriel and Richard J. Guida?

Anonymous said...

Wow, I thought making RIAA Richard a judge was a travesty, but I figured it would at least mean the RIAA would calm down and be more rational. No such luck.

The RIAA must be going for some sort of Hubris Award. The idea of a company that has filed 30,000 or more sham lawsuits, even going so far as to sue dead people, the idea of them calling Ray Beckerman a "vexatious litigant" is stunning in the extreme. It is "gumption" in 30,000 point type. It it is "The Big Lie," one so stupendous they, one assumes, hope to get away with it based on sheer audacity.

I imaging that the RIAA considers all defense lawyers fighting RIAA lawsuits to be vexatious by definition, since to oppose the RIAA, in their minds, is to oppose the side that is always right, and it is, to them, un-reasonable to resist them at any level.

I hope this action receives the short shrift it deserves.

Anonymous said...

That motion is something else, Ray.

They are treading some mighty thin ice with the attack on this blog's coverage.

How can bringing transparency to the litigation process possibly be "vexatious" or "demeaning" to the "integrity of these judicial proceedings"? These are civil actions, not under seal.

They actually believe that pointing people to online resources that tell the other side of the story is somehow tampering with the purity of the legal process. If nothing else, there needs to be a counterbalance to the FAQs on their online settlement site.

I look forward to your opposition.

Lisa Borodkin

Anonymous said...

Plaintiffs assert that Defendant and family intentionally give misleading or false information.

1. When she got internet service. Innocent mistake?
2. Wireless router. Evidence needs evaluation in court.
3. Junior Lindor. Plaintiffs claim Defendant had contact "the entire time" with Junior Lindor, but the only supporting evidence shows that Defendant had contact with Junior for a few days.
4. Hiding a second hard drive. Don't Plaintiffs believe someone in Defendant's family used the second hard drive? Does not implicate Defendant.
5. RW's changes. The big question in this case, as Ray has said many times, is whether Defendant downloaded and/or shared copyrighted music. Similarly, everything in this motion that deals with people other than Defendant and counsel is moot. Exercise for reader: in this motion, cross out all sentences and depending sentences that involve people other than Defendant and counsel.


Anonymous said...

Well, I for one agree with everything TCMS says above. It looks like you finally backed them against a wall while playing their game. Good for you Ray! At least morally you know you beat them. Legally, well that looks like that could be another story with their sanctions they want to railroad you and every other defense lawyer with.

Best of luck with your response Ray. Hopefully you can get the judge to see the legal shenanigans/double speak the RIAA is trying to pull.

Unknown said...

Because the infringement at issue did not occur through a wireless Internet connection, Plaintiffs do not believe the laptop was used to infringe Plaintiffs’ copyrights. How can Plaintiffs state with any certainty that the infringement detected from somewhere didn't involve a wireless Internet connection? This man doesn't believe they actually can prove this from the far end of the wire.

You can't reliably prove this at all, without access to the router. An IP address is an IP address. Actually, if she had a router installed between her cablemodem and the rest of her network (a likely scenario) or if she happened to have fios (which I doubt) The outword facing IP adress would only point to the router. All the internal ip addresses would be 192.168.1.x(most likely) and only the routers would know who had a wireless connection and who was plugged in directly. Additionally, home based routers, if they even have logs, don't keep them for very long.

Their technical claims are pretty much contradictory and a joke, though TCM did a nice job of pointing that out.

Anonymous said...

Well at least we see the RIAA's true colors when you back them against a wall like you did Ray. Their motion reminds me of someone who gets so mad when they are losing that they spout off anything and everything they can to try and get some "perceived" justice but in the end wind up looking like more of a fool.

Hopefully you can make the judge understand all of the RIAA's inconsistencies (read "lies") that TCMS brought up when you file your reply.

Best of luck to you Ray!

Anonymous said...

"Now, there is a claim that there was 2 computers hooked up at the time in question, and therefore if that statement is true, what about your own expert claiming there was no router."

Switch or hub would work that way. Sorry, I'm all for Ray, but that is something the RIAA is likely aware of.

Unknown said...

Ray, this is nothing more than a message of support and appreciation. You are the "voice crying in the wilderness" on this issue, and your actions are appreciated by many.
Anne Madison

Unknown said...

Switch or hub would work that way. Sorry, I'm all for Ray, but that is something the RIAA is likely aware of.

This is true. Except for 1 ittybitty problem. Switches and Hubs do not allocate IP Addresses.

So, if her account from her Service Provider has 1 IP address, going directly into a cable modem. If she used a switch or hub to connect the other machines, then only one of those machines would be able to connect to the internet at any 1 given time. Hubs and Switches allow you to share bandwidth, but do not have any ability to ROUTE packets out of the internal network that's been created.

In order for 2 machines to be on the 'internet' at the sametime, using the same external IP address, there HAS to be a router (even if said router is a linux box with iptables and 2 network cards.)

internet -> wall -> router -> internal network

Some cablemodems are also routers, though many are not. Small wireless routers, that do mac address cloning are easy to setup, but then there would be a router.

You cannot maintain that there was no router, and that there were 2 computers sharing a network connection.

raybeckerman said...

Hi folks, appreciate the support. I just posted this on Slashdot. said...

Hey Ray,

Did a write up about this on our site as well, would appreciate a link back.

The article:


raybeckerman said...

Ryan, this has been getting a lot of press, but I must say yours is my favorite....


Matt Fitzpatrick said...

"What is the sound of one hand SLAPPing?"

My psychic blog hotline predicts this blog will soon publish a defendant cross-motion for costs & fees upon voluntary dismissal #2 of the same copyright case (assuming Lindor was sued as a Doe).

It will be published not because Ray Beckerman is vindictive, and not because he wants to embarrass anyone, and certainly not because it is somehow baseless or improper for a prevailing copyright defendant to ask for costs & fees. It will be published because he's defending the interests of his client, and pooling his experience and expertise with the many other advocates in many other *AA cases doing the same.

What's this really about? The fewer people who know about the nature and sheer scale of the *AAs' pattern of litigation, the easier it will be for the *AAs to continue to game the system. I know this doesn't fall under the strict legal definition of a SLAPP, but the strategic similarities are striking, and I expect the response, as well, will be similar.

Anonymous said...


I went back and reviewed "how" the expert claimed that no router was used.

It seems that within the data packets transmitted by the P2P program, are the address of the transmitting machine. Since the address found in this packet was a routable IP, and NOT a 192.168.x.x one, the "expert" claimed that no router was used.

Since there is a packet log of at least some of the communication between MS and whatever machine was at the other end, this fact (Routable IP in data packet) is something MS could have observed.

However, there is no basis to conclude from the fact observed (Routable IP in data packet) ANYTHING about the use of a router.

Yes, the presence of a routable IP where it was observed could mean no router was used. However, it could also mean that a router was used.

Since either is possible, the fact observed can not standing alone be used to make any statement about the use of or non-use of a router to any degree of scientific certainty.

If a router WAS in use, one of the machines connected to this router would have the option to use the outside IP address by using the DMZ mode of almost any router sold. The machine using this mode could have been connected either by wire, or wirelessly.

A person who is using someone elses wireless router might actually choose to use this mode in order to hide their connection. This is because generally on most routers, the DMZ connected machine is NOT shown in the list of connected machines. If the router was installed in default mode, it is highly possible it either had no password, or the default one, which can easily be found on the internet.

In short, without further evidence, the RIAA can never know if a router was in use, or if the machine that was observed belonged to the Defendant, Defendant's family, or for that matter ANYONE within range of their installed wireless access point. And of course this assumes they actually were able to identify the correct person, as they have sent requests for information about persons "observed" on unused IP addresses!!


Unknown said...


A routable IP address. If this is true, that does potentially indicate there was no router. Although, not conclusively. But, this hurts their case even more. If there was no router, that means that the infringing PC /has/ to be connected to her cable modem directly. That's really cumbersome with sharing between 2 different pc's. Also, they claim the laptop was connected wirelessly. Wait, that just doesn't make any sense. Laptop cannot be the infringer because it was connected wirelessly, but htere was no router?
That doesn't make ANY sense.
There /has/ to be a router for the laptop to have been connected wirelessly.

I'm actually starting to wonder if the Kazaa packets actually DO keep the originating non-routable ip address, or if that information gets lost when the packet goes through the router, and replaced by the routable IP address from the router.

There is /1/ way this might work. I had this setup back in the learly 2000's. I had a cablemodem, connected to a hub, and my service provider gave me 2 ip addresses. For that brief time, I had 2 routable ip addresses. But, this would be very easy for Ray to disprove, given as you had to pay extra for extra IP addresses.

Anonymous said...

This talk about being able to identify the number of computers hooked up, or whether a router is used or not is just plain silly. If you could easily figure this out, all the phone tech-support people working for the ISPs wouldn't have to ask that age-old "Are you connected through a router?" question off their reading cards. The easiest way to disprove their claims (though may be costly) is to hook up various LAN setups to the internet and ask the RIAA's so-called expert to identify the number of computers connected to the internet per IP, and whether a router is used or not in each setup. I'm willing to bet my life-savings that the expert cannot accurately provide this information without hacking into the network (Which would raise a whole bunch of other questions)


Anonymous said...

To Mr. Beckerman,

Reading this post, the song "I'll Sue Ya!" by "Weird Al" Yankovic comes to mind. Since I started reading your blog last September, I've been enlightened to a side of the story nobody else knows about, yet desperately need to be informed over. The tactics of the RIAA have crawled over here to South-East Asia, in the form of a company called Odex (which deals with Japanese animation). They have had the audacity to claim entitlement to settlements, going so far as to call them "far from amounting to extortion" and "a sensible way of redressing wrongs and grievances". Had I not read through your blog and become informed about these issues I likely would have swallowed their nonsense at face value.

Months ago, I was privileged to share with a group of acquaintances on such issues, and one of them, currently a law student, was absolutely disgusted and appalled by the RIAA's tactics. It just goes to show how little of the victims and the true story we hear about, which would not have been possible had it not been for good folk like you, bringing these truths to light at, as we now see, great personal risk.

Keep up the good fight, Mr. Beckerman! There's people watching on this side of the world, too!

-- DTS (Download This Song, by MC Lars (2005)) said...

Thanks Ray!
It was fun writing that post as well as taking that "secret photo" of you ;)

Looks like the RIAA are never going to learn, just like when they try to (unsuccessfully) shut down a torrent site, that sites traffic skyrockets I think its going to have the same effect here.
The next innocent person who gets one of these sham settlement letters is going to go on the net and type something like "RIAA innocent lawyer" and get the other side of the story as well as learn what big bas...oops, forgot,sorry, will keep it clean :)... cheats the RIAA are and how their 'proof' is just an illusion.
Plus any up-coming lawyer should be able to find a LOT of material and advise here as well.

All thanks to the RIAA! So, after you kick their behinds in court... do send them a thank you note for helping you get more attention and spreading the word!!


Anonymous said...

Albert (or anyone),

What happens when you connect a computer with a static IP address to a NATting router that may, or may not, have DHCP enabled? Will the router refuse to pass through packets not of the form, will it pass those packets through unaltered (as opposed to NATted), or will it do something else?

Even when a home user has a router they may not have configured their computer properly to use the NAT feature of the router. And as long as the computer connects to the Internet they won't bother to mess with it.

Note that cable modems, among other devices, accept any address on the back (user) end and translate them to the cable modem's routable IP address. They're not particular about what they're handed, which is why routers are easily configurable to mimic the computer connected's address.

(In the early days you needed your router to be able to mimic the routable address assigned to your single computer by your cable company because in those early days cable companies had the Insane idea that you should only be allowed to connect one computer to your Internet connection unless you paid them lots more money. In order to prevent the cable company from realizing that a router was in use -- take especial note here Ray that NATing routers cannot be detected even directly by the ISP -- the router manufacturers make it easily possible for your router to present the IP address the cable company had assigned your single computer to prevent this detection. Only years later did the cable companies give into the obvious, and the desire for people to connect wirelessly with their notebook computers, and decide that routers would be allowed without paying gobs of extra money. Historical note: they also tried to prohibit VPN's on home connections, although a VPN is nothing more than data bits to the connection, just like any other use of your Paid For broadband connection.)


Anonymous said...

"Now, there is a claim that there was 2 computers hooked up at the time in question, and therefore if that statement is true, what about your own expert claiming there was no router."

"Switch or hub would work that way. Sorry, I'm all for Ray, but that is something the RIAA is likely aware of."

Correct me if I'm wrong, but it's impossible to use a switch or a hub without a NAT to connect multiple computers to a single internet connection (without owning a block of IP addresses like universities or large companies). Those only work on LANs or behind another NAT.

Justin Olbrantz (Quantam)

Anonymous said...


Ive done some checking as to what kind of Modems/Routers are issued to Verizon customers. Since I do not know if they are former BellAtlantic or Former GTE area, I checked both.

Most of the "Modems" given out the the customers of Verizon (both portions) are actually Modem and Routers in one. Units like the Zytel and Actiontec are examples of combination units. The Actiontec unit given out often also has wireless built in as well.

Now as to your question, if the customer had a static IP, and manually assigned it to their computer, and connected it to one of the typical units issued by Verizon, it would automatically route the packets generated by that computer using the DMZ mode. This assumes a static ip set on the workstation that exactly matches the ISP assigned Routable IP, or at least an IP in the same subnet as the Routable IP.

If it is set to something else, it will not work, UNLESS it is in the 192.168.x.x subnet of the device. A static address outside the DHCP area, of the assigned 192.168.x.x will also work, as will a static address within the DHCP area, but in that case you risk having 2 devices assigned to the same ip.

KaZaA places the IP address of the computer running the program in a certain field of the data area of the packets. Routers running NAT do NOT touch the data area at all, except for some limited support for FTP, which contains the IP and Port in the Control connection. Thus, if the routable IP was in the data packet, it was either running DMZ or directly connected to the modem when set in bridge mode. Since both parts of Verizon uses PPPoE or PPPoA, they would also have to be running a PPPoE client on that computer as well for it to be directly connected, an unlikely configuration with the simple instructions provided by the telco.

Since the majority of this Telco supplied "modems" are also routers, odds are the computer was NOT directly connected, but connected by DMZ, but this is just a guess based on the percentage of a given companies supplied equipment. Not even the ISP can tell exactly what was connected, they might be able to guess based on MAC address, but this is also settable in most units, or the unit automatically clones the first machines's MAC onto the output. This is done because Cable Modems are often tied to MAC addresses, and the software used by Cable and DSL devices in the modems are often shared. The MAC address is what is cloned, NOT the IP address. This is because in the cable modem enviroment, all the modems in a given segment are connected in effect to the same LAN, and the MAC address is what is used for access control.

Most current cable modems are NOT routers, and latch onto the first MAC address seen upon power up, and will not route anything else.

A "moocher" will often use the DMZ mode, as 1) they get full in and out access to the outside IP and 2) Most units do not show the DMZ machine in the connection list.

As to the question from Justin Olbrantz, about using a switch/hub, because most of the "modems" supplied are actually a router as well, this configuration WILL work. This happens because the DHCP server built into the unit assigns a different 192.168.x.x address for each computer, and each computer uses its unique private network address to operate. All the switch/hub does is adapt the single ethernet connection on the device to more than one computer.

Strictly speaking, another possibility does exist. Internet Connection Sharing could be running on the single machine with the IP address, IF that machine has more than one network card. However if the drive was examined, this would have been detected in the Registry.


Justin Olbrantz (Quantam) said...

"As to the question from Justin Olbrantz, about using a switch/hub, because most of the "modems" supplied are actually a router as well, this configuration WILL work...All the switch/hub does is adapt the single ethernet connection on the device to more than one computer."

Right. A hub or switch (to my knowledge) can only be used in a LAN or behind a NAT. In the case you describe, the NAT is integrated with the modem+router.

As for the rest of that post, nice detective work.

Jadeic said...

"However if the drive was examined, this would have been detected in the Registry."

Perhaps this should read 'this should have been detected in the Registry'. Do not assume that, despite his credentials, Dr Doug Jacobson PhD CFCE actually knows what he is looking for.


Anonymous said...


I agree with you about the expert. He may know a bit about the theory, but seems to be lacking in knowledge about what is actually used in the real world.

The Plaintiffs could have asked Verizon to tell them exactly what CPE equipment (if any) was supplied by them for this DSL connection. However I wonder if they really want to ignore that answer.

The reason I say that is other than Embarq (The old Sprint Local Telephone), the trend for some years is to get rid of DSL only modems and connection means other than ethernet, and go to combined modem/routers that can automatically take care of the PPPoE/PPPoA connection to their broadband gateway automatically without much technical help. This is because the support costs greatly outweigh the increased cost of issuing more advanced equipment. This allows 1 plug to the computer (or wireless connection), and simple DSL filters which allow 95% of their customers to connect their device to broadband without any real technical experence. AT&T has even gone to software that is installed from their setup website that can automatically set the username and password, without having to even ever log into the router. These routers are shipped with an initial limited login name which is replaced by the customers actual login name during the online setup process.

And since I brought up Embarq, they use DHCP on both the WAN and LAN side of the supplied modem/router so in their case there is ZERO setup other than the DSL filters....

Im sure Ray already knows what brand and model of equipment was used, and odds are it is NOT a stand alone modem. This means that the only reasonable explanation if the expert is not mistaken about the Routable IP, or for that matter the IP itself, is that someone else OTHER than the defendant hooked up to this network, very likely by wireless means and put their computer into the DMZ.

The Defendant is not technical, so it is very unlikely she did it, since like 99% of their customers, she is not going to know what DMZ is, or why she might want to use it. It is NOT her fault if anyone else used it, regardless if they were family or friends or neighbors or strangers......

They have NOT proven their case against the DEFENDANT, who is the ONLY person on trial here. Thus they need to LOSE. SO WHAT if her family might have been involved, as they are NOT defendants in this case.

I agree with a comment that suggested crossing all words not refering to the defendant out of their motion. I suggest if this were done I doubt very little would be left other than the caption and the footer.