Cage 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page1iofi11 Page ID #:2/88
Oo ~~) BD Un BP WO NO KH CO BO BAN BDA FW NY YF CO
oO Oo ~ HDR Ur BR WH NO
INGENUITY 13 LLC, | Case No. 2:12-cv-08333-ODW-JC
JOHN DOE, 6662; and 2:12-cv-6668
Case No. 2:12-cv- ~ DECLARATION OF SETH SCHOEN 08333-ODW-JC
Morgan E. Pietz, Esq. (SBN 260629) THE PIETZ LAW FIRM
3770 Highland Avenue Suite 206 Manhattan Beach, CA 90266
Tel: 310-424-5557
Fax: 310-546-5301
Email: mpietz@pietzlawfirm.com
Nicholas R Ranallo
NICHOLAS RANALLO LAW OFFICES 371 Dogwood Way
Boulder Creek, CA 95006
Tel: 831-703-4011
Fax: 831-533-5073
Email: nick@ranallolawoffice.com
Attorneys for Putative John Doe in 2:12- cv-08333-ODW-JC
UNITED STATES DISTRICT COURT FOR THE CENTRAL DISTRICT OF CALIFORNIA
Plaintiff, DECLARATION OF SETH SCHOEN
Vv. Case Consolidated with Case Nos.: 2:12-cv-6636; 2:12-cv-6669; 2:12-cv-
Defendant. Case Assigned to: District Judge Otis D Wright, II
| Discovery Referred to: Magistrate Judge Jacqueline Chooljian
) Complaint Filed: September 27, 2012 Trial Date: None set
wo WH vw HY Re LY LV & =| || Se EF Te], lhmm..hlUlUUlUre Oo aA nA BwWNH KF OO WON DN FWY YF ©
0 Oo NHN DA Wn BP W NY
Be 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 2of11 Page ID #:2/89
DECLARATION OF SETH SCHOEN I, Seth Schoen, declare and state as follows:
l. Lam a Senior Staff Technologist with the Electronic Frontier Foundation (EFF). I am over eighteen years of age. I make this declaration on my own personal knowledge and if called upon to testify thereto, I could and would competently do so.
2. I have worked with computers and computer networks for over a decade. I have published two peer-reviewed academic papers in the field of computer security, and been interviewed about computer networking and computer security in the national news media. I have testified about electronic communications systems in three courts and before the United States Sentencing Commission, and have
submitted expert testimony concerning the analysis of BitTorrent file-sharing
| networks to the federal courts in at least fifteen other matters.
3. I was requested by Morgan Pietz, counsel for a putative J ohn Doe in the above-captioned action, to research and provide an objective response to several statements made in the Declaration of Joshua Chin in Support of Response to Order to Show Cause, which was filed on April 8, 2013, and to factual assertions in the
oppositions to the Order to Show Cause. Specifically, I was asked to research and
| respond to these issues:
a. Whether the protocol described by Peter Hansmeier in his declaration in the above-captioned case is a reasonably accurate means of identifying
the Internet Protocol (IP) addresses of computers involved in file-sharing using the
| BitTorrent protocol.
b. | Whether an incomplete download of a video file using BitTorrent results in the downloader having a viewable copy of the file. C. What the metadata associated with the documents filed by the
plaintiffs in this action reveal about who was involved in their drafting.
J
i jj‘‘i‘i§‘£g‘ig | gt
Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Cag
)
Oo co ~ITI NA Wn Bh WW NO
bro NO ND ND ND NN WN WN NN FH FF FF FT FH FS SF PE hl Eh lS co ~~) OO wm BR WH NO KK CO UO DBA BD A HP WW VY FS OO
e@ 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 3o0f11 Page ID 90
4, In forming these opinions, I relied upon the Declarations of Peter
Hansmeier filed in the above-captioned case (ECF No. 8-1) and in case 2:12-06662-
| ODW (ECF No. 6-1); Brett L. Gibbs’ Response to the Order to Show Cause in the
above-captioned case (ECF No. 49); the Declaration of Joshua Chin in Support of Response to Order to Show Cause (ECF No. 108-1); the pleadings, declarations, and exhibits filed in connection with the Court’s February 7, 2013 Order to Show Cause; certain other pleadings filed in the above-captioned case and in the related cases, all - of which were electronically filed on the CM/ECF system by Brett Gibbs’ CM/ECF account and are identified below; and the authorities I cite below.
The Accuracy of Plaintiff’s Means of Identifying IP Addresses
a: While the Hansmeier Declaration purports to describe the method by which the Plaintiffs in these consolidated cases identify the IP addresses of copyright
infringers, the declarations omit information that I believe is material to a
| determination of whether that method is reasonably accurate,
6. For example, Mr. Hansmeier states that his software records the
| “percent of the file downloaded by [his firm]’s software from the infringer’s
| computer” (Hansmeier Decl. at 20), but also that his firm’s software “does not [...]
allow me to [...] communicate with [the infringer’s] computer in any way”
(Hansmeier Decl. at 21). It is thus unclear whether or to what extent the software
| downloaded portions of the file from individual defendants, and Mr. Hansmeier did
| not file this information with the Court, although he states that he has it on file
(Hansmeier Decl. at 26). Similarly, it is unclear to what extent Mr. Hansmeier's software relied on information obtained from third-party BitTorrent trackers (which facilitate downloads) as opposed to information obtained by direct observation of and communication with defendants’ computers.
i. These omitted details could be important because simple methods of attempting to locate copyright infringers can easily go awry. For example, in 2008,
researchers from the University of Washington found that, given then-prevalent 2
Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Ca
Be 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 4of11 Page ID | #:2791
L | methods for investigating BitTorrent transfers, it was straightforward to frame 2 | particular IP addresses for downloading files that they had not, in fact, ever . attempted to download. The researchers experimentally framed their own laser =| printer and succeeded in eliciting false allegations of copyright infringement against > | it. See Michael Piatek, Tadayoshi Kohno, and Arvind Krishnamurthy, “Challenges : and Directions for Monitoring P2P File Sharing Networks, or, Why My Printer 7 | Received a DMCA Takedown Notice,” in Proceedings of the 3rd USENIX Workshop : on Hot Topics in Security, July 29, 2008, available at ? http://www.usenix.org/event/hotsec08/tech/ full papers/piatek/piatek.pdf. 8. I do not mean to suggest that Mr. Hansmeier is unable to gather or did LT not gather relevant information to support Plaintiff's allegations, including by Me techniques that avoid the pitfalls described by Piatek et al. However, paragraphs 20, Sy 25, and 26 of his declaration indicate that he filed with the Court only a small a summary portion of the information that he gathered. In paragraph 27, Mr. !5 | Hansmeier says he “personally observed” infringing transmissions; his statement that 16 | his firm's software does not “communicate” with Defendants’ computers leaves 17 | some ambiguity about the exact nature of this observation. ” 9. Without more information about how Plaintiff gathers IP addresses and ee attribute infringing activity to them, it is my opinion that an investigation like 20 | plaintiffs could result in the identification of IP addresses of computers that were | not actually participating in infringing filesharing activity, or that had not been 22 | directly confirmed to have done so. 23 The Usability of Partial Downloads 24 | 10. BitTorrent divides each file into “pieces,” which are subregions of the file that are downloaded independently of one another. When a BitTorrent user ee begins downloading a file, the BitTorrent client software receives pieces of the file 27 | from many other BitTorrent clients on the Internet. These pieces do not arrive in 28 | order, as they would when using the Hypertext Transfer Protocol (HTTP) or File Case No. 2:12-cv- SEGLARATION OF SETH SCHOEN
| 08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Cah
i> wW we Ww VY NM WY LH LH HS HSE YF SF SE FF | SB S| Oo a’ A Mma BwWN KF OO AN DH FW NY FF ©
se 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page5of11 Page ID #:2792
0 Oo HN DB Nn FP WW NY
| the downloader. For example, a partial video file containing gaps may be difficult to |
regard the file as damaged or corrupt and stop the playback process.
| some circumstances it may be used to play portions of incomplete or damaged files.
| the beginning of the file is missing.
| large video file with zero (null) bytes, which is the same condition as an incomplete | BitTorrent download that is missing the beginning of the file. VLC was not willing to play this file when I pressed the “Play” button. Although an expert could use
| VLC, possibly in combination with other software, to locate and play intact video
| data from later regions of the file, most users would probably consider this file
/ useless and unplayable.
Case No. 2:12-cv- DECLARATION OF SETH SCHOEN
Transfer Protocol (FTP). Thus, at any given point during a BitTorrent download, the user will have some portion of the data in the complete file, but that portion will almost certainly consist of pieces separated by numerous gaps. For example, when downloading a ten-minute video file, a BitTorrent client may receive a few seconds of minute six, followed by a portion of minute two, and so on. At some point, if the download progresses, the user will have a complete or substantially complete copy of the file. It is statistically unlikely that the user would have large contiguous portions of the video early in the download.
11. An incomplete, interrupted BitTorrent download is often not useful to
play through even if the majority of the file is present, both because the gaps may be
disorienting to a human viewer and because they may cause computer software to
12. Tagree with Mr. Chin that the VLC Player is powerful and that under However, gaps in a video file (such as those caused by an incomplete BitTorrent download) could still interrupt the playback.
13. More significantly, VLC cannot easily play certain video file formats if
14. I confirmed this by overwriting a small fraction of the beginning of a
15. Because BitTorrent client software applications normally download
pieces of the file in a completely random order, it is quite possible, even common, A
08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Cag
e@ 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 6of1i1 Page I/D #:2/93
| for the beginning of a file to be missing even when a significant fraction of the file's - content has already been downloaded. This is an important contrast with other kinds : of downloads where a file is downloaded sequentially from beginning to end, such as 4 an HTTP or FTP file download. Unlike these downloads, BitTorrent downloads do >| not happen in sequential order. 6 16. Under the assumption that pieces are downloaded in a random order, v there is a certain probability of having received at least a specified amount of data : intact and contiguous at the beginning of the file. The probability of having at least ? | the first b pieces of the file after downloading k out of n total pieces can be ” calculated explicitly as 1] | 2 | ies r -Ta 14 | ik : ID | where 16 | 17 | ca 18 ly) yiix-yil - is the “choose” function from probability, indicating the number of distinct ways of ay choosing y objects from a set of x objects. The general pattern is that this probability al remains extremely low while a download is incomplete (even when a substantial 22 majority of the file has been downloaded), and then grows quickly as the download - | nears completion. on 17. For example, consider a 60-minute video file of 300 megabytes in size 4) | which is being distributed via a BitTorrent swarm. Suppose that the file has been ee divided into 1200 pieces of 256 kilobytes each. This graph shows the explicit ad | probability that a given downloader has obtained the first one minute (5 megabytes, ce | or twenty pieces) of contiguous video content, and hence can play through the first Case No. 2:12-cv- SECLARATION OF SETH SCHOEN |
08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Ca
10
Oo oOo IN DB nA FP W NY
Be 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 7of11 Page ID #:2794
minute of video without interruption, once the downloader has downloaded a
specified number of pieces:
Probability of At Least First Minute Intact
0.8 |
B 06 5 ae) a nL 0,4
0,2
0 200 ABO 600 SOO 1000 1200 Pieces Downloaded 6 Case No. 2:12-cv- DECLARATION OF SETH SCHOEN
08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Ca
Be 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 8of11 Page ID | #:2/95
; 18. Here is the corresponding graph for the ability to play the first 15 , | seconds of this file (1.25 megabytes, or five pieces): 3 4 Probability of At Least First 15 Seconds Intact 5 6 | 7 Q | 9 | 2 10 | 2 fo 11} 2 | a 12 13 | 14 | is | ®) 200 400 600 800 1000 1200 My Pieces Downloaded 18 - | 19. Lhave heard that some BitTorrent clients could be set to prioritize a downloading the beginning of the file before other parts, but this is not, to my - knowledge, standard or default behavior in BitTorrent software because it would oa have a deleterious effect on the speed and efficiency of a BitTorrent swarm as a 23 | whole. eet 20. According to the Hansmeier Declaration, Plaintiffs use “proprietary = forensic software to conduct an exhaustive real time ‘fingerprint’ of [a BitTorrent] ue swarm.” Hansmeier Decl. § 20. This statement, as well as Mr. Hansmeier's a observation that “while [his firm] detects an infringement at a particular instant, the ae infringer may, and likely is infringing at other times as well” (id. J 21), suggests that 7 | Case No. 2:12-cv- DECLARATION OF SETH SCHOEN
08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Ca
Oo co ~T HA nA BB W NO
| Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
Be 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 9of11 Page ID #:2196
Plaintiffs observe a swarm and a defendant’s participation in that swarm at a single
moment in time. At any given moment, participants in the swarm will have
| downloaded different amounts of data.
21. Although Mr. Hansmeier states that “[o]nce obtaining a full version of the Video file, John Doe . . . shared pieces of that copyrighted Video file... with other individuals” (id. 27), it is unclear from his declaration whether Mr. Hansmeier observed that any given Doe did in fact obtain a full version of the video
file, or whether Mr. Hansmeier was merely speculating that the Doe would
| eventually obtain a full version. His testimony at § 21 that “0881 detects an
infringement at a particular instant” suggests that his statement at q 27 about a particular Doe “obtain[ing] a full version” is speculative.
22. Many BitTorrent downloads fail to complete or are interrupted. Thus, many of the computers observed to have a partial download at a given time will not complete the download and will not obtain a usable video file. Without more
information about how the Plaintiffs determine the nature and extent of a Doe
| defendant's downloading activity, it is my opinion that the investigation described in
| the Hansmeier Declaration could result in the identification of IP addresses of
computers that did not download a usable video file.
23. Inhis declaration, Mr. Chin stated that “Use of the VLC Player has
| produced up to five seconds or more of images from a video file that had been the
| subject of no more than thirty seconds of downloading.” However, Mr. Chin did not
specify how the VLC Player was used in that instance, nor what protocol was used to
download the file. A file downloaded using HTTP, FTP, or another protocol that
| downloads a file in linear fashion would, when interrupted, be more likely to result
in a file directly usable by an unskilled user. If Mr. Chin was referring to an
interrupted BitTorrent download, it is likely that the playback he described required
| more than simply pressing “Play” in the VLC Player.
Ca
Nm NO NO NY WN WN NN NN NN YH KF KF FP FF FF FF ESE eS 0 ~T AR nA B WOW NO KFK CO O fFBANQI BD an fF WY NY FF CO
0 Oo NY DB A FSF W NO
He 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 10o0f11 Page ID | #:2797
Authorship of Plaintiffs’ Filings
24. Portable Document Format (PDF) files can contain metadata, including fields indicating the author’s name and the file’s creation and modification dates.
25. Using the Xpdf software created by Glyph & Cog, LLC, I extracted the
| metadata from several PDF files that were electronically filed using Brett Gibbs’
CM/ECEF account in the above-titled case, and in a few of the related cases. 26. My analysis revealed that the following files’ were “created” by user “SHO”: ¢ Memo iso P’s Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8- 1, created Oct. 5, 2012) ¢ Opposition to Ex Parte Application to Stay Pending Subpoena.pdf (ECF | No. 14, created November 30, 2012) ¢ P’s Response to Ex Parte re Stay.pdf (ECF No. 16, created November 30, 2012)
27. My analysis revealed that the following files were “created” by user
“SHO0S”:
e P's Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8, created Oct. 55,2012)
¢ P’s Response in Opposition to Movant’s Notice of Related Cases.pdf (ECF No. 18, created Dec. 7, 2012)
¢ P's Response in Opposition to Movant's Supplement to Notice of Related Cases Filed 12-14-12.pdf (ECF No. 21, created Dec. 14, 2012).
And in AF Holdings, LLC v John Doe, No. 12-cv-5709: ¢ P’s Response to OSC.pdf (ECF No. 10, created Nov. 1, 2012)
| The specific titles of these files were assigned when they were downloaded from the CM/ECF system, however, I assume that the underlying PDF metadata is from the original file uploaded to
1 the CM/ECF system by the electronic filer, Brett Gibbs. Except where otherwise indicated, ECF | numbers are from 2:12-cv-8333.
9 Case No. 2:12-cv- DECLARATION OF SETH SCHOEN >
| 08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT
de 2:12-cv-08333-ODW-JC Document 117-3 Filed 04/16/13 Page 11of11 Page ID #:2/98
28. My analysis revealed that the following files were “created” by user
¢ Ps Sanctions Motion.pdf (ECF No. 22, created Dec. 17, 2012) ¢ P's Response to Anonymous Doe Movant's Ex Parte Appl for Leave to Take Early Discovery and Stay.pdf (ECF No. 27, created Dec. 20, 2012) ¢ Motion to Disqualify Judge Wright.pdf (ECF No. 35, created Dec. 30, 2012) ¢ Opp to Request for Leave to File Response to Motion to Disqualify.pdf (ECF No. 39, created Jan. 7, 2013) ¢ Notice of Voluntary Dismissal.pdf (ECF No. 43, created Jan. 28, 2013). And in AF Holdings, LLC v. John Doe, No. 12-cv-6636: ¢ P’s Response re Failure to Serve.pdf (ECF No. 15, created Dec. 27, 2012) And in AF Holdings, LLC v. Chaz Forsyth, No. 12-cv-6669: ¢ P’s Response re Failure to Serve.pdf (ECF No. 18, created Dec. 27, 2012)
I declare under penalty of perjury under the laws of the United States of
America that the foregoing is true and correct. Executed on April 16, 2013 at San
abe Lede
Seth Schoen
| Francisco, California.
10
| Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC PRIVILEGED AND CONFIDENTIAL DRAFT