Case 2:12-cv-08333-ODW-JC Document 119 Filed 04/17/13 Page 1ofi1 Page ID #:2801 Morgan E. Pietz, Esq. (SBN 260629) THE PIETZ LAW FIRM 3770 Highland Avenue Suite 206 Manhattan Beach, CA 90266 Tel: 310-424-5557 Fax: 310-546-5301 Email: mpietz@pietzlawfirm.com Nicholas R Ranallo NICHOLAS RANALLO LAW OFFICES 371 Dogwood Way Boulder Creek, CA 95006 Tel: 831-703-4011 Fax: 831-533-5073 Email: nick@ranallolawoffice.com WO co ~T QD Wn BR WW NO — — p— WN ee © Attorneys for Putative John Doe in 2:12- cv-08333-ODW-JC — Ss WW UNITED STATES DISTRICT COURT FOR THE CENTRAL DISTRICT OF CALIFORNIA ee ~~ HN nN INGENUITY 13 LLC, ) Case No. 2:12-cv-08333-ODW-JC jh CO 19 | Plaintiff, DECLARATION OF SETH SCHOEN 20 V. Case Consolidated with Case Nos.: 1 2:12-cv-6636; 2:12-cv-6669; 2:12-cv- JOHN DOE, 6662; and 2:12-cv-6668 22 Defendant. Case Assigned to: hO eo) District Judge Otis D Wright, II NO a Discovery Referred to: Magistrate Judge Jacqueline Chooljian No WN NO NN Complaint Filed: September 27, 2012 Trial Date: None set No ON oo ~~ Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 08333-ODW-JC Case 2:12-cv-08333-ODW-JC Document119 Filed 04/17/13 Page 2of11 Page ID #:2802 1 | DECLARATION OF SETH SCHOEN a | I, Seth Schoen, declare and state as follows: : ll. Iam a Senior Staff Technologist with the Electronic Frontier : | Foundation (EFF). I am over eighteen years of age. I make this declaration on my > | own personal knowledge and if called upon to testify thereto, I could and would =| competently do so. q M, I have worked with computers and computer networks for over a 8 | decade. I have published two peer-reviewed academic papers in the field of computer ? | security, and been interviewed about computer networking and computer security in “0 the national news media. I have testified about electronic communications systems in _ three courts and before the United States Sentencing Commission, and have 2 | submitted expert testimony concerning the analysis of BitTorrent file-sharing = | networks to the federal courts in at least fifteen other matters. an ot I was requested by Morgan Pietz, counsel for a putative John Doe in the 1D | above-captioned action, to research and provide an objective response to several 16 | statements made in the Declaration of Joshua Chin in Support of Response to Order a to Show Cause, which was filed on April 8, 2013, and to factual assertions in the re oppositions to the Order to Show Cause. Specifically, I was asked to research and 19 | respond to these issues: a0 | a. Whether the protocol described by Peter Hansmeier in his 7 declaration in the above-captioned case is a reasonably accurate means of identifying cal the Internet Protocol (IP) addresses of computers involved in file-sharing using the *3-| BitTorrent protocol. a b. | Whether an incomplete download of a video file using BitTorrent 2) | results in the downloader having a viewable copy of the file. 26 c. What the metadata associated with the documents filed by the oa plaintiffs in this action reveal about who was involved in their drafting. 28 ] | “Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC mo wo NHN NH NH WN NY WN NN | FF FP FF KF Fe PR FY FS oO VTA nA B WN KK DOD wHO ANAND HA FW NY FF CO 0 Oo SYN DO UO HR WY NY R:12-cv-08333-ODW-JC Document119 Filed 04/17/13 Page 3of11 Page ID #:2803 4, In forming these opinions, I relied upon the Declarations of Peter | Hansmeier filed in the above-captioned case (ECF No. 8-1) and in case 2:12-06662- | ODW (ECF No. 6-1); Brett L. Gibbs’ Response to the Order to Show Cause in the above-captioned case (ECF No. 49); the Declaration of Joshua Chin in Support of Response to Order to Show Cause (ECF No. 108-1); the pleadings, declarations, and | exhibits filed in connection with the Court’s February 7, 2013 Order to Show Cause; | certain other pleadings filed in the above-captioned case and in the related cases, all of which were electronically filed on the CM/ECF system by Brett Gibbs’ CM/ECF account and are identified below; and the authorities I cite below. The Accuracy of Plaintiff’s Means of Identifying IP Addresses 5. While the Hansmeier Declaration purports to describe the method by which the Plaintiffs in these consolidated cases identify the IP addresses of copyright infringers, the declarations omit information that I believe is material to a | determination of whether that method is reasonably accurate. 6. For example, Mr. Hansmeier states that his software records the | “percent of the file downloaded by [his firm]’s software from the infringer’s computer” (Hansmeier Decl. at 20), but also that his firm’s software “does not [...] | allow me to [...] communicate with [the infringer’s] computer in any way” (Hansmeier Decl. at 21). It is thus unclear whether or to what extent the software | downloaded portions of the file from individual defendants, and Mr. Hansmeier did | not file this information with the Court, although he states that he has it on file (Hansmeier Decl. at 26). Similarly, it is unclear to what extent Mr. Hansmeier's software relied on information obtained from third-party BitTorrent trackers (which facilitate downloads) as opposed to information obtained by direct observation of | and communication with defendants’ computers. 7 These omitted details could be important because simple methods of | attempting to locate copyright infringers can easily go awry. For example, in 2008, researchers from the University of Washington found that, given then-prevalent Z | Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 08333-ODW-JC Case 10 | 2:12-cv-08333-ODW-JC Document119 Filed 04/17/13 Page 4of11 Page ID #:2804 | methods for investigating BitTorrent transfers, it was straightforward to frame | printer and succeeded in eliciting false allegations of copyright infringement against | on Hot Topics in Security, July 29, 2008, available at io co©O ~YJQ HA NA BB W NH | 25, and 26 of his declaration indicate that he filed with the Court only a small | Hansmeier says he “personally observed” infringing transmissions; his statement that | not actually participating in infringing filesharing activity, or that had not been | begins downloading a file, the BitTorrent client software receives pieces of the file | Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC particular IP addresses for downloading files that they had not, in fact, ever attempted to download. The researchers experimentally framed their own laser it. See Michael Piatek, Tadayoshi Kohno, and Arvind Krishnamurthy, “Challenges and Directions for Monitoring P2P File Sharing Networks, or, Why My Printer Received a DMCA Takedown Notice,” in Proceedings of the 3rd USENIX Workshop http://Awww.usenix.org/event/hotsec08/tech/full _papers/piatek/piatek.pdf. 8. I do not mean to suggest that Mr. Hansmeier is unable to gather or did not gather relevant information to support Plaintiff's allegations, including by techniques that avoid the pitfalls described by Piatek et al. However, paragraphs 20, summary portion of the information that he gathered. In paragraph 27, Mr. his firm's software does not “communicate” with Defendants’ computers leaves some ambiguity about the exact nature of this observation. 9: Without more information about how Plaintiff gathers IP addresses and attribute infringing activity to them, it is my opinion that an investigation like Plaintiff's could result in the identification of IP addresses of computers that were directly confirmed to have done so. The Usability of Partial Downloads 10. BitTorrent divides each file into “pieces,” which are subregions of the file that are downloaded independently of one another. When a BitTorrent user from many other BitTorrent clients on the Internet. These pieces do not arrive in order, as they would when using the Hypertext Transfer Protocol (HTTP) or File 3 wo feo ~~) HD WN BP WO NO DP DO BDO NO HD WD NN WN NN FY FF FF FF KF FF PF Pl hc oO ~Y) OH WH BR WH NYO KF CO OHO DB nN DB A FP WW NY KF CO :12-cv-08333-ODW-JC Document119 Filed 04/17/13 Page5of11 Page ID #:2805 Transfer Protocol (FTP). Thus, at any given point during a BitTorrent download, the | user will have some portion of the data in the complete file, but that portion will almost certainly consist of pieces separated by numerous gaps. For example, when | downloading a ten-minute video file, a BitTorrent client may receive a few seconds of minute six, followed by a portion of minute two, and so on. At some point, if the | download progresses, the user will have a complete or substantially complete copy of the file. It is statistically unlikely that the user would have large contiguous portions of the video early in the download. 11. An incomplete, interrupted BitTorrent download is often not useful to the downloader. For example, a partial video file containing gaps may be difficult to play through even if the majority of the file is present, both because the gaps may be disorienting to a human viewer and because they may cause computer software to | regard the file as damaged or corrupt and stop the playback process. 12. Tagree with Mr. Chin that the VLC Player is powerful and that under some circumstances it may be used to play portions of incomplete or damaged files. | However, gaps in a video file (such as those caused by an incomplete BitTorrent download) could still interrupt the playback. 13. More significantly, VLC cannot easily play certain video file formats if the beginning of the file is missing. 14. Iconfirmed this by overwriting a small fraction of the beginning of a large video file with zero (null) bytes, which is the same condition as an incomplete | BitTorrent download that is missing the beginning of the file. VLC was not willing | to play this file when I pressed the “Play” button. Although an expert could use | VLC, possibly in combination with other software, to locate and play intact video data from later regions of the file, most users would probably consider this file | useless and unplayable. 15. Because BitTorrent client software applications normally download | pieces of the file in a completely random order, it is quite possible, even common, 4 | Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 08333-ODW-JC Case P:12-cv-08333-ODW-JC Document 119 Filed 04/17/13 Page 6of11 Page ID #:2806 for the beginning of a file to be missing even when a significant fraction of the file's content has already been downloaded. This is an important contrast with other kinds of downloads where a file is downloaded sequentially from beginning to end, such as | an HTTP or FTP file download. Unlike these downloads, BitTorrent downloads do not happen in sequential order. 16. Under the assumption that pieces are downloaded in a random order, there is a certain probability of having received at least a specified amount of data intact and contiguous at the beginning of the file. The probability of having at least the first b pieces of the file after downloading k out of n total pieces can be | calculated explicitly as 1 where 1X a x! ; i ” ag yy) yxy | is the “choose” function from probability, indicating the number of distinct ways of choosing y objects from a set of x objects. The general pattern is that this probability remains extremely low while a download is incomplete (even when a substantial | majority of the file has been downloaded), and then grows quickly as the download nears completion. 17. For example, consider a 60-minute video file of 300 megabytes in size which is being distributed via a BitTorrent swarm. Suppose that the file has been divided into 1200 pieces of 256 kilobytes each. This graph shows the explicit | probability that a given downloader has obtained the first one minute (5 megabytes, | or twenty pieces) of contiguous video content, and hence can play through the first 5 Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC Case P:12-cv-08333-ODW-JC Document 119 Filed 04/17/13 Page 7of11 Page ID #:2807 minute of video without interruption, once the downloader has downloaded a specified number of pieces: Probability of At Least First Minute Intact ‘10 co ~) QA wr Bp WN NO Probability —_ —= — — Ww No FS © —. a 0 200 A00 600 300 1000 1200 Pieces Downloaded wb NWN NH NY WH NN NN KH BF KS & oc TNA A BWHONH KF OOo ON A 6 Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 08333-ODW-JC Case P:12-cv-08333-ODW-JC Document 119 Filed 04/17/13 Page 8of11 Page ID #:2808 L | 18. Here is the corresponding graph for the ability to play the first 15 2 seconds of this file (1.25 megabytes, or five pieces): 3 4 | Probability of At Least First 15 Seconds Intact 1 5 6 | 7 0.3 8 9] > O06 10} 2 o ly FS 04 12 13 | | 0.2 14 1S | 16 0 SS — 0 200 400 600 B00 1000 1200 17 | Pieces Downloaded 18 | 19 | 19. Ihave heard that some BitTorrent clients could be set to prioritize ae downloading the beginning of the file before other parts, but this is not, to my BE | knowledge, standard or default behavior in BitTorrent software because it would e have a deleterious effect on the speed and efficiency of a BitTorrent swarm as a 23 4 whole. zh | 20. According to the Hansmeier Declaration, Plaintiffs use “proprietary | forensic software to conduct an exhaustive real time ‘fingerprint’ of [a BitTorrent] a swarm.” Hansmeier Decl. § 20. This statement, as well as Mr. Hansmeier's a observation that “while [his firm] detects an infringement at a particular instant, the - | infringer may, and likely is infringing at other times as well” (id. { 21), suggests that 7 Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC Case 2:12-cv-08333-ODW-JC Document 119 Filed 04/17/13 Page 9of11 Page ID #:2809 | | Plaintiffs observe a swarm and a defendant’s participation in that swarm at a single 2 moment in time. At any given moment, participants in the swarm will have 3 | downloaded different amounts of data. 4 21. Although Mr. Hansmeier states that “[o]nce obtaining a full version of ° | the Video file, John Doe . . . shared pieces of that copyrighted Video file . . . with © | other individuals” (id. § 27), it is unclear from his declaration whether Mr. y | Hansmeier observed that any given Doe did in fact obtain a full version of the video 5 | file, or whether Mr. Hansmeier was merely speculating that the Doe would 2 eventually obtain a full version. His testimony at {21 that “6881 detects an ” infringement at a particular instant” suggests that his statement at {| 27 about a | particular Doe “obtain[ing] a full version” is speculative. - 22. Many BitTorrent downloads fail to complete or are interrupted. Thus, = many of the computers observed to have a partial download at a given time will not complete the download and will not obtain a usable video file. Without more | information about how the Plaintiffs determine the nature and extent of a Doe MO defendant's downloading activity, it is my opinion that the investigation described in 17 | the Hansmeier Declaration could result in the identification of IP addresses of " computers that did not download a usable video file. 19 | 23. Inhis declaration, Mr. Chin stated that “Use of the VLC Player has produced up to five seconds or more of images from a video file that had been the en subject of no more than thirty seconds of downloading.” However, Mr. Chin did not 22 specify how the VLC Player was used in that instance, nor what protocol was used to | 23 | download the file. A file downloaded using HTTP, FTP, or another protocol that es | downloads a file in linear fashion would, when interrupted, be more likely to result = in a file directly usable by an unskilled user. If Mr. Chin was referring to an ES interrupted BitTorrent download, it is likely that the playback he described required 27 | more than simply pressing “Play” in the VLC Player. 28 8 Case No. 2:12-cv- DECLARATION OF SETH SCHOEN Case f:12-cv-08333-ODW-JC Document 119 Filed 04/17/13 Page 10o0f11 Page ID #:2810 L | Authorship of Plaintiffs’ Filings 2 'I 24. Portable Document Format (PDF) files can contain metadata, including : fields indicating the author’s name and the file’s creation and modification dates. = 25. Using the Xpdf software created by Glyph & Cog, LLG, I extracted the > | metadata from several PDF files that were electronically filed using Brett Gibbs’ | CM/ECF account in the above-titled case, and in a few of the related cases. a 26. My analysis revealed that the following files' were “created” by user 8 | «gH01”: > | ¢ Memo iso P’s Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8- ” 1, created Oct. 5, 2012) 7 | ¢ Opposition to Ex Parte Application to Stay Pending Subpoena.pdf (ECF = No. 14, created November 30, 2012) ¢ P’s Response to Ex Parte re Stay.pdf (ECF No. 16, created November a 30, 2012) Id | 27. My analysis revealed that the following files were “created” by user no “SH0S”: a | ¢ P's Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8, created Oct. 18 | 5, 2012) o ¢ P’s Response in Opposition to Movant’s Notice of Related Cases.pdf a0 (ECF No. 18, created Dec. 7, 2012) a ¢ P's Response in Opposition to Movant's Supplement to Notice of aa Related Cases Filed 12-14-12.pdf (ECF No. 21, created Dec. 14, 2012). = And in AF Holdings, LLC v John Doe, No. 12-cv-5709: ¢ P’s Response to OSC.pdf (ECF No. 10, created Nov. 1, 2012) 25 26 | 1 The specific titles of these files were assigned when they were downloaded from the CM/ECF 27 | system, however, I assume that the underlying PDF metadata is from the original file uploaded to | the CM/ECF system by the electronic filer, Brett Gibbs. Except where otherwise indicated, ECF 28 | numbers are from 2:12-cv-8333. 9 | Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC Case 0 Oo YH WN BP W NY A:12-cv-08333-ODW-JC Document 119 Filed 04/17/13 Page 11of11 Page ID #:2811 28. My analysis revealed that the following files were “created” by user “Paul”: ¢ Ps Sanctions Motion.pdf (ECF No. 22, created Dec. 17, 2012) ¢ P's Response to Anonymous Doe Movant's Ex Parte Appl for Leave to Take Early Discovery and Stay.pdf (ECF No. 27, created Dec. 20, 2012) ¢ Motion to Disqualify Judge Wright.pdf (ECF No. 35, created Dec. 30, 2012) ¢ Opp to Request for Leave to File Response to Motion to Disqualify.pdf (ECF No. 39, created Jan. 7, 2013) ¢ Notice of Voluntary Dismissal.pdf (ECF No. 43, created Jan. 28, 2013). And in AF Holdings, LLC v. John Doe, No. 12-cv-6636: ¢ P’s Response re Failure to Serve.pdf (ECF No. 15, created Dec. 27, 2012) And in AF Holdings, LLC v. Chaz Forsyth, No. 12-cv-6669: ¢ P’s Response re Failure to Serve.pdf (ECF No. 18, created Dec. 27, 2012) I declare under penalty of perjury under the laws of the United States of | America that the foregoing is true and correct. Executed on April 16, 2013 at San Francisco, California. 10 | Case No. 2:12-cv- DECLARATION OF SETH SCHOEN | 08333-ODW-JC