RAM Ruling Raises Privacy Issues

Information Management Journal, Sep/Oct 2007 by Swartz, Nikki

A Los Angeles judge issued what some are calling a groundbreaking ruling in a copyright case that may shake up US. laws governing electronic discovery.

In Columbia Pictures Industries v. Bunnell, U.S. magistrate judge Jacqueline Chooljian ruled that a computer server's random-access memory (RAM) is a tangible document that can be stored, and the information it contains must be surrendered in a lawsuit - a decision that threatens Internet privacy and could impose huge discovery and recordkeeping burdens on companies, experts said.

According to CNetNews, Chooljian issued the decision in a copyright infringement lawsuit filed in 2006 by the Motion Picture Association of America (MPAA). According to Lflw.com, six movie studios filed suit against TorrentSpy, which does not directly offer copyrighted video files to its visitors but acts as a search engine that helps users access them.

TorrentSpy - like many other sites -avoids logging visitors' Internet protocol (IP) addresses by switching off their servers' logging function, which typically records visitor addresses and user activity, according to CNet News. MPAA's attorneys argued this makes it easier to download pirated material anonymously, which the MPAA estimates costs the six largest U.S. studios more than $2 billion annually.

To prove that TorrentSpy was making it easier to share files, the studios convinced Chooljian that they must obtain TorrentSpy's user activity records - and the only way to do it was to cull the data from the RAM.

In addition to requiring TorrentSpy to turn over RAM data, the ruling requires TorrentSpy to begin logging user information but allows it to mask the IP addresses of its visitors. The order has been stayed pending TorrentSpy's appeal.

According to Law.com, this is the first case where a court considered RAM data as discoverable, which means that any company being sued could have to collect and turn it over at great expense. If the ruling stands, it would require search engines to create and store logs of its users' activities as part of e-discovery obligations in civil lawsuits.

Ken Withers, director of judicial education at The Sedona Conference, told CNet News he feared the decision may mean a "tremendous expansion" of the scope of discovery in civil litigation. According to Withers, the judge's order for TorrentSpy to create logs of user activity is unprecedented.

"There's never been a requirement that [defendants] must create documents that they wouldn't ordinarih/ maintain for the purpose of satisfying some [plaintiffs] discovery requests," he said.

Dean McCarron, principal analyst at Mercury Research, told CNet News that the judge erred by defining volatile computer memory as electronically stored information (ESI). RAM is a computer's ephemeral and temporary memory that helps it access data quickly to carry out relevant processes, but it is overwritten or deleted when the process is complete or the computer is shut down. McCarron said a "tap" can be installed in a server, but that requires keeping a running log of IP addresses and other information, creating large amounts of data to store.

The Electronic Frontier Foundation (EFF) and Center for Democracy and Technology (CDT) are working to overturn Chooljian's ruling. According to the groups, the magistrate judge incorrectly reasoned that, because the IP addresses exist in the RAM of TorrentSpy's webservers, they are ESI that must be collected and turned over under the rules of federal discovery.

They say this decision could be interpreted to extend to every function carried out by a digital device. Every keystroke at a computer keyboard, for example, is temporarily held in RAM. Also, digital telephone systems record every conversation, moment by moment, in RAM.

"In the analog world, a court would never think to force a company to record telephone calls, transcribe employee conversations, or log other ephemeral information," said EFF Senior Staff Attorney Fred von Lohmann. "There is no reason why the rules should be different simply because a company uses digital technologies."

Privacy watchdogs say the ruling, if allowed to stand, may mean companies that conduct business online might have to adjust their privacy policies and start gathering additional information about their customers simply because their company has been sued.

However, a MPAA attorney told CNet News that, because TorrentSpy is allowed to redact IP addresses, no one's privacy is threatened. The attorney called the user privacy argument a "red herring," and said courts have long considered computer RAM as ESI.