Are universities protecting students from the RIAA?

[vansmack]

I have to take the no comment approach to this article as well.
 
 October 18, 2007 4:00 AM PDT
 
 Are universities protecting students from the RIAA?
 Posted by Declan McCullagh
 
 As I wrote earlier this week, the Recording Industry Association of America has now expanded its campaign against illicit file-sharing to students at George Washington University.
 
 One thing I noticed when reading through the court documents is how sluggish the RIAA's attorneys and its MediaSentry contractor have been in filing these lawsuits. Even though the complaint was filed on September 19, this excerpt lists IP addresses in use as long ago as February:
 
 
 Doe # 1 IP Address:  128.164.100.11 2007-02-02 05:59:17 EST
 Doe # 2 IP Address:  128.164.100.11 2007-03-05 04:29:42 EST
 Doe # 3 IP Address:  128.164.100.158 2007-04-14 16:57:39 EDT
 Doe # 4 IP Address:  128.164.100.22 2007-03-26 02:02:52 EDT
 Doe # 5 IP Address:  128.164.100.72 2007-05-10 00:24:36 EDT
 
 If GWU has deleted its logs of who was using what IP address back then, the RIAA is going to be out of luck. So this becomes an important question: how long do universities keep logs showing who's been assigned a particular IP address? And why won't they say what the duration is?
 
 "We have not systematically surveyed our members regarding their data retention practices, especially IP addresses," Rodney Petersen, Educause's government relations officer, told me in e-mail. "Anecdotally, our members have reported varying retention practices--ranging from keeping them for as little time as necessary, usually a few days, for internal security purposes to keeping them indefinitely. There is little uniformity in practice based upon our informal inquiries." Educause is, of course, a nonprofit group that represents higher education institutions and oversees the .edu domain.
 
 The RIAA's lawsuit against GWU students in Washington, D.C., is not an outlier. The RIAA sued 21 "John Does" at Boston University on May 2. The alleged infringing activity in that case goes back to January 15, meaning the RIAA waited nearly four months.
 
 Now, there's no legal obligation for colleges or universities to keep records of temporary IP address assignment, assuming addresses are allocated on demand through a protocol like DHCP. (They also can be allocated semi-permanently based on geographic location such as residence hall or campus office.)
 
 "Georgetown University uses DHCP to assign IP addresses but in order to protect the integrity of our computer security systems we do not release information about length of storage," Georgetown spokeswoman Julie Green Bataille told me on Wednesday. For its part, GWU didn't reply at all.
 
 The reason I know there's no legal obligation is that I spent much of the last three years writing about precisely this topic: lobbying Congress to enact mandatory IP address logging was a favorite hobby of former attorney general Alberto Gonzales. Even though some companies like Comcast decided to extend their logging policy to six months, Gonzales still resigned without getting what he wanted.
 
 Universities may want to keep longterm logs of IP addresses assigned in hopes of discouraging file-sharing. Multi-month logs may help identify network misuse. On the other hand, schools may try to protect their students' privacy by keeping logs for only a few days (and then may not want to publicize it for fear of being publicly criticized by the RIAA or Congress for being "soft on piracy").
 
 While schools have the right to set whatever policies they want--in a pro-copyright or pro-privacy direction--they should at least be public about it. That would let students, faculty, and staff debate the topic in the open rather than let rules be set in private by attorneys or administrators who tend to be far too risk-averse. It would also, I suppose, let students who are wavering between one school and another decide whether they'd rather attend a school that has chosen copyright as a paramount value, or one that has embraced privacy instead.
 
 (If you know more details about a particular university's data retention policy, please post them below...)

[sweetcell]

are you researching this, smackie?  if so, this might help: below is a notice i got from the university on who's campus i'm living, and through which i'm accessing the internet at home.  i've taken out the name of the university since i'm not sure if i'm allowed sharing this... anyhoo, if you've been paying attention you already know what university this is (please don't post it here).  apparently, lawsuits have already been brought against students here.
 
 
 Important Notice for Graduate Students:
 
 Copyright Law and (EDITED) University Policy
 
 The entertainment industry continues to target students at colleges and universities in an aggressive campaign against copyright infringement involving the use of file-sharing technologies such as BitTorrent, i2Hub, and others.  In fact, the Recording Industry Association of America (RIAA) now has filed more than two dozen lawsuits against (EDITED) University students since April 2003, and has filed thousands more against users nationwide in an ongoing effort to deter the illegal downloading and sharing of copyrighted music.  Movie and television studios have also filed copyright lawsuits against individuals, although none have yet been brought against (EDITED) students.  Below is some information that may help you comply with copyright law and University policy.
 
 
 �??What�??s the worst that can happen?�?�
 
 If the entertainment industry sues you, it is likely you will face claims for many thousands of dollars for engaging in what might seem to be a relatively modest amount of file-sharing.  Even the cost and inconvenience of settling such a lawsuit can be considerable. Moreover, the University takes disciplinary action for infringement and, in appropriate circumstances such as those involving instances of repeat infringement, the penalty may include the termination or suspension of network privileges as well as disciplinary probation.
 
 
 �??What are my chances of getting caught?�?�
 
 The entertainment industry actively monitors the Internet for potentially infringing activity.  Last year, the University received hundreds of complaints from film and television studios, the RIAA and other copyright holders.  In a letter to President (DELETED), the Motion Picture Association of America (MPAA) also identified alleged infringers on campus.  Although many of these complaints have not yet resulted in further legal action, they are indicative of the industry�??s increasing vigilance.  It is also important to remember that copyright holders are not required to notify the University before filing a lawsuit against a user of our network.  Copyright holders can also obtain subpoenas that compel the University to disclose information regarding the identity of students suspected of infringement.
 
 �??What about legal copies on my computer?�?�
 
 Even if the copyrighted copies of music and video on your computer were legally obtained, you must protect those copies from further copying by others.  For example, just because you have purchased a music CD or a movie on DVD, you do not have the right to give copies of that CD or DVD to your friends or to make it available for copying by your friends.  If you use file-sharing software, be careful not to leave copyrighted material in the shared space that the software creates.  In fact, some students have discovered that their personal files were being accessed without consent.  
 
 �??How do I know whether the material I want is copyrighted?�?�
 
 The scope of copyright protection is very broad. As a general matter, it is safe to assume only that music, film and other works of �??authorship�?� created before 1923 have fallen into the public domain and are no longer protected under the copyright law of the United States.  It is also important to remember that copyright protection may apply even if you do not see the copyright symbol © or any other indication that the material in question has been officially registered with the United States Copyright Office. It is not correct to assume, moreover, that commercial makers of file-sharing software have already secured the right for you to use their software for purposes of sharing music or video files with others.  There are Internet sites that offer legal copies of music and other copyrighted materials for free or for a small fee.    
 
 
 �??What if I have questions?�?�
 
 The web site of the U.S. Copyright Office (www.copyright.gov) may be helpful, as may industry web sites such as www.musicunited.org and www.respectcopyrights.org .  If you have specific questions regarding University policy regarding file-sharing and copyright, you can address them to helpdesk@(EDITED).edu for proper referral.  The University�??s Office of General Counsel also offers a �??Copyright Basics�?� website where you may learn more about the scope and nature of copyright protection, including the limitations of the �??fair use�?� exemption.

[Charlie Nakatestes, Japanese Golfer]

You might want to edit out the university president's name as well, if you're really trying to be discreet.

[vansmack]

Thanks for sharing.
 
 There are two trains of thought on this one.
 
 When John Doe requests are made (as in GW above), the University has the choice of identfying the infringer by their IP address or not identifying the infringer and forcing the RIAA to do the leg work to find the students name out on their own.
 
 In order to get the University's cooperation, the RIAA is offering plea deals of about $2000 per infirnger.  If the University declines to identify, then the RIAA will pursue a more stringent course of action for every infraction (usually a 6 to 7 figure fine for the infringer).
 
 Some Universities have left it up to the student to decide which course of action they would like the University to take.

[sweetcell]

Originally posted by Charlie Nakatestes,Japanese Golfer:
  You might want to edit out the university president's name as well, if you're really trying to be discreet.

wow, great catch... didn't realize you cared (wipes tear)     thanks.
 
   

Originally posted by vansmack:
  Thanks for sharing.

"hello, my name is sweetcell and i'm a file swapper".  "welcome, sweetcell!"
 
 seriously tho, what a choice for a student to be faced with... i imagine that most will chose to spin the wheel and hope that the RIAA can't/won't do the leg-work.  not that i feel sorry for him/her, it's not as if anyone can claim ignorance anymore.

[vansmack]

Originally posted by sweetcell:
 
 seriously tho, what a choice for a student to be faced with... i imagine that most will chose to spin the wheel and hope that the RIAA can't/won't do the leg-work.  not that i feel sorry for him/her, it's not as if anyone can claim ignorance anymore.

I can't comment much other than it seems to go down class lines.  If $2000 is not a lot to you (or more notably, your family) then you pay the fine and face the music.
 
 If $2K seems like a lot (or your stupid enough to not ask for family help because you're embarassed), then you roll the dice thinking there is no way they will get $200,000 from me 'cause I ain't got nothing.  
 
 There's bound to be one rich kid some day that decided not to tell his folks and gets hit with the huge fine.  But seriously, take the $2K if you've got it - even if you have to ask your folks.  Students are really rolling the dice thinking the RIAA won't find some court that forces University's to identify the John Doe's.