The online community now has an opportunity to see the fruits of its labor. Back in December, the Slashdot ("What Questions Would You Ask an RIAA "Expert"?") and Groklaw ("Another Lawyer Would Like to Pick Your Brain, Please") communities were asked for their input on possible questions to pose to the RIAA's "expert", Dr. Doug Jacobson of Iowa State University, who was scheduled to be deposed in February in UMG v. Lindor, for the first time in any RIAA case. Ms. Lindor's lawyers were flooded with about 1400 responses.
The deposition of Dr. Jacobson went forward on February 23, 2007, and the transcript is now available online (pdf). Ray Beckerman, one of Ms. Lindor's attorneys, had this comment: "We are deeply grateful to the community for reviewing our request, for giving us thoughts and ideas, and for reviewing other readers' responses.
Now I ask the tech community to review this all-important transcript, and bear witness to the shoddy "investigation" and 'junk science' upon which the RIAA has based its litigation war against the people. The computer scientists among you will be astounded that the RIAA has been permitted to burden our court system with cases based upon such arrant and careless nonsense."
Here is the deposition as text.
***************************
1
1
2 UNITED STATES DISTRICT COURT
3 EASTERN DISTRICT OF NEW YORK
4 ---------------------------------------X
5 UMG RECORDINGS, INC., et al,
6
Plaintiffs, 05 CV 1095
7 (DGT)(RML)
vs.
8
9 MARIE LINDOR,
10 Defendant.
---------------------------------------X
11
12 February 23, 2007
13 9:30 a.m.
14
15 DEPOSITION of Expert Witness,
16 DR. DOUGLAS W. JACOBSON, held at the offices
17 of Vanderberg & Feliu, LLP, 110 East 42nd
18 Street, New York, New York, pursuant to
19 Notice, before ELIZABETH SANTAMARIA, a
20 Notary Public of the State of New York.
21
22
23
24 Reported by:
ELIZABETH SANTAMARIA
25 JOB NO. 54123
2
1
2 A p p e a r a n c e s :
3
4 HOLME ROBERTS & OWEN LLP
5 Attorneys for Plaintiffs
6 1700 Lincoln Street
7 Denver, Colorado 80203-4541
8 BY: RICHARD L. GABRIEL, ESQ.
9
10 VANDENBERG & FELIU, LLP
11 Attorneys for Defendant
12 110 East 42nd Street
13 New York, New York 10017
14 BY: RAY BECKERMAN, ESQ.
15
16
ALSO PRESENT: ZI MEI
17
18
19
20
21
22
23
24
25
3
1
2 --O0O--
3
4 IT IS HEREBY STIPULATED AND AGREED
5 that the filing and sealing of the within
6 deposition be, and the same are hereby
7 waived;
8
9 IT IS FURTHER STIPULATED AND AGREED
10 that all objections, except as to the form
11 of the question, be and the same are hereby
12 reserved to the time of the trial;
13
14 IT IS FURTHER STIPULATED AND AGREED
15 that the within deposition may be sworn to
16 before Notary Public with the same force and
17 effect as if sworn to before a Judge of this
18 Court;
19 IT IS FURTHER STIPULATED that the
20 transcript is to be certified by the
21 reporter.
22
23 --o0o--
24
25
4
1
2 D O U G L A S W. J A C O B S O N,
3 called as a witness, having been duly sworn
4 by the Notary Public, was examined and
5 testified as follows:
6 EXAMINATION BY
7 MR. BECKERMAN:
8 Q. Please state your name for the
9 record.
10 A. Dr. Douglas W. Jacobson.
11 Q. What is your business address?
12 A. 2215 Coover Hall, Iowa State
13 University, Ames, Iowa 50011.
14 Q. Dr. Jacobson, are you yourself an
15 engineer?
16 A. Yes.
17 Q. By what body are you certified as an
18 engineer?
19 A. By no professional society.
20 Q. No professional society? Is there
21 any organization that has certified you as an
22 engineer?
23 A. No.
24 Q. Are you part of any peer regulatory
25 body?
5
1 Jacobson
2 A. I don't quite understand what you
3 mean by --
4 Q. Are you part of any body the members
5 of which are peer-regulated?
6 A. Can you give me an example of what
7 you are --
8 Q. A lawyer, an architect, an
9 accountant.
10 I thought an engineer had to be
11 certified by a peer-regulated body.
12 A. To be called a professional engineer
13 they do.
14 Q. So are you not a professional
15 engineer?
16 A. I do not have a PE license.
17 Q. You are the founder of the Palisade
18 Systems?
19 A. That's correct.
20 Q. What other titles do you hold within
21 that organization?
22 A. Chief technology officer.
23 Q. And are you a member of the board of
24 directors?
25 A. Yes.
6
1 Jacobson
2 Q. Are you a shareholder?
3 A. Yes.
4 Q. What percentage of the shares of that
5 company do you own?
6 A. I believe it's about 3 percent.
7 Q. Palisade Systems sells software
8 products to universities, businesses and other
9 institutions that maintain networks; is that
10 correct?
11 A. Yes.
12 Q. Do these products include products
13 which are intended to combat file sharing through --
14 we are going to be using that term a lot.
15 Withdrawn.
16 These products include products that
17 are intended to combat peer-to-peer file sharing of
18 copyrighted works; is that correct?
19 MR. GABRIEL: Objection to form.
20 You can answer the question.
21 A. Yes.
22 Q. Is one of the reasons that these
23 organizations buy these products the avoidance of
24 lawsuits?
25 MR. GABRIEL: Objection to form.
7
1 Jacobson
2 Lack of foundation.
3 A. I don't -- since I'm not on the
4 marketing side, I really can't testify to why a
5 particular client buys the product.
6 Q. Have you been quoted in press
7 releases issued by the company as to reasons to buy
8 the product?
9 A. Yes.
10 Q. And in those press releases have you
11 stated that one of the reasons to buy the product is
12 to avoid lawsuits?
13 A. I very well could have. I do not --
14 without seeing one of the press releases.
15 Q. Is one of the reasons to buy these
16 products to avoid copyright infringement lawsuits?
17 MR. GABRIEL: Objection to form.
18 A. That would be a reason to buy one of
19 the products.
20 Q. And have you specifically referred to
21 lawsuits by the RIAA as one of the types of lawsuits
22 that they could avoid by buying these products?
23 A. To my recollection, I have not.
24 Q. Is it true that the RIAA backs the
25 software that was co-licensed between your company
8
1 Jacobson
2 and Audible Magic?
3 MR. GABRIEL: Objection to form.
4 Lack of foundation.
5 A. I do not know what arrangement
6 Audible Magic and the RIAA have entered into.
7 Q. Are you aware that an officer of
8 Audible Magic was introduced to government officials
9 in Washington by representatives of the RIAA?
10 A. No.
11 MR. BECKERMAN: I would like to
12 mark as Defendant's 1 a press release from
13 Palisade Systems, Inc. bearing the
14 headline "Peer-to-Peer File Sharing
15 Struggles Intensify in Universities."
16 (Defendant's Exhibit 1, press release
17 from Palisade Systems, Inc. bearing the
18 headline "Peer-to-Peer File Sharing
19 Struggles Intensify in Universities," marked
20 for identification, as of this date.)
21 Q. Is this press release genuine?
22 A. It was released by the company.
23 MR. BECKERMAN: I would like to
24 mark as Exhibit 2 a one-page press release
25 of Palisade Systems, Inc. dated April 21,
9
1 Jacobson
2 2004. The headline is "Instantly Stop
3 Illegal P2P With PacketSure 3."
4 (Defendant's Exhibit 2, one-page
5 press release of Palisade Systems, Inc.
6 dated April 21, 2004, marked for
7 identification, as of this date.)
8 Q. Is this press release genuine?
9 A. Yes. It was released by the company.
10 Q. Going down to the third paragraph,
11 which purports to have a quotation from you, would
12 you tell us if that quotation is accurate?
13 A. Yes.
14 MR. BECKERMAN: I would like to
15 mark as Exhibit 3 a two-page article dated
16 April 19, 2004 by David Chappelle entitled
17 "Newest PacketHound release eliminates
18 illegal trading of copyrighted files."
19 (Defendant's Exhibit 3, two-page
20 article by David Chappelle dated April 19,
21 2004, marked for identification, as of this
22 date.)
23 Q. Who is Steven Brown?
24 A. Steven Brown, what was his title? He
25 was our marketing individual at Palisade. I don't
10
1 Jacobson
2 remember his exact title.
3 Q. Was he authorized to speak for
4 Palisade Systems to the press?
5 A. Yes.
6 Q. I direct you to the fifth paragraph
7 and ask you whether that is an accurate statement of
8 something that was said by Steven Brown.
9 MR. GABRIEL: Objection. Lack of
10 foundation.
11 A. I have no way of knowing firsthand
12 that Steven Brown said that.
13 Q. Do you agree with the statement "Some
14 P2P applications can evade certain security tools"?
15 A. Yes.
16 Q. Do you agree with the statement of
17 Mr. Chappelle contained in the third paragraph that
18 "Detecting and stopping copyrighted materials from
19 being shared illegally eliminates the liability
20 faced by organizations associated with file
21 sharing"?
22 MR. GABRIEL: Objection to form.
23 Lack of foundation.
24 A. Can you repeat the question?
25 (Record read.)
11
1 Jacobson
2 A. Since I'm not a lawyer, I'm not sure
3 I can comment on being a liability and the absolute
4 elimination of it.
5 Q. I call your attention to the ninth
6 paragraph, starting with the word "instead."
7 A. Okay.
8 Q. Do you agree with that paragraph?
9 MR. GABRIEL: Objection to form.
10 Lack of foundation.
11 A. Yes, I would agree with that.
12 MR. BECKERMAN: I would like to
13 mark as Exhibit 4 an article dated
14 April 21, 2004, of C/net News.Com.,
15 entitled "New Tool Designed to Block Song
16 Swaps."
17 (Defendant's Exhibit 4, C/net
18 News.com article dated April 21, 2004,
19 marked for identification, as of this date.)
20 Q. Do you agree with the statement in
21 the second paragraph, the first paragraph that's not
22 in bold, which says that the song filtering software
23 is backed strongly by the Recording Industry
24 Association of America, RIAA?
25 MR. GABRIEL: Objection to form.
12
1 Jacobson
2 Lack of foundation.
3 A. I have no firsthand knowledge of
4 whether or not the RIAA has strongly backed Audible
5 Magic software.
6 Q. Do you have any reason to believe
7 that they have?
8 MR. GABRIEL: Object to the form.
9 A. Could you rephrase the question?
10 Q. What is the problem with the
11 question?
12 A. Restate the question and then I will
13 tell you.
14 Q. You said you had no firsthand
15 knowledge. Now I am asking you whether you have any
16 reason to believe that the RIAA did, in fact, back
17 the software strongly.
18 A. I have no firsthand knowledge that
19 they have.
20 Q. Did you ever see this article?
21 A. I don't recall seeing the article on
22 the web.
23 Q. Did you see any articles or press
24 releases saying that the RIAA backed the software
25 strongly?
13
1 Jacobson
2 A. I don't recall seeing any.
3 Q. So this is the first you've heard of
4 it? Is that your testimony?
5 MR. GABRIEL: I object to the form.
6 He said what he said.
7 A. I have no firsthand knowledge that
8 they have strongly backed -- I don't have any
9 firsthand knowledge that they strongly backed the
10 software, Audible Magic software.
11 Q. Do you have any other knowledge that
12 they backed it?
13 A. Not to my recollection.
14 Q. Going down to the second paragraph
15 that's not in bold and the sentences which purport
16 to quote you, would you tell me whether those are
17 accurate quotes.
18 A. Yeah.
19 Q. Now, going down to the fourth
20 paragraph starting with the word "during," is it
21 your testimony that you have no knowledge of RIAA
22 executives helping to guide Audible Magic CEO Vance
23 Ikezoye around federal government offices advocating
24 the song blocking technology as a tool for stopping
25 copyright infringement on file swapping networks?
14
1 Jacobson
2 MR. GABRIEL: Object to the form of
3 the question.
4 A. Could you please read the question
5 back again.
6 (Record read.)
7 A. I have no knowledge that that took
8 place.
9 Q. What is the relationship, if any,
10 between the RIAA and Palisade Systems, Inc.?
11 A. There is no relationship.
12 Q. Has Palisade Systems, Inc. had any
13 dealings with any agents of the Recording Industry
14 Association of America?
15 A. I believe that our chief operating
16 officer had discussions with the RIAA back in the
17 early 2000s.
18 MR. BECKERMAN: I would like to
19 mark as Exhibit 5 a press release from
20 ZDNet entitled "File-Swap Killer Grabs
21 Attention."
22 (Defendant's Exhibit 5, press release
23 from ZDNet entitled "File-Swap Killer Grabs
24 Attention," marked for identification, as of
25 this date.)
15
1 Jacobson
2 Q. Do you know what ZDNet is?
3 A. Yeah.
4 Q. What is ZDNet?
5 A. It is an online publication, is my
6 understanding.
7 Q. Have you ever used ZDNet for anything
8 other than reading?
9 A. Personally, not to my knowledge I
10 haven't.
11 Q. You've never downloaded any software
12 from ZDNet?
13 A. Not that I can recall.
14 Q. Have you never heard of ZDNet as a
15 source of software?
16 A. Not that I recall.
17 Q. And what is ZDNet News?
18 A. My understanding is it's an online
19 publication that I believe they send out to e-mails
20 to the subscribers.
21 Q. Have you ever had any dealings with
22 the University of Rochester?
23 A. Define the university.
24 Q. Excuse me?
25 A. I don't quite understand when you say
16
1 Jacobson
2 the university.
3 Q. Have you ever had any dealings with
4 officials of the University of Rochester?
5 A. Personally I have not, no.
6 Q. Has Palisade Systems?
7 A. Personally I have no knowledge of
8 that.
9 Q. What do you mean personally you have
10 no knowledge of that? Do you have some other kind
11 of secondhand knowledge of it?
12 A. Not that I recall, but I do not keep
13 close tabs of what the marketing or the sales force
14 does.
15 Q. Has Palisade Systems had any dealings
16 with the University of Rochester?
17 A. Not that I recall.
18 Q. Did the provost of the University of
19 Rochester attend a demonstration of the Audible
20 Magic software at RIAA headquarters in January of
21 2004?
22 A. Not that I know of, but ...
23 Q. Do you agree or disagree with the
24 statement that the RIAA has helped the company,
25 meaning Audible Magic, gain entree to official
17
1 Jacobson
2 Washington circles?
3 MR. GABRIEL: Object to form. Lack
4 of foundation.
5 A. I have no knowledge of what the RIAA
6 has done to help Audible Magic.
7 Q. Is it a fact that Audible Magic
8 entered into a cross-licensing agreement with
9 Palisade Systems, Inc.?
10 A. That's correct.
11 Q. What was the software designed to do?
12 A. What software?
13 Q. Song filtering software created by
14 Audible Magic, software that was mentioned in the
15 press releases I just showed you.
16 A. Audible Magic's software is designed
17 to examine audio data and determine if it matches a
18 database of copyrighted materials.
19 MR. BECKERMAN: Would you read back
20 the question.
21 (Record read.)
22 Q. Do you feel you have answered that
23 question?
24 A. I answered the question of what
25 Audible Magic software was designed to do.
18
1 Jacobson
2 Q. Is it song filtering software?
3 MR. GABRIEL: Object to the form.
4 A. Define what you mean by filtering.
5 Q. What is filtering? Withdrawn.
6 Is it your testimony here under oath
7 you do not know what the word "filtering" means?
8 MR. GABRIEL: Object to the form.
9 Argumentative.
10 A. The term has many different uses.
11 I'm trying to --
12 Q. Is the audio designed by Audible
13 Magic designed for song filtering?
14 MR. GABRIEL: Object to the form.
15 Lack of foundation.
16 A. Will you repeat the question.
17 (Record read.)
18 A. I can't testify to what their design
19 team chose to design their software to do.
20 Q. So is it your testimony that you do
21 not know if this software has any application to
22 blocking song trades on peer-to-peer file sharing
23 networks?
24 MR. GABRIEL: Object to the form.
25 That's a different question.
19
1 Jacobson
2 You can answer the question.
3 A. Which application?
4 Q. The same one we've just been talking
5 about. The application designed by Audible Magic,
6 which was cross-licensed to Palisade Systems.
7 A. The Audible Magic code that was
8 licensed by Palisade does not block traffic.
9 Q. What does it do?
10 A. It identifies traffic content.
11 Q. Is it able to identify song files?
12 A. It is able to identify -- it is able
13 to identify --
14 It is able to analyze files and
15 determine if those files match the signatures that
16 are stored in their database.
17 Q. And was it marketed by Palisade
18 Systems as something that could identify and stop
19 illegal file trades in real time without any
20 requirement for individual users to be identified?
21 A. Yes, their code coupled with our
22 code.
23 Q. And was it marketed by Palisade
24 Systems as something that could block specific
25 illegal file trades?
20
1 Jacobson
2 A. Yes.
3 Q. Now, you are the chief technology
4 officer of Palisade?
5 A. That's correct.
6 Q. So you would be knowledgeable about
7 technology work between your company and Audible
8 Magic, is that not true?
9 MR. GABRIEL: Object to the form.
10 A. Define what you mean by technology
11 work.
12 Q. Development of computer programs.
13 A. I am knowledgeable as to how our
14 software operates and how the application interfaced
15 between our software and Audible Magic software
16 operates.
17 Q. Did your company work jointly with
18 Audible Magic to develop the first network
19 appliances that identified copyrighted works on the
20 fly combined with the ability to block individual
21 trades?
22 A. Our company worked with Audible Magic
23 to develop a product to stop peer-to-peer traffic as
24 identified by Audible Magic's proprietary code.
25 Q. And you are testifying here today
21
1 Jacobson
2 that you have no idea how the RIAA reacted to this
3 work that you are doing?
4 A. That's correct.
5 Q. Have the press releases issued by
6 Palisade Systems referred to the RIAA?
7 MR. GABRIEL: I object to the form.
8 Lack of foundation.
9 A. I'm sure that some of our press
10 releases have probably mentioned the RIAA.
11 Q. In what capacity?
12 MR. GABRIEL: Same objections.
13 A. I don't recall any direct quotes out
14 of any of the press releases.
15 Q. Did you ever meet with the CEO of
16 Audible Magic?
17 A. I recall meeting him in just a short
18 meeting when he visited Palisade, but I was not part
19 of the negotiations.
20 Q. Did you discuss the software?
21 MR. GABRIEL: The question is
22 whether Dr. Jacobson talked to the CEO
23 about the software? I'm just clarifying
24 the question.
25 Q. Did you discuss the software?
22
1 Jacobson
2 MR. GABRIEL: I object to the form.
3 A. I can't recall whether I did or
4 didn't.
5 Q. Have you formed an opinion as to
6 whether Marie Lindor personally uploaded any
7 copyrighted files to anyone?
8 A. The computer whose IP address has
9 been identified as being registered to Ms. Lindor
10 has been shown to have made songs available,
11 copyrighted material available to the internet
12 community through peer-to-peer software.
13 MO MR. BECKERMAN: I move to strike the
14 answer as nonresponsive.
15 Would you read back the question.
16 (Record read.)
17 MR. GABRIEL: Is there a question
18 pending?
19 MR. BECKERMAN: Yes. I'm waiting
20 for an answer to the question. It calls
21 for a "yes" or "no" answer.
22 MR. GABRIEL: I object. It does
23 not. He answered the question.
24 MR. BECKERMAN: Are you directing
25 him not to answer the question?
23
1 Jacobson
2 MR. GABRIEL: No, no.
3 THE WITNESS: Would you repeat the
4 question.
5 (Record read.)
6 MR. GABRIEL: My objection was he
7 just answered.
8 You can answer it again.
9 A. Again, the computer registered to
10 Marie Lindor had made available songs through
11 peer-to-peer software, therefore making them
12 available.
13 MR. BECKERMAN: I am going to say
14 this once and I am not going to repeat it.
15 We are here, we have a limited
16 time. I am on page 1 of about 40 pages
17 of notes. If this kind of gamesmanship
18 is going to be continued, we will never
19 get through even a fraction of this
20 deposition and we will just have to
21 continue it. But I have no intention of
22 accepting that type of answer.
23 If that's the way you are going
24 to play this, then we will be here all
25 day. It calls for a "yes" or "no"
24
1 Jacobson
2 answer and there is no reason to be
3 playing games in answering a question
4 that was not asked. He will be asked
5 questions that may relate to what his
6 answer was, but he has not answered the
7 question that was asked of him and it
8 calls for a "yes" or "no" and I expect
9 an answer to it.
10 MR. GABRIEL: It is a nice speech,
11 Ray. The witness answered the question.
12 I object to the characterization of
13 gamesmanship. Because you don't like the
14 answer doesn't mean it is gamesmanship.
15 The witness has answered, he has his
16 opinions. And if you want to argue with
17 me or the witness, we will be here all day
18 or we will leave.
19 MR. BECKERMAN: I am going to ask
20 the question one more time and if I do not
21 get an answer to it, we will eventually
22 seek a ruling on that and we are going to
23 seek a ruling on all questions that we do
24 not receive answers to, all questions to
25 which we do not receive answers to, and
25
1 Jacobson
2 then we will have a continued deposition.
3 MR. GABRIEL: You reserve whatever
4 you want, Ray, and seek whatever rulings
5 you want. The witness answered the
6 question and I submit this is browbeating
7 the witness into trying to get the witness
8 by arguing with me. This is not serving
9 any purpose.
10 BY MR. BECKERMAN:
11 RL Q. Have you formed an opinion as to
12 whether Marie Lindor personally uploaded any
13 copyrighted files, "yes" or "no"?
14 MR. GABRIEL: Objection. Form.
15 Asked and answered twice.
16 Q. Dr. Jacobson, would you please answer
17 the question.
18 A. I have twice already answered the
19 question.
20 Q. Are you refusing to answer the
21 question?
22 MR. GABRIEL: Objection.
23 Argumentative. He answered the question.
24 MR. BECKERMAN: We will seek a
25 ruling on that.
26
1 Jacobson
2 RL Q. Have you personally formed an opinion
3 as to whether Marie Lindor personally downloaded any
4 copyrighted files?
5 A. The computer whose IP address who has
6 been identified as belonging to Marie Lindor made
7 copyrighted material available through peer-to-peer
8 software -- made the material available through
9 peer-to-peer software.
10 MR. BECKERMAN: We also will seek a
11 ruling on that and we will seek a ruling
12 on all follow-up questions which would
13 have resulted from a "yes" or "no" answer.
14 MO I move to strike the nonresponsive
15 answer that was given.
16 Q. Based upon your examination of the
17 hard drive which you examined, what evidence did you
18 find that inculpated Marie Lindor personally?
19 MR. GABRIEL: Object to the form.
20 Lack of foundation.
21 A. Would you please define the
22 second-to-last word.
23 Q. "Her"?
24 A. No, "inculpated." Would you please
25 define that for me.
27
1 Jacobson
2 Q. Do you not know what the word
3 "inculpated" means?
4 A. That's correct.
5 Q. Are you familiar with the word
6 "exculpate"?
7 A. No.
8 Q. What is your educational background?
9 A. Computer engineering.
10 Q. Well, which school did you attend?
11 Did you get a Bachelor's degree?
12 A. Yes.
13 Q. What school?
14 A. Iowa State University, science and
15 technology.
16 Q. When did you graduate?
17 A. With which degree?
18 Q. When did you get your Bachelor's
19 degree?
20 A. 1980.
21 Q. Do you have any other degrees?
22 A. I hold a Master of Science in
23 electrical engineering.
24 Q. When did you get that?
25 A. 1982.
28
1 Jacobson
2 Q. Any other degrees?
3 A. A Doctor of Philosophy, Ph.D., in
4 computer engineering.
5 Q. When was that?
6 A. 1985.
7 Q. And you are associate professor at
8 Iowa State University?
9 A. That is correct.
10 Q. And you do not know what the word
11 "exculpate" means?
12 A. That's correct.
13 Q. Based upon your examination of the
14 hard drive which you examined in this case, what
15 evidence did you find that supported or would
16 support a conclusion that Marie Lindor had
17 personally uploaded any files?
18 A. The hard drive that I examined showed
19 no evidence of any peer-to-peer software or MP3
20 music files.
21 Q. So is it correct to say that there
22 was nothing on the hard drive that tended to prove
23 that she had uploaded or downloaded anything?
24 A. There was nothing on the hard drive
25 that indicated there was any peer-to-peer software.
29
1 Jacobson
2 Q. Hypothetically, had you discovered
3 KaZaA software and song files or remnants of KaZaA
4 software or song files resembling those that had
5 appeared in a screen shot, would that have tended to
6 support a finding that she had downloaded or
7 uploaded copyrighted files?
8 A. That would have supported a claim
9 that that computer was used to make files available.
10 Q. So it would have supported a finding
11 that the computer whose hard drive you examined had
12 been used for that purpose?
13 A. Correct.
14 Q. It would not have supported a
15 finding, would it, as to whether Marie Lindor
16 herself had used those programs or files?
17 MR. GABRIEL: Object to the form.
18 Lack of foundation.
19 THE WITNESS: Please read it back.
20 (Record read.)
21 A. That's correct.
22 Q. Hypothetically, had you discovered
23 substantial deletions, would that have supported a
24 finding that there had been the use of KaZaA file
25 sharing to download or upload copyrighted files?
30
1 Jacobson
2 MR. GABRIEL: Object to the form.
3 Lack of foundation.
4 A. Had I found substantial deletions of
5 the KaZaA software and music files, that would have
6 supported it.
7 Q. Had you discovered that the hard
8 drive had been entirely reformatted would that, in
9 your view, have supported a finding that the
10 computer had been used for uploading or downloading
11 copyrighted works?
12 MR. GABRIEL: Same objections.
13 A. Had the computer been reformatted,
14 there would have been no conclusion that I could
15 have drawn as to what was on the computer prior to
16 formatting.
17 Q. Hypothetically, had you discovered
18 substantial defragmentation of the hard drive, would
19 that have supported a finding that the computer had
20 been used to upload or download copyrighted works?
21 MR. GABRIEL: Same objection.
22 A. If that's all I had found, no, that
23 would not have supported.
24 Q. So you have concluded that the hard
25 drive that you examined was not used for KaZaA file
31
1 Jacobson
2 sharing; is that correct?
3 A. That's correct, as I testified or as
4 I -- in one of my documents, yes.
5 Q. Are you aware of any evidence of
6 anything that would point to Marie Lindor personally
7 having done something as opposed to any other
8 person?
9 MR. GABRIEL: Objection to the
10 form. Lack of foundation.
11 A. I have examined evidence that shows
12 that the computer registered to the IP address
13 belonging to Marie Lindor was used to share
14 copyrighted material.
15 Q. But other than that, other than the
16 fact that the computer was used, as you say, is
17 there any evidence to show what natural person, what
18 individual was the one who actually did it?
19 A. No.
20 Q. Do you know what processes and
21 procedures MediaSentry employed?
22 A. I do not know the inner works of
23 MediaSentry processes and procedures.
24 Q. Do you know what software they used?
25 A. No.
32
1 Jacobson
2 Q. Do you know if it was well known
3 off-the-shelf software or if it was proprietary
4 software?
5 A. Again, I do not know the inner
6 workings of MediaSentry's operations.
7 Q. Do you know if their software had
8 been peer-reviewed or published or anything like
9 that?
10 A. Not that I'm aware of.
11 Q. Have you ever testified as an expert
12 in a deposition?
13 A. No.
14 Q. Have you ever testified as an expert
15 in a trial?
16 A. No.
17 Q. Have you ever testified as an expert
18 in any other type of proceeding?
19 A. I testified in front of a school
20 board.
21 Q. As an expert?
22 A. Yes.
23 Q. On what subject?
24 A. A teacher was accused of viewing
25 pornography at school.
33
1 Jacobson
2 Q. There was no judge?
3 A. No.
4 Q. There was no arbitrator or judicial
5 type of person conducting it? It was just a school
6 board?
7 A. Yes.
8 Q. Has any judge or jury ever found your
9 methodology to be unreliable?
10 A. I've never been in front of a judge,
11 so no.
12 Q. Has any judge or jury ever found your
13 methodology to be reliable?
14 A. Again, I've never been in front of a
15 judge.
16 Q. Has anyone other than the RIAA ever
17 hired you to do a forensic examination of a hard
18 drive?
19 A. Yes.
20 Q. Who?
21 A. That school board. I'm currently
22 working on a --
23 MR. GABRIEL: Why don't you wait
24 until the ambulance passes.
25 MR. BECKERMAN: I don't think we --
34
1 Jacobson
2 MR. GABRIEL: It may take a while.
3 MR. BECKERMAN: This is New York,
4 Richard. This isn't Denver. We could be
5 here all day.
6 MR. GABRIEL: Just try to keep your
7 voice up.
8 A. I am currently working on two
9 forensic cases that are ongoing. I've done quite a
10 bit of forensic work for law enforcement which I do
11 pro bono.
12 Q. When were you first hired to do
13 forensic work on a hard drive?
14 MR. GABRIEL: Just for
15 clarification, when you say hired, does
16 that include the pro bono work he's
17 talking about?
18 MR. BECKERMAN: Yes.
19 A. On a hard drive, probably in the late
20 '80s.
21 Q. And who was that?
22 A. The Iowa State University. I've done
23 quite a bit of forensic work helping out various
24 individuals at the university.
25 Q. What law enforcement agency hired you
35
1 Jacobson
2 to do a forensic examination of a hard drive?
3 A. Again, I did it with no compensation.
4 I do all my forensic exams for law enforcement
5 through the Iowa State University police department.
6 However, they take in cases from other
7 jurisdictions. I don't always know the jurisdiction
8 that brought the case in.
9 Q. And they have never used you as a
10 witness?
11 A. No. We never -- they've always
12 settled.
13 Q. Apart for doing things for people at
14 Iowa State University how many times have you
15 been -- and apart from the RIAA, how many hard
16 drives have you done forensic examinations of?
17 A. By outside the university, do you
18 also mean outside the Iowa State Police Department?
19 Q. No.
20 A. I maybe misunderstood the question.
21 Can you restate the question or repeat the question?
22 Q. I will restate the question.
23 Apart from your work for the RIAA and
24 your work for people at Iowa State University, how
25 many hard drives have you been hired to do a
36
1 Jacobson
2 forensic examination of?
3 A. Probably half a dozen. It's been
4 over such a long period of time.
5 Q. What software did you use?
6 A. In the latest ones I've been using
7 EnCase.
8 Q. Which edition of EnCase?
9 A. I'm using 5.
10 Q. What did you use before?
11 A. I would use various Hex editors and
12 then -- before it was -- before we had sophisticated
13 software. Sometimes I would write software to
14 recover.
15 Q. When did you start using EnCase 5?
16 A. I don't remember the date that it
17 came out. Prior to that I was using version 4.
18 Q. When did you start using that?
19 A. Probably about three years ago.
20 Q. Has anyone other than the RIAA ever
21 hired you to opine on whether a particular computer
22 had been used for uploading or downloading
23 copyrighted works?
24 A. Copyrighted works?
25 Q. Yes.
37
1 Jacobson
2 A. No.
3 Q. How long have you been using your
4 present method of determining whether a particular
5 computer has been used for uploading or downloading
6 copyrighted works?
7 A. About a year and a half.
8 Q. When did you learn your present
9 method of determining whether a particular computer
10 has been used for uploading or downloading
11 copyrighted works? Or did you develop it yourself?
12 A. Clarification. Are you talking about
13 exams on the hard drives or just the process, the
14 entire process?
15 Q. Well, you have a method, do you not?
16 A. I have a method for examining hard
17 drives and I have a method for reviewing the
18 MediaSentry material.
19 Q. So these are two different things?
20 One isn't tied into the other?
21 A. They are two different processes.
22 Q. Okay. So let's break it down. Your
23 method of --
24 The MediaSentry materials are
25 gathered through the internet?
38
1 Jacobson
2 A. Yeah. MediaSentry gathers the
3 material through the internet.
4 Q. How did you learn your method of
5 interpreting -- withdrawn.
6 Are you able --
7 I am having a little difficulty with
8 this conceptually. You are breaking it down into
9 two separate processes. Is it your testimony that
10 there is a way to detect whether a computer has been
11 used for uploading or downloading copyrighted works
12 without both looking at the MediaSentry material and
13 the hard drive?
14 A. Yes.
15 Q. Let's break it down, then, into two
16 separate things.
17 How did you learn your method of
18 determining from the MediaSentry materials whether a
19 particular computer has been used for uploading or
20 downloading copyrighted works?
21 A. It was a process that I developed.
22 Q. You developed it on your own?
23 A. Yes.
24 Q. How did you learn your method of
25 determining from a hard drive whether a particular
39
1 Jacobson
2 computer has been used for uploading or downloading
3 copyrighted works?
4 A. Well, the forensic examination
5 process I learned through self-study and through the
6 forensic examiner's exam.
7 Q. Now, am I correct that you were doing
8 this for law enforcement before you were a certified
9 forensic examiner?
10 A. That's correct.
11 Q. And when did you become a certified
12 forensic examiner?
13 A. September '04.
14 Q. And why did you become a certified
15 forensic examiner?
16 A. Two reasons. One is to be able to
17 better work with the law enforcement and the other
18 is to help support our university's educational
19 mission, since we teach computer forensics.
20 Q. Wouldn't a third reason be that it
21 might give you standing to testify in a court of law
22 as to your forensic examinations of hard drives?
23 A. That I would tie in with the first
24 reason, to work better with law enforcement.
25 Q. What about your private work for the
40
1 Jacobson
2 recording industry of America?
3 A. I was a certified examiner before I
4 was engaged by the recording industry.
5 Q. Isn't it a fact that you were engaged
6 by the RIAA in 2002?
7 A. It was in September '05.
8 Q. You were not doing any work for them
9 in 2002?
10 A. No. My first work for them was in
11 the fall of 2005. I can't remember my first trip to
12 Kansas City.
13 Q. And you weren't doing any work for
14 them in 2003?
15 A. No.
16 Q. And you weren't doing any work for
17 them in 2004?
18 A. I started working with the law firm
19 in the fall of 2005.
20 MR. BECKERMAN: Off the record.
21 (Discussion off the record.)
22 Q. Has your method of determining from
23 the MediaSentry materials whether a particular
24 computer has been used for uploading or downloading
25 copyrighted works been tested by any testing body?
41
1 Jacobson
2 A. Not that I have submitted.
3 Q. Do you know anyone else that is using
4 your method, other than you?
5 A. Not that I'm aware of.
6 Q. Has your method of determining
7 through the MediaSentry materials whether a
8 particular computer has been used for uploading or
9 downloading copyrighted works been subjected to any
10 form of peer review?
11 A. Not that I'm aware of.
12 Q. Has your method of determining from
13 the MediaSentry materials whether a computer has
14 been used for uploading or downloading copyrighted
15 works been published?
16 A. No.
17 Q. Is there a known rate of error for
18 your method?
19 A. No.
20 Q. Is there a potential rate of error?
21 MR. GABRIEL: Object to the form.
22 A. I guess there is always a potential
23 of an error.
24 Q. Do you know of a rate of error?
25 A. To my process, no.
42
1 Jacobson
2 Q. Are there any standards and controls
3 over what you have done?
4 A. No.
5 Q. Have your methods been generally
6 accepted in the scientific community?
7 A. The process has not been vetted
8 through the scientific community.
9 Q. Have you had communications with
10 MediaSentry?
11 A. Not that I recall.
12 Q. Have MediaSentry's methods been
13 tested by any testing body?
14 A. I don't know.
15 Q. Have MediaSentry's methods been
16 subjected to any form of peer review?
17 A. I don't know.
18 Q. Have MediaSentry's methods been
19 published?
20 A. I don't know.
21 Q. It's a fact, is it not, that
22 MediaSentry's methods are secret?
23 MR. GABRIEL: Objection of lack of
24 foundation.
25 A. I don't know.
43
1 Jacobson
2 Q. Is there a known rate of error for
3 MediaSentry's methods?
4 A. Not that I'm aware of.
5 Q. So when you evaluate the MediaSentry
6 materials you are assuming them to be accurate?
7 A. Yes.
8 Q. Is there a potential rate of error
9 for MediaSentry's methods?
10 MR. GABRIEL: Object to the form.
11 A. There is always a potential for an
12 error.
13 Q. Are there any standards and controls
14 over MediaSentry's methods?
15 A. I don't know.
16 Q. Have MediaSentry's methods been
17 generally accepted in the scientific community?
18 MR. GABRIEL: Object to the form.
19 Lack of foundation.
20 A. Not that I know of.
21 Q. Is MediaSentry peer-regulated?
22 A. Not that I know of.
23 Q. Apart from your work on RIAA
24 litigations against owners of internet access
25 accounts, have you engaged in research on
44
1 Jacobson
2 determining whether specific individual computer
3 users engaged in copyright infringement through
4 peer-to-peer file sharing?
5 MR. GABRIEL: I'm sorry. I lost
6 the question. Could you repeat it,
7 please?
8 Q. Apart from your work on the RIAA
9 cases, have you engaged in any research on methods
10 of determining whether specific individual computer
11 users engaged in copyright infringement through the
12 use of P2P file sharing?
13 A. Yes.
14 Q. And what kind of research was that?
15 A. Obviously there was some research
16 done through Palisade as part of its product rollout
17 dealing with how to identify the individuals within
18 an organization. One of my grad students also
19 worked on the project to identify users of
20 peer-to-peer software, although that was focused
21 more on child pornography than it was copyright
22 material.
23 Q. I would like to leave aside research
24 that may have been done by others. I mean to ask
25 whether you personally have engaged in research.
45
1 Jacobson
2 A. Through Palisade as part of product
3 development.
4 Q. Is that something that is research
5 which is private and proprietary?
6 A. No. The piece I did is no longer
7 used as the technology, so it's not.
8 Q. Was it ever published?
9 A. No. At the time it was proprietary
10 to Palisade.
11 Q. And now it's been replaced by other
12 methods?
13 A. Yes.
14 Q. Apart from your work on the RIAA
15 cases, have you engaged in any research on methods
16 of determining whether specific computer hard drives
17 contained evidence of copyright infringement through
18 peer-to-peer file sharing?
19 A. No.
20 Q. Do any of your three reports -- by
21 "three reports" I'm referring to the April 7th
22 initial report, the December 19th declaration that
23 you signed and the October report which you did not
24 sign. Do any of those three reports discuss the
25 possibility of any alternate explanations other than
46
1 Jacobson
2 copyright infringement?
3 MR. GABRIEL: Object to form to the
4 extent that they speak for themselves.
5 You can answer the question.
6 A. Please read the question. I didn't
7 understand.
8 (Record read.)
9 A. Alternate explanations to?
10 Q. Your conclusions.
11 A. No.
12 I'm sorry. I said, "No."
13 Q. Did any of the three reports discuss
14 any alternate explanations other than KaZaA
15 appearing on a file owned by Marie Lindor?
16 MR. GABRIEL: Object to the form.
17 They speak for themselves.
18 A. What do you mean by KaZaA appearing
19 on a file?
20 Q. I'm sorry, I misspoke. Do any of
21 your three reports discuss the possibility of any
22 alternate explanations other than KaZaA appearing on
23 a computer owned by Marie Lindor?
24 A. No.
25 Q. Are you, as we sit here, capable of
47
1 Jacobson
2 thinking of some alternate explanations?
3 A. Yes.
4 Q. Can you think of any possible
5 infirmities in MediaSentry's methods as we sit here?
6 MR. GABRIEL: Object to form and
7 foundation. I'm sorry.
8 A. I don't have an inner knowledge of
9 their methods so I...
10 Q. Can you think of any possible
11 security vulnerabilities in the computer that was in
12 Marie Lindor's apartment?
13 MR. GABRIEL: Object to form and
14 foundation.
15 A. Repeat the question. Read it back.
16 (Record read.)
17 A. I didn't examine the hard drive that
18 was given to me for security vulnerabilities, so I
19 can't attest to what vulnerabilities may have been
20 present in that hard drive.
21 Q. As we sit here, can you think of any
22 possible security vulnerabilities in the computer
23 that was in Marie Lindor's apartment?
24 MR. GABRIEL: Objection to form.
25 Lack of foundation.
48
1 Jacobson
2 A. Read that back.
3 (Record read.)
4 A. Can you read it one more time.
5 (Record read.)
6 A. I'm sure the possibility exists there
7 were security vulnerabilities. Again, I don't know
8 which ones would apply to that particular computer.
9 Q. And did your report discuss any of
10 those possible security vulnerabilities?
11 A. No.
12 Q. Did you testify at an United States
13 Senate committee in September of 2003?
14 A. Yes.
15 Q. Did you make this statement?
16 "In summer of 2000 we introduced
17 PacketHound which is designed to detect, monitor and
18 block unauthorized peer-to-peer applications."
19 A. That sounds like -- that sounds like
20 a statement I made.
21 Q. Did you make this statement?
22 "There are no effective controls
23 regarding content provided on a peer-to-peer
24 network."
25 A. Again, that sounds like a statement I
49
1 Jacobson
2 made.
3 Q. And did you make this statement?
4 "Both the provider and the requester
5 of the file are not easily detected."
6 A. Again, that sounds like a statement
7 that was in that testimony. I don't have the
8 testimony in front of me, so I ...
9 Q. Did you make this statement?
10 "These technologies are not designed
11 for the home users."
12 A. Again, that sounds like a statement
13 that was in the testimony.
14 Q. Did you make this statement?
15 "This leaves individuals on their own
16 to solve the problems of peer-to-peer networking."
17 A. Again, that sounds like a statement
18 that was in the testimony.
19 Q. Did you make this statement?
20 "Which naturally leaves us to the
21 question, what is the homeowner to do?"
22 A. Again, that sounds like something
23 that was in that testimony.
24 Q. Did you make this statement?
25 "Unlike web filtering, where certain
50
1 Jacobson
2 sites can be blocked and web access can be
3 monitored, peer-to-peer traffic cannot be filtered
4 based on its content. This leaves a home user no
5 choice but to either allow peer-to-peer activity and
6 all of its associated risks or not allow any
7 peer-to-peer applications on their machines."
8 A. Again, that sounds like what was in
9 that testimony.
10 Q. Are you familiar with Steven Gottlieb
11 of the RIAA?
12 A. I've heard the name but that's it.
13 Q. Do you agree with this statement
14 which I will represent to you he made on
15 November 15, 2004 in comments he provided to the
16 Federal Trade Commission?
17 "P2P services often configure their
18 software to share content by default. What users
19 often do not know is that they may be sharing their
20 tax records, financial records, health records,
21 business records, e-mail and other personal and
22 private material."
23 Do you agree with that statement?
24 A. Oh, I'm sorry. Yes.
25 Q. Do you agree with this statement,
51
1 Jacobson
2 which I represent to you was made by Mr. Gottlieb?
3 "As an additional matter P2P software
4 may, upon installation, automatically search a
5 user's entire hard drive for content, files that
6 users have no intention of sharing may end up being
7 offered to the entire P2P network."
8 A. Yes.
9 Q. Do you agree with this statement
10 which I represent to you was made by Mr. Gottlieb?
11 "Continued sharing of personal
12 information is hard to avoid and is facilitated by
13 confusing and complicated instructions for
14 designating shared items."
15 A. Yes.
16 Q. Do you agree with this statement also
17 made by Mr. Gottlieb?
18 "A study by Nathaniel S. Good and
19 Aaron Krekelberg at HP Laboratories showed that the
20 majority of the users were unable to tell what files
21 they were sharing and sometimes incorrectly assumed
22 they were not sharing any files when in fact they
23 were sharing all files on their hard drive.
24 MR. GABRIEL: Object to the form.
25 Lack of foundation.
52
1 Jacobson
2 A. I guess I can't quantify some, most,
3 all. I'm sorry.
4 Q. Are you familiar with the report by
5 Nathaniel Good and Aaron Krekelberg at HP
6 Laboratories?
7 A. No.
8 MR. GABRIEL: When we get to a good
9 stopping point, can we take five? It's
10 been an hour and a half.
11 MR. BECKERMAN: Sure.
12 (Recess taken.)
13 Q. Your reports state your conclusions;
14 is that correct?
15 A. Yes.
16 Q. And they state that your conclusions
17 were based upon --
18 Withdrawn. I shouldn't lump the
19 three together.
20 The April report states that
21 conclusions were based upon the materials that had
22 been provided to you by MediaSentry plus a few other
23 documents; is that correct?
24 A. Yes.
25 Q. Does that report explain how you
53
1 Jacobson
2 formed your conclusions from those documents?
3 A. Not in any detail.
4 Q. How many reports have you issued for
5 the RIAA?
6 A. Maybe 200. I don't know, don't
7 recall the exact count.
8 MR. BECKERMAN: I would like to
9 leave a space in the record for that
10 number.
11 TO BE FURNISHED:____________________________________
12 ____________________________________________________
13 Q. How many of those reports concluded
14 that there was in fact downloading or uploading of
15 plaintiff's copyright files?
16 A. All of the -- yes, all of the
17 reports.
18 Q. How much time did you spend on each
19 report?
20 A. A typical report takes me about 45
21 minutes.
22 Q. And how much time did you spend on
23 the April 2006 report in this case?
24 A. Without seeing the billing records, I
25 can only guess but I think it was 45 minutes.
54
1 Jacobson
2 Q. How much time did you spend preparing
3 the unsigned October report?
4 A. That was -- not that one.
5 I'm sorry. I was pointing to
6 something on your desk. I probably shouldn't do
7 that.
8 MR. GABRIEL: After you looked at
9 the hard drive he is asking about.
10 THE WITNESS: Okay. Thank you.
11 Q. Would you like me to show you a copy?
12 A. No. I just wanted to clarify between
13 the two reports that --
14 Again, without looking at the billing
15 records, I would say probably two to four hours.
16 Q. And how much time did you spend on
17 the December 19th declaration?
18 A. Maybe 15 minutes.
19 Q. If a hard drive had been used for
20 peer-to-peer file sharing with KaZaA, would your
21 forensic inspection have allowed you to see whether
22 a file sharing program had been downloaded or
23 installed?
24 A. If the program was present on the
25 hard drive, a forensic examination would have shown
55
1 Jacobson
2 that.
3 Q. Similarly, if the hard drive had been
4 used for peer-to-peer file sharing with KaZaA, would
5 your forensic inspection have allowed you to see
6 whether there was a shared files folder on the
7 computer?
8 A. Yes.
9 Q. And, again, if the hard drive had
10 been used for peer-to-peer file sharing with KaZaA,
11 would your forensic inspection have shown you
12 whether there were audio files or remnants, or
13 evidence thereof, of the files that MediaSentry had
14 observed?
15 A. Yes.
16 Q. Under those same circumstances, would
17 your forensic inspection have allowed you to see
18 whether a party had attempted to delete file sharing
19 programs or other files?
20 A. Yes.
21 Q. Now, a dynamic IP address is
22 allocated very often for a short period of time; is
23 that not correct?
24 A. It depends how you define "short."
25 Q. Well, you yourself used that
56
1 Jacobson
2 technology, did you not?
3 A. Yes.
4 Q. So what is the shortest it could be?
5 There is no shortest, is there? It could be for a
6 split second?
7 A. A computer can request and release.
8 Q. It could be for hours or it could be
9 for seconds or --
10 A. It could be for days, yes.
11 Q. Would it be possible to have the same
12 dynamic IP address assigned to three people during
13 one minutes?
14 MR. GABRIEL: Object to the form.
15 A. It's possible.
16 Q. Now, the users of a peer-to-peer
17 network often think they are anonymous when they
18 distribute files. Isn't that true?
19 A. In my opinion, a lot of users feel
20 that they are anonymous.
21 Q. In your April 7th report you say that
22 in reality they can be identified using the IP
23 address. Is that not what you said in your report?
24 A. Yes, sir.
25 Q. That's not exactly true, is it?
57
1 Jacobson
2 A. I guess I'm not clear what you mean
3 by that.
4 Q. Well, it's true, is it not, that
5 there can be more than one computer operating under
6 a single IP address?
7 MR. GABRIEL: Object to the form.
8 A. As I talked about it in the report
9 with public IP addresses, in order for the internet
10 to function there can only be -- every public IP
11 address has to be globally unique within that window
12 of time.
13 Q. But there can be more than one
14 computer operating behind that IP address?
15 MR. GABRIEL: Same objection.
16 A. Every -- I don't understand what you
17 are asking. Every device connecting to the public
18 internet has to have a global unique address.
19 Q. And a device doesn't have to be a
20 computer, does it?
21 A. That's correct.
22 Q. It could be a router, correct?
23 A. Yes.
24 Q. It could be a wired router?
25 A. Yes.
58
1 Jacobson
2 Q. It could be a wireless router?
3 A. Yes.
4 Q. And if there is a firewall, under
5 most circumstances no one would know the various
6 computers or devices behind the router, would they?
7 MR. GABRIEL: Object to form.
8 A. It depends on the type of router.
9 Q. Is it possible for more than one
10 device to be operating behind a single IP address?
11 A. Yes.
12 Q. Now, when we get to the devices, some
13 of the devices are computers. Is that not correct?
14 A. Yes.
15 Q. And is it possible for a computer to
16 have more than one user?
17 A. Yes.
18 Q. So, in other words, when a person is
19 engaged in peer-to-peer file sharing, it's not the
20 person that could be identified by an IP address, is
21 it?
22 MR. GABRIEL: Object to the form.
23 Lack of foundation.
24 Q. Isn't it the MAC address that is
25 identified?
59
1 Jacobson
2 MR. GABRIEL: Object to form.
3 A. I don't understand the follow-on
4 statement.
5 Q. Do you know what a MAC address is?
6 A. Yes.
7 Q. Can a router have a MAC address?
8 A. Yes.
9 Q. If I had ten different companies
10 operating behind a router and I had a properly
11 functioning firewall or firewalls, would anybody in
12 the wide network actually know what was behind the
13 router with the properly functioning firewall?
14 MR. GABRIEL: Object to the form.
15 Lack of foundation.
16 A. It's possible to determine who is
17 behind that, so to say that there is no way to know
18 is not true.
19 Q. How could you find out?
20 A. Potentially based on the activity
21 coming out. There is lots of ways that attackers
22 could use to determine what is behind a firewall.
23 Q. But one method to identify that
24 person would not be the IP address. The IP address
25 alone would not tell you that, would it?
60
1 Jacobson
2 A. Would not tell you what?
3 Q. What individual was sharing files.
4 A. By "individual" do you mean
5 flesh-and-blood person?
6 Q. Yes.
7 A. The IP address tells you the identity
8 of the computer.
9 Q. It actually doesn't tell you the
10 identity of the computer. It tells you the identity
11 of the device.
12 A. That's correct.
13 Q. And it doesn't actually tell you the
14 identity of the device. It tells you a MAC address?
15 MR. GABRIEL: Objection to form.
16 A. IP address does not tell you a MAC
17 address.
18 Q. How could it tell you the identity of
19 the device? How would you identify a device other
20 than by a MAC address?
21 A. Every device in the public internet
22 is configured with an IP address.
23 Q. Which would link to what?
24 A. Which links to the device.
25 Q. And how do you identify the device on
61
1 Jacobson
2 the internet?
3 A. Again, every device is identified
4 through its IP address. The MAC address is only
5 valid from one local connection to another.
6 Q. What is the one thing unique about
7 each device?
8 MR. GABRIEL: Object to the form.
9 A. Unique to it or that uniquely tells
10 them apart?
11 Q. That tells them apart.
12 A. On the internet the only requirement
13 for uniqueness is the IP address.
14 Q. So when you say that in reality they
15 can be identified using the IP address, your
16 testimony is that it's not the user that can be
17 identified, it's a computer that can be identified?
18 Is that your testimony?
19 Or is your testimony that it is the
20 computer on the network device that is interfacing
21 with the wide network?
22 A. The IP address identifies the
23 computer or device that is connected to the wide --
24 to the internet.
25 Q. And the device might be a network
62
1 Jacobson
2 card?
3 A. Generally network card doesn't have
4 an IP address. The computer is what has the IP
5 address.
6 Q. The device might be a router?
7 A. That's correct.
8 Q. In that report you said that the IP
9 address of the computer can be captured by a user
10 during a search or file transfer. Now, you don't
11 exactly mean of the computer; you mean of the
12 computer or network device, right?
13 A. In the peer-to-peer file transfer the
14 device running -- the computer running the
15 peer-to-peer software reports its IP address
16 along with -- in addition to that, the IP address of
17 the -- if it is behind a router that separates
18 public and private addresses, then the IP address of
19 the public internet will also be shown.
20 Q. But when you said that the IP address
21 of the computer offering the files for distribution
22 can be captured by a user during a search or file
23 transfer, you didn't really mean the computer. You
24 meant the computer or network device?
25 A. In order for the peer-to-peer
63
1 Jacobson
2 software to work, you have to have the identity of
3 the machine holding the music or holding the data.
4 Q. Even if it's going through a router?
5 You're saying there is more than one IP address
6 going through a router?
7 A. The peer-to-peer software will
8 present an IP address within the data payload of the
9 IP packet.
10 Q. Well, what I'm trying to understand
11 is why in your report, referring to your April
12 report, it seems to me that when you were making
13 general descriptions of the technology involved, you
14 kept saying computer or network device but then when
15 you were coming to your conclusions about the
16 defendant, then you all of a sudden started talking
17 about computers and you left out network devices. I
18 was wondering why.
19 Do you agree with that, what I am
20 saying?
21 A. Yes.
22 Q. Why did you do that? Why did you
23 stop mentioning network devices?
24 A. Because in an examination of
25 MediaSentry data, I concluded that it was a computer
64
1 Jacobson
2 at that IP address.
3 Q. And how did you come to that
4 conclusion?
5 A. Through the MediaSentry traffic
6 captures which shows the IP address of the actual
7 computer and the IP address of the packet in transit
8 across the internet, and those two IP addresses were
9 both public and both matched.
10 Q. What is the document you are
11 referring to for MediaSentry?
12 A. I think it was the download.text file
13 or download log maybe they call it.
14 Q. The log for the user?
15 A. No.
16 MR. GABRIEL: Do you want to go off
17 the record for a minute and find it?
18 MR. BECKERMAN: No. We are on the
19 record.
20 Q. The Marie system log? Lindor, Marie
21 system log?
22 A. No. That's not the system log. It
23 could be the download record.
24 Q. This one (indicating)?
25 A. Yes.
65
1 Jacobson
2 MR. BECKERMAN: I would like to
3 mark as Exhibit 6 a printout of numbered
4 pages 36 to 45.
5 (Defendant's Exhibit 6, printout of
6 numbered pages 36 to 45, marked for
7 identification, as of this date.)
8 Q. So this tells you that there was no
9 router?
10 A. This tells me that there was -- yes.
11 There was no router.
12 Q. How does it tell you that there was
13 no router?
14 A. Through the two --
15 If you look at the second chunk down,
16 you will see the source address at the top and you
17 will see the KaZaA IP address midway through that,
18 and they match and they are both public IP
19 addresses.
20 Q. You said they match?
21 A. Uh-huh. The 141.155.57.198.
22 Q. That's the source?
23 A. And then down below you see the KaZaA
24 IP?
25 Q. Yes.
66
1 Jacobson
2 A. It's those two IP addresses.
3 Q. What does the first number indicate?
4 A. The first number of the IP address?
5 Q. Yes.
6 No. The second line of that chunk
7 that says "source." What does that indicate?
8 A. That is the source address. That is
9 where the packet came from.
10 Q. Now we go down to the next line you
11 referred to, it says "KaZaA IP." What does that
12 refer to?
13 A. That is the IP address that the KaZaA
14 software is running on, the IP address of the
15 computer that the KaZaA software is running on.
16 Q. What is the next line?
17 A. A supernode. That's the supernode
18 that KaZaA is connected to.
19 Q. So, in other words, this went in
20 directly through the supernode? So you are saying
21 this transmission went through the supernode?
22 MR. GABRIEL: Objection to form.
23 A. No. This packet just indicates
24 that -- where the supernode is that KaZaA is talking
25 to. The packet as shown by the second line is the
67
1 Jacobson
2 actual source address of the internet packet.
3 Q. What is the next line, the KaZaA IP?
4 A. Oh.
5 Q. The line down below where you say the
6 two numbers match, what is the meaning of that
7 number?
8 A. Which one? The KaZaA IP?
9 Q. You said it is the same number.
10 A. Right.
11 Q. Where it says "KaZaA IP" and there is
12 the same number.
13 A. As line 2, yes. That is the -- that
14 is the --
15 Q. What is the significance of that
16 line?
17 MR. GABRIEL: Let him ask the
18 question and then you answer. He asked
19 what is the significance of that line.
20 A. Of the line "KaZaA IP"?
21 Q. Yes.
22 A. That is the IP address that the KaZaA
23 software is using.
24 Q. And how is that determined?
25 A. It's determined by the KaZaA software
68
1 Jacobson
2 itself.
3 Q. Why wouldn't those two numbers always
4 be the same?
5 A. In the case of a router as you
6 described earlier that has private addresses on the
7 inside, you will see those numbers be different.
8 Q. So you are saying there can be
9 different IP addresses for different devices behind
10 the router?
11 A. Yes.
12 Q. What does the presence of the
13 supernode line indicate?
14 A. It indicates the supernode, that the
15 KaZaA software is used to perform the searches.
16 Q. So does this indicate that the
17 computer that's referred to on -- whose IP address
18 is referred to on the source line and the KaZaA IP
19 line is not a supernode?
20 A. It indicates that that computer is
21 communicating with that supernode in order to do the
22 searches.
23 Q. And how did MediaSentry determine
24 these numbers?
25 A. Line 2 of that section is the address
69
1 Jacobson
2 that is carried within the data packet as it
3 traverses across the internet. The line that starts
4 "X-KaZaA-IP" is part of the data payload within that
5 packet.
6 Q. And how do you know that? Didn't you
7 say you have never communicated with MediaSentry?
8 A. That's correct.
9 Q. So how do you know that?
10 A. Because I understand how KaZaA
11 operates.
12 Q. And how did you come to understand
13 how KaZaA operates?
14 A. Through researching protocol.
15 Q. Starting when?
16 A. I can't remember the exact date I
17 started researching KaZaA. It was all part of the
18 work Palisade did in the production of PacketHound.
19 Q. Are you familiar with the Ross
20 studies of KaZaA?
21 A. Not offhand.
22 Q. You never read them?
23 A. I don't recall without seeing one.
24 MR. BECKERMAN: I would like to
25 mark as Exhibit 7 a study entitled "The
70
1 Jacobson
2 KaZaA Overlay: A Measurement Study."
3 (Defendant's Exhibit 7, study
4 entitled "The KaZaA Overlay: A Measurement
5 Study," marked for identification, as of
6 this date.)
7 Q. So have you reviewed this report at
8 any time?
9 A. Yes, I have.
10 Q. I direct your attention to Page 17
11 and I call your attention to in the middle of the
12 page a sentence that starts with the words "later
13 versions." The statement says, "Later versions
14 (KMDV 2.0+ and KaZaA-Lite) employ dynamic port
15 numbers to evade firewalls."
16 Do you agree with that statement?
17 MR. GABRIEL: Objection. Lack of
18 foundation.
19 A. Yes.
20 Q. Going down to the end of that
21 paragraph, I will read you the last sentence and ask
22 if you agree with that sentence.
23 "Since the KaZaA port numbers are
24 dynamic, it is very difficult to block KaZaA
25 connections unless a very rigid filtering policy is
71
1 Jacobson
2 employed at the firewall." Do you agree with that
3 statement?
4 MR. GABRIEL: Object to form. Lack
5 of foundation.
6 A. Yes.
7 Q. Now I refer you to the first sentence
8 of the next paragraph.
9 "The reality of today's internet is
10 that a large fraction of peers reside behind NATs."
11 Do you agree with that statement?
12 MR. GABRIEL: Object to form. Lack
13 of foundation.
14 A. I don't have any way to know what
15 fraction.
16 Q. Do you agree that NATs exist?
17 A. Yes.
18 Q. What is a NAT?
19 A. The term stands for network address
20 translator. It is a router that on one side has a
21 public IP address and on the other side maintains or
22 has a set of what I want to refer to as private or
23 sometimes inside IP addresses, which are addresses
24 that are not allowed on the public internet.
25 Q. And do you agree that the existence
72
1 Jacobson
2 of a network address translator makes it difficult
3 to detect the IP address of specific computers
4 behind the router?
5 MR. GABRIEL: Objection to form.
6 Lack of foundation.
7 A. By router do you mean network address
8 translator?
9 Q. Yes.
10 A. Yes.
11 Q. And do you agree that KaZaA has used
12 a connection reversal in order to try to overcome
13 that?
14 MR. GABRIEL: Objection to form.
15 Lack of foundation.
16 A. I agree with the definition that they
17 specify in the article. I've never heard that
18 specific term.
19 MR. BECKERMAN: I would like to
20 mark as Exhibit 8 a one-page chart.
21 (Defendant's Exhibit 8, one-page
22 chart, marked for identification, as of this
23 date.)
24 Q. Can you identify what that displays?
25 MR. GABRIEL: Object to foundation.
73
1 Jacobson
2 He didn't draft it.
3 You can answer the question.
4 A. I don't know the intent of it but it
5 shows, as it's labeled, a cable modem connected to
6 the internet. And it shows a set of IP addresses,
7 all of which are the private -- designated as parts
8 of the private IP address range.
9 Q. Going back to the study, Exhibit 7, I
10 call your attention to Page 21, a paragraph bearing
11 number 7, and I'm going to the last two sentences
12 and I am going to ask if you agree with this
13 statement. "KaZaA uses dynamic port numbers along
14 with" --
15 A. I'm sorry. I am not finding it.
16 Q. Page 21, there is a paragraph number
17 7.
18 A. Okay. I'm sorry.
19 Q. I am asking if you agree with this
20 statement. "KaZaA uses dynamic port numbers along
21 with its hierarchical design to avoid firewall
22 blocking."
23 Do you agree with that?
24 MR. GABRIEL: Objection to form.
25 Lack of foundation.
74
1 Jacobson
2 A. I know KaZaA uses dynamic port
3 numbers. Whether that was the original design
4 intent to avoid firewalls would be a fair
5 assumption.
6 Q. The next sentence, do you agree with
7 that statement ?
8 "Furthermore, it uses connection
9 reversal to allow NATed peers to share files."
10 MR. GABRIEL: Objection to form.
11 Lack of foundation.
12 A. Yes.
13 Q. When you studied KaZaA, did you
14 familiarize yourself with the concept of pollution
15 on KaZaA?
16 A. No.
17 Q. Do you know what pollution is on
18 KaZaA?
19 A. My understanding is it is putting
20 things out into the network KaZaA that either
21 misrepresents the content or for some reason is not
22 what it says to be.
23 MR. BECKERMAN: I will mark this as
24 Exhibit 9. It is a paper entitled
25 "Pollution in P2P File Sharing Systems."
75
1 Jacobson
2 (Defendant's Exhibit 9, paper
3 entitled "Pollution in P2P File Sharing
4 Systems," marked for identification, as of
5 this date.)
6 Q. Going to the first page, the
7 right-hand column, the first full paragraph, the
8 first sentence starts with "One sabotage technique."
9 I will ask if you agree with this statement.
10 MR. GABRIEL: I'm sorry. Where are
11 you?
12 I got it.
13 Q. "One sabotage technique that is
14 particularly prevalent today is that of pollution."
15 Do you agree with that statement?
16 MR. GABRIEL: Objection to form.
17 Lack of foundation.
18 A. I don't have any knowledge that as
19 they define pollution it is prevalent on the
20 peer-to-peer systems.
21 Q. Are you aware that one of
22 MediaSentry's areas of business is pollution?
23 A. No.
24 Q. Are you aware that MediaSentry is in
25 the business of sending out decoy files?
76
1 Jacobson
2 MR. GABRIEL: Objection to form.
3 A. No.
4 MR. GABRIEL: Sorry. Belated
5 objection to the form.
6 Q. Excuse me?
7 A. No.
8 Q. I turn you to the second page, the
9 first full paragraph. About two-thirds of the way
10 down in the paragraph there is a sentence that
11 starts "We will see that." I call your attention to
12 that sentence and ask if you agree with this
13 statement.
14 "We will see that pollution is indeed
15 pervasive with more than 50 percent of the copies of
16 many popular recent songs being polluted in KaZaA
17 today." Do you agree with that?
18 MR. GABRIEL: Objection to form.
19 Lack of foundation.
20 A. I have no way of knowing if that's
21 true or false.
22 Q. So is it your testimony that you are
23 not knowledgeable about pollution?
24 MR. GABRIEL: Objection to form.
25 Q. Are you knowledgeable about
77
1 Jacobson
2 pollution?
3 A. Only to the extent that I know what
4 it is.
5 Q. And that's the sole extent of your
6 knowledge?
7 A. Yes.
8 Q. And are you familiar with the
9 distinction between content pollution and metadata
10 pollution?
11 A. I just now read their classification.
12 Q. Is it the first time you ever learned
13 of the distinction between those two terms?
14 A. Yes.
15 Q. So it would be fair to say that your
16 expertise does not extend to the nature and extent
17 and methods of pollution on KaZaA?
18 A. Yes.
19 Q. When you in your report refer to
20 analogizing an IP address to a return address and a
21 send address on a letter, would you say that analogy
22 is somewhat incorrect?
23 A. There is probably no perfect analogy
24 but it's a reasonable analogy to use for a lay
25 explanation.
78
1 Jacobson
2 Q. Is it fair to say that your postal
3 address is to your home whereas an IP address would
4 be more like an address to a timeshare that you
5 might occupy for a split second or for a minute?
6 MR. GABRIEL: Objection to form.
7 A. The IP address delivers to a device
8 or location.
9 Q. But not a person?
10 A. That's correct.
11 Q. And not for any given amount of time,
12 just as long as the internet connection stays on
13 line?
14 MR. GABRIEL: Objection to form.
15 A. Define what you mean by internet
16 connection.
17 Q. You don't know what I mean by an
18 internet connection?
19 A. There are multiple definitions.
20 Q. Why don't you give me the most common
21 meaning.
22 A. There is an application layer
23 connection which is used by individual applications
24 to communicate.
25 Q. With a dynamic IP address is the
79
1 Jacobson
2 person using it still using it after he's
3 disconnected from the internet?
4 MR. GABRIEL: Objection to form.
5 A. Depending on how they are connected,
6 the dynamic address may be dropped.
7 Q. You're saying they could end their
8 connection to the internet and still -- and the
9 dynamic IP address stays in effect and then if they
10 turn it back on, they could pick up the same exact
11 dynamic IP address? Is that your testimony?
12 MR. GABRIEL: Objection to form.
13 Lack of foundation.
14 A. If the device that issues the dynamic
15 address can detect the other device being turned
16 off, then the dynamic IP address can be released.
17 Otherwise, the dynamic address could still be
18 assigned to that device.
19 Q. Now, with a decentralized
20 peer-to-peer network, it's your statement in your
21 report that a request is sent to each neighbor and
22 each neighbor sends the request to the next neighbor
23 and so on. Did you mean that literally?
24 A. You said decentralized?
25 Q. Yes.
80
1 Jacobson
2 A. Yes.
3 Q. To neighbors? What do you mean by
4 neighbors?
5 A. The decentralized peer-to-peer
6 software referred to the peer-to-peer entities that
7 they talked directly to as neighbors.
8 Q. So you are using it figuratively to
9 describe other computers?
10 A. Yes.
11 Q. You say the semi-decentralized
12 peer-to-peer network uses a central index server.
13 Is that correct?
14 A. Yes.
15 Q. And that if one server node quits,
16 the other nodes can still function?
17 A. Yes.
18 Q. Now, when you access a screen shot,
19 are you accessing a file or are you accessing an
20 index of files?
21 A. When you query the server, what you
22 get is an index of the files.
23 Q. Now, is it your testimony that every
24 time you see a screen shot in KaZaA, you're seeing
25 files that are on a single ordinary node?
81
1 Jacobson
2 MR. GABRIEL: Objection to form.
3 A. There are many ways you can query
4 KaZaA, one of which is to ask all the files that are
5 contained on a particular machine.
6 Q. How would you frame such a query?
7 A. You frame the query with the address
8 of the machine that contains the information.
9 Q. And do you know how MediaSentry
10 queried?
11 A. I don't know the exact techniques
12 that they used.
13 Q. Now you said in your report that you
14 will demonstrate how defendant's internet account
15 and computer were used. Would you now demonstrate
16 for me how you can -- show me how you can
17 demonstrate that the defendant's computer was used?
18 A. Which line of the report are you?
19 Q. What?
20 A. Which line of the report are you
21 referring to?
22 Q. Paragraph 15.
23 A. Would you restate the question.
24 (Record read.)
25 A. Identifications through the IP
82
1 Jacobson
2 address to demonstrate which computer it is.
3 Q. No, I'm asking you to demonstrate it
4 now for me. You said, "I will testify to the
5 procedures and results obtained by MediaSentry
6 coupled with the information complied by defendant's
7 ISP to demonstrate the defendant's internet account
8 and computer were used to download and upload
9 copyrighted music from the internet using the KaZaA
10 peer-to-peer network."
11 Please demonstrate for me that
12 defendant's computer was used to download and upload
13 copyrighted music.
14 A. I can demonstrate through the
15 MediaSentry material.
16 Q. Okay.
17 A. I don't have the MediaSentry
18 material.
19 MR. BECKERMAN: We will mark as
20 Exhibit 10 a two-page printout, page
21 numbers 46 to 47.
22 (Defendant's Exhibit 10, two-page
23 printout of page numbers 46 to 47, marked
24 for identification, as of this date.)
25 MR. BECKERMAN: We will mark as
83
1 Jacobson
2 Exhibit 11 a printout, page numbers 49 to
3 187.
4 (Defendant's Exhibit 11, printout of
5 page numbers 49 to 187, marked for
6 identification, as of this date.)
7 MR. BECKERMAN: And you already
8 have Exhibit 6 and we have Exhibit 12,
9 which is a screen shot, pages 199 to 224.
10 (Defendant's Exhibit 12, printout of
11 pages 199 to 224, marked for identification,
12 as of this date.)
13 MR. BECKERMAN: And we will mark as
14 Exhibit 13 a one-page printout marked as
15 page number 48.
16 (Defendant's Exhibit 13, one-page
17 printout of page numbered 48, marked for
18 identification, as of this date.)
19 MR. BECKERMAN: And we will mark as
20 Exhibit 14 a printout of pages numbers 188
21 through 198.
22 (Defendant's Exhibit 14, printout of
23 pages numbers 188 through 198, marked for
24 identification, as of this date.)
25 Q. Now would you please demonstrate how
84
1 Jacobson
2 you can show that it's the defendant's computer that
3 was used.
4 MR. BECKERMAN: Off the record.
5 (Recess taken.)
6 Q. Please demonstrate that the
7 defendant's computer was used.
8 MR. GABRIEL: If I can ask you, if
9 you refer to an exhibit, please say what
10 the exhibit is.
11 THE WITNESS: Yes.
12 Q. Before we go into that, let me just
13 ask you something.
14 When you say "defendant's computer"
15 in your report, you're referring to the computer
16 that was accessed by MediaSentry; is that correct?
17 A. I'm referring to the -- yeah, the
18 computer with the IP address shown in Exhibit 6 that
19 we discussed earlier.
20 Q. And it's your contention that the
21 computer as to which you examined the hard drive is
22 a different computer than the one that was accessed
23 by MediaSentry; is that correct?
24 A. Yes.
25 Q. Now, going to the first computer, how
85
1 Jacobson
2 do you know that it was defendant's computer?
3 A. We don't have the Verizon information
4 in front of me. By using the subpoenaed records
5 from Verizon they show --
6 Q. They were asked --
7 I'm sorry. I cut you off.
8 They were asked to identify the owner
9 of an account that had used an IP address; is that
10 correct?
11 A. Yes.
12 Q. How would that tell you who owned the
13 computer?
14 A. It tells me the individual who has
15 the account that was associated with that IP
16 address; therefore, that computer at the time.
17 Q. Let's say -- not me, that would be
18 too improbable. Let's say you had a visitor at your
19 home and that visitor plugged into your internet
20 connection with his laptop. Would that make his
21 computer your computer?
22 A. Without knowing the configuration of
23 your home network, I couldn't.
24 Q. Let's say you had a wired internet
25 connection at your home, you had a cable modem and
86
1 Jacobson
2 someone was visiting who had a laptop, a friend of
3 yours or relative, and that person asked if they
4 could plug in their laptop and check their e-mail.
5 Okay?
6 Now, the IP address would show up as
7 your address, would it not? The dynamic IP address?
8 A. It depends.
9 Q. If I sent a query like the record
10 industry sent to Verizon, I would get you, right?
11 If you are the person who pays for the internet
12 access at your home.
13 A. If the ISP allows multiple devices
14 directly connected to their internet service.
15 Q. And it wouldn't have been your
16 computer, it would have been your friend's or
17 relative's computer. Correct?
18 MR. GABRIEL: Object to the form.
19 Lack of foundation.
20 A. The scenario you laid out. If the
21 ISP allowed multiple IP addresses, then it would
22 have associated an IP address with that particular
23 device.
24 Q. So when you say it was defendant's
25 computer, you don't actually have any knowledge as
87
1 Jacobson
2 to whether it was defendant's computer. All you
3 know is that the defendant's name is associated with
4 the internet access account; is that correct?
5 MR. GABRIEL: Objection to form.
6 A. I know that the -- yeah, the computer
7 associated with that user account, an IP address was
8 used.
9 Q. But you don't know whose computer it
10 actually was, do you?
11 A. No.
12 Q. But your report said it was
13 defendant's computer, so I think you will agree that
14 that's an imprecision in your report.
15 MR. GABRIEL: Objection to form.
16 Lack of foundation. Misstates the report.
17 A. The report states that I have
18 identified through the internet service provider the
19 account holder of the IP address.
20 Q. The report says that you will
21 demonstrate that it was defendant's computer that
22 was used. How can you demonstrate that the computer
23 belonged to the defendant? You don't know who it
24 belonged to.
25 MR. GABRIEL: Objection to form.
88
1 Jacobson
2 Lack of foundation.
3 Q. You are under oath.
4 A. It's my opinion that given the
5 information from MediaSentry and from Verizon, that
6 that IP address was associated with the defendant
7 and computers or at least in presence of the
8 defendant.
9 Q. There are two parts to your
10 statement. You say the defendant's internet account
11 and computer. Right now I'm not asking you about
12 the internet account. I'm asking about the
13 computer. You will agree, then, will you not, that
14 when you said computer that you don't actually know
15 if it was defendant's computer or not?
16 A. It is the computer associated with
17 the account of the defendant.
18 Q. But you don't know if it was
19 defendant's computer?
20 A. I know that the computer was
21 associated with the defendant's internet account.
22 Q. But you don't know if the defendant
23 owned it?
24 A. Nowhere is purchase information.
25 Q. And you do not know if the defendant
89
1 Jacobson
2 ever used it?
3 A. I know that the computer associated
4 with that address was used.
5 Q. Now, demonstrate how you know that
6 that computer was used to upload and download
7 copyrighted music from the internet.
8 A. Well, I know which computer through
9 Exhibit 6. That is the primary piece of evidence.
10 I know that material was downloaded
11 through Exhibit 10. I know music was made available
12 through Exhibits 10, 11, 12 and 14, and I know that
13 the music was downloaded through Exhibit 11.
14 MR. BECKERMAN: I would like to
15 mark as Exhibit 15 the undated October
16 report.
17 (Defendant's Exhibit 15, undated
18 October report, marked for identification,
19 as of this date.)
20 Q. When did you provide this report to
21 Mr. Gabriel?
22 A. October 25th.
23 Q. Why did you not sign it?
24 A. It's a draft.
25 Q. Why is it not dated?
90
1 Jacobson
2 A. It was a draft report.
3 Q. Have you ever submitted an unsigned
4 or undated draft to Mr. Gabriel before?
5 A. I could have. I don't recall.
6 Q. Have you ever submitted unsigned
7 drafts or undated drafts to anyone in Mr. Gabriel's
8 firm before?
9 A. Again, I could have. I don't recall.
10 Q. Is it your practice to submit
11 unsigned, undated drafts before submitting your
12 final reports to them?
13 A. The standard report goes in without
14 their review.
15 MR. GABRIEL: I would like the
16 record to reflect that there is a copying
17 issue in Exhibit 15. Page DJ0069 was
18 stamped "Draft." I note in the copying
19 the draft was too light to copy
20 apparently.
21 Q. Did Mr. Gabriel tell you not to issue
22 a final report, but to issue a draft instead?
23 A. Yes.
24 Q. Now, turning to Page DJ0071,
25 Paragraph 17, the second sentence, which says, "I
91
1 Jacobson
2 will testify based on the forensic examination of
3 the hard drive that was copied from the computer
4 owned by the defendant."
5 Now, are you saying there that the
6 second computer which you claim is different than
7 the first one was owned by the defendant also?
8 A. I'm lost in the second, first and --
9 Q. It's your words. It's your
10 testimony. It's your declaration, your unsigned
11 draft which Mr. Gabriel asked you to submit to him
12 so he could have input into the final. But this was
13 your wording I assume. Right?
14 A. Yes.
15 Q. This was wording that was not fed to
16 you by Mr. Gabriel?
17 A. Correct.
18 Q. So you say the computer owned by the
19 defendant. Now you are saying that the second
20 computer was owned by the defendant.
21 A. I'm saying the hard drive that I was
22 given to examine was reported to have been owned by
23 the defendant and I examined that hard drive and
24 came up with that conclusion.
25 Q. So is it your testimony that she
92
1 Jacobson
2 owned both computers?
3 MR. GABRIEL: Objection to form.
4 A. It's my testimony that the hard drive
5 contained no evidence of KaZaA and that hard drive
6 was reported to have belonged to the computer owned
7 by the defendant.
8 Q. What basis do you have for saying
9 that the computer was owned by the defendant?
10 A. Based on the chain of evidence
11 that -- the chain of custody that followed the
12 forensic disk.
13 Q. So it is your testimony that Marie
14 Lindor, who is a home health aide who has never even
15 used a computer, it is your testimony that she owns
16 two computers?
17 MR. GABRIEL: Objection to form.
18 Lack of foundation. Misstates testimony.
19 Q. Is that your testimony? She has
20 never even used a computer in her life, that she
21 owns not one, but two computers?
22 MR. GABRIEL: Same objection.
23 A. What I am stating is that the hard
24 drive I examined, which was reported to have come --
25 been owned by the defendant did not contain KaZaA or
93
1 Jacobson
2 any of the copyrighted or any music files.
3 MR. BECKERMAN: Let's mark as
4 Exhibit 16 your April report.
5 (Defendant's Exhibit 16, Dr. Douglas
6 W. Jacobson's April report, marked for
7 identification, as of this date.)
8 Q. Now, on Page DJ0006, Paragraph 19, in
9 the last line you use the words "being distributed."
10 A. Yes.
11 Q. Were you using "distributed" in the
12 legal sense of the word or in the generic sense of
13 the word?
14 MR. GABRIEL: Objection to form.
15 A. I'm not a lawyer so I don't know the
16 legal -- I guess I am not clear as to what
17 difference you are trying to make between the two
18 words.
19 Q. Where did you get the word
20 "distributed"?
21 A. In that paragraph I'm referring to
22 the fact that the files were on the peer-to-peer
23 network and by the nature of the peer-to-peer
24 network they are being distributed.
25 Q. Do you know of any instances in which
94
1 Jacobson
2 they were distributed to anyone other than
3 MediaSentry?
4 A. Given the nature of the peer-to-peer
5 system, there is a high probability that they
6 were -- well, strike that.
7 Distributed, they are being offered
8 for distribution by the fact that they were on the
9 peer-to-peer network.
10 Q. The question was whether they had
11 actually been distributed, not whether they had been
12 offered for distribution.
13 MR. GABRIEL: Objection to form.
14 A. The KaZaA program made those files
15 available through the supernode. Anybody --
16 Let me strike that and start over.
17 The KaZaA program made the files
18 available on her computer for distribution and given
19 the nature of the peer-to-peer network and the
20 number of users, there is a high probability that
21 songs were actually uploaded from that computer.
22 Q. Do you have any knowledge of any
23 specific instances of any uploads other than to
24 MediaSentry?
25 A. No.
95
1 Jacobson
2 Q. In Paragraph 21 you use the words
3 that the computer was registered to the defendant.
4 How does a computer get registered to a person?
5 A. Through the IP address it is
6 registered. Verizon indicated the subscriber.
7 Q. So you don't mean that the computer
8 was registered to the defendant. You mean the IP
9 address was identified by Verizon as having been on
10 the internet access account that was in the name of
11 the defendant. Is that correct?
12 A. The IP address of, was registered to
13 the defendant on said computer. So it says that the
14 IP address.
15 Q. Not the computer. The IP address was
16 registered?
17 A. That's what 21 states.
18 Q. 21 states that the computer that had
19 the IP address was registered to the defendant.
20 "I will testify based on all of the
21 information" --
22 A. Right, right.
23 Q. So you don't mean the computer was
24 registered, you mean the IP address was registered?
25 A. Yes.
96
1 Jacobson
2 Q. Now, in Paragraph 22 you state that
3 you could prove from the MediaSentry user log that
4 the music found on the defendant's computer was
5 downloaded from other users on the internet. How
6 would you have done that?
7 A. By using the metadata tags, in
8 particular the description tag. For example,
9 Page 0106.
10 MR. GABRIEL: What exhibit?
11 THE WITNESS: I'm sorry.
12 Exhibit 11.
13 A. Page 10106 indicates in the
14 description "ripped by" and had several -- several
15 cases "ripped by X7" and so on, and that's
16 throughout the document.
17 Q. A metadata is text, is it not?
18 A. Yes.
19 Q. Metadata can be changed, can it not?
20 A. Metadata can be changed and is not
21 present on original CD recordings.
22 Q. And it can be changed easily through
23 commonly available software, can it not?
24 A. Yes.
25 Q. And could it be changed through KaZaA
97
1 Jacobson
2 software?
3 A. Yeah. I believe KaZaA lets you edit
4 the metadata.
5 MR. BECKERMAN: I would like to
6 mark as Exhibit 17 a page of handwritten
7 notes.
8 (Defendant's Exhibit 17, page of
9 handwritten notes, marked for
10 identification, as of this date.)
11 Q. When were these notes prepared?
12 A. These notes were prepared prior to
13 the submission of the October -- let's see which
14 exhibit. Exhibit 15.
15 Q. Are there any other notes which you
16 jotted down which you did not preserve from the date
17 the hard drive was furnished to you?
18 A. No.
19 Q. What are the letters at the top
20 right?
21 A. DHCP name server.
22 Q. What are the three IP addresses below
23 that?
24 MR. GABRIEL: Objection to form.
25 A. Those are the IP addresses of the
98
1 Jacobson
2 name server that were on her computer.
3 Q. What does that mean?
4 A. The name server, my best analogy is a
5 giant phone book that converts names and IP
6 addresses. So when you type in www.google.com, you
7 get the IP address of Google.
8 Q. What is the entry at the bottom,
9 "7704 repaired"? What is that a reference to?
10 A. In examining the hard drive, it
11 appeared that there was some type of repair of the
12 Windows operating system on that date.
13 MR. BECKERMAN: I would like to
14 mark as Exhibit 18 a single-page document
15 which says "wireless router" at the top.
16 (Defendant's Exhibit 18, single-page
17 document bearing "wireless router" at the
18 top, marked for identification, as of this
19 date.)
20 Q. When was this prepared?
21 A. 3/14.
22 Q. Now, You say "wireless router?" and
23 then say, "No." How did you know there was no
24 wireless router?
25 A. Again, by looking at the information
99
1 Jacobson
2 on Exhibit 6.
3 Q. How does that show you that there is
4 no wireless router?
5 A. Again, as I testified earlier, here
6 at the source address and that the KaZaA IP address
7 matched.
8 Q. And that tells you that there was no
9 wireless router?
10 A. Again, those are all public IP
11 addresses on both the computer and the device that
12 put the IP packet onto the internet, both at the
13 same IP address.
14 Q. And that's your sole basis for your
15 conclusion?
16 A. Yes.
17 MR. BECKERMAN: I would like to
18 mark as Exhibit 19 a two-page letter from
19 Verizon.
20 (Defendant's Exhibit 19, two-page
21 letter from Verizon, marked for
22 identification, as of this date.)
23 Q. Is that the source for your
24 information as to whose access account it was?
25 A. Yes.
100
1 Jacobson
2 MR. BECKERMAN: I would like to
3 mark as Exhibit 20 a resume, a one-page
4 resume, page number DJ0076.
5 (Defendant's Exhibit 20, one-page
6 resume, page number DJ0076, marked for
7 identification, as of this date.)
8 A. It is a printout of a file that I
9 found on the hard drive that I examined. It was
10 described in Exhibit 15.
11 Q. Did you know who prepared this?
12 A. I know it was on the hard drive and
13 it in the directory of user Kathleen on the system.
14 Q. Do you know who typed it?
15 A. No.
16 Q. Now, what does it say next to the
17 word "e-mail" in this resume?
18 A. J-C-Q-L-L-I-N-E.
19 Q. What tools did you use to determine
20 that the hard drive had not been used for a KaZaA
21 account?
22 A. I used EnCase to examine the captured
23 hard drive.
24 Q. When you used EnCase, did you know
25 that this matter was in litigation and that you were
101
1 Jacobson
2 an expert witness in this case?
3 A. Yes.
4 Q. Did you not have screens? When you
5 used EnCase, didn't you look at a computer screen?
6 A. Yes.
7 Q. Did you save what was on that screen?
8 A. No.
9 Q. Did you generate reports?
10 A. No.
11 Q. Now I'm not asking you if you printed
12 out reports or saved reports. I'm asking you if you
13 generated reports.
14 A. No.
15 Q. So you did not document your findings
16 in EnCase at all, did you?
17 A. No.
18 Q. Did Mr. Gabriel tell you to do that?
19 A. No.
20 Q. So did you feel that you could just
21 review it on EnCase and then come and testify from
22 memory at a trial? Is that what you intended to do?
23 A. I examined the hard drive, found no
24 evidence of file sharing software or audio files,
25 and so there was nothing to document.
102
1 Jacobson
2 Q. S