Oregon Attorney General Hardy Myers filed a motion to quash a subpoena that the Recording Industry Association of America filed in U.S. District Court in September that would require the University to identify 17 network users that the RIAA contends illegally downloaded copyrighted material.
A representative of the RIAA said, “Regarding the motion, this is not the first attempt to quash a subpoena, nor do we expect it to be the last. In the handful of instances where this has occurred, the courts have overwhelmingly ruled in favor of the record companies.”
The University was first contacted this summer by the RIAA when the group sent 17 pre-trial settlement letters to the University and asked it to forward them to the users of certain IP addresses.
According to court documents, the University promised to preserve identifying information for the RIAA, and had Dale Smith, director of network services, attempt to identify the users. Despite this promise, the RIAA filed the subpoena anyway, said Stephanie Soden, a spokeswoman for the Department of Justice.
Soden said the subpoena “asked for broader information and would require the University to interview students and perhaps violate federal confidentiality laws.”
The RIAA said this is standard procedure and upon discovering the identity of the individuals it offers settlements to those individuals prior to filing another lawsuit naming the violator.
Records state Smith and other network services employees tried to identify users, but five of the 17 IP addresses belonged to double-occupancy dorm rooms and have no personal login requirements.
In Myer’s memorandum to support the motion to quash, he writes, “an IP address in a shared room at the University can be used by any of the occupants, all the occupants or visitors…in order to determine the identities of the John Does associated with the IP addresses in shared rooms, the University would have to undertake an investigation of all of the individuals who were or may have been present in the shared rooms in question…”
Smith also identified two IP addresses belonging to single-occupancy dorms, but since no login is required, anyone with access to the room would also have access to the IP address.
Myers writes, “The alleged infringement could have been committed by a visitor just as easily as the occupant him or herself.”
Nine others used the University’s wireless network, which does require login, but Smith contends the University cannot definitively identify those users either because it cannot determine whether the user was the person associated with the login or someone else with access to the login.
Smith’s notorized paperwork states “in the case of sixteen of the seventeen John Does, I believe it is not possible for the University to identify the alleged infringers without conducting interviews and a forensic investigation of the computers likely involved.”
The University contends that to do the forensic work is both an undue burden and a possible violation of the Family Educational Rights and Privacy Act, which protects students’ personal information from being released by the school.
In regards to the undue burden, the University says the subpoena requires them to create material to assist the RIAA in its litigation, and generally non-parties are not required to create documents that do not already exist.
Additionally, the University argues, under FERPA’s guidelines, it is responsible for notifying a student previous to releasing personal information about them, and since it cannot determine who the users are, it cannot comply with the notice requirements.
The RIAA representative said, “FERPA does not protect a student from having their identity revealed.”
Myers writes that MediaSentry, a third-party investigator employed by the RIAA, has collected additional information about each individual, which the University wants to verify.
The RIAA said the group does not have any additional information, explaining that the investigation team scours file-sharing Web sites such as LimeWire looking for illegal activity.
“When an individual is caught sharing music that isn’t theirs to share, we collect the person’s Internet protocol address, a representative sampling of the music and a time stamp,” the RIAA said.
[email protected]