Judge In Grooveshark Lawsuit Orders Blog To 'Preserve' Logs That Had Already Been Deleted
from the dangerous-ruling dept
Earlier this month, we noted a problematic attempt by Grooveshark’s parent company, Escape Media, to subpoena information on an anonymous commenter on the blog site Digital Music News. As we noted at the time, Universal Music had referenced that comment in its lawsuit against Grooveshark. It seemed bizarre to reference an anonymous comment, especially one that seemed like pure hearsay (it made claims about things Grooveshark employees had done). In the lawsuit between UMG and Grooveshark it seemed completely pointless (and, indeed, Grooveshark has been arguing as much in that particular lawsuit). Yet, at the same time, Grooveshark subpoenaed DMN in an attempt to find out who posted that comment. DMN resisted the subpoena, noting that it discards and overwrites its log files every few days anyway, and these files had been long gone already. It also pointed to California’s shield law for journalists and the basic First Amendment protections for anonymous speech.
Unfortunately, the judge has ruled against Digital Music News, and ordered it to produce the information. The judge has indicated that he will not require this information during the appeal that DMN’s lawyer indicated they would file… but did require “preservation” of the evidence during that time. Beyond the shield law and First Amendment issues raised here (we’ll get to those), this raises a very, very troubling proposition for any website that regularly overwrites its log files. Escape Media had argued that even if DMN overwrote the log files, it should be required to hand over the information on the subpoena just in case the overwritten data was still available and could be recovered.
So, what do you do in this situation? Under the judge’s order to “preserve” data that has already been deleted, what is a site to do? Do they have to immediately stop using their existing hardware and set up an entire clone — hanging onto all of the original hardware for who knows how long, just in case a forensics expert can find a tiny piece of (useless for this case anyway) data that has been overwritten probably a hundred times already? That seems crazy. Paul Levy, from Public Citizen, who is representing DMN on this issue, highlighted many of the issues in his blog post about this:
The imposition of data preservation requirements on a journalist who is not a party to the litigation raises questions apart from the merits of the order. Journalists need to be able to discard data when they no longer have any of their own use for it. Yes, “the public has a claim to every man’s evidence,” but don’t members of the public who are not involved in litigation have the right to discard information despite the fact that it might turn out to be useful evidence for somebody else’s case? Does the public have a claim to heroic efforts on every man’s part? Shouldn’t there be higher standards for subpoenas demanding intrusive searches for discarded data in the hands of third parties?
The problem is compounded when it is a journalist that has been subpoenaed. To what extent does society have any entitlement to make journalists in particular take heroic measures, such as searching the nooks and crannies of their computer equipment for fragments of discarded data? The judge was sensitive to the fact that our client here is a journalist, telling Escape Media that he was not prepared to allow it to make any general search of Digital Music News’ computers. But an issue that we may have to pursue on appeal is whether a journalist should ever have to undertake such drastic preservation efforts in aid of a lawsuit in which he is not involved, particularly given the relative unlikelihood that fragments of identifying data remain on his computers somewhere. Indeed, the problem is broader than just journalists. Companies often keep log files with respect to server visits (and hosted comments), but there is little business justification for keeping those logs forever; so generally speaking they are discarded after a period of time (EFF’s best practices recommendations are worth a look in this regard). Does the mere act of discarding log files set a company up for the possibility of a demand for forensic examination of the underlying servers, in the hope that some fragment of the data might be recovered? In this regard, the trial court’s order has chilling implications for other California companies, even beyond the issue of journalists.
Issues of how to preserve the data remain to be decided. This is not like just leaving one of your file cabinets untouched for a period of time; it is not even as easy as making sure you don’t delete any of your email. Preserving the web site while creating a copy of the underlying servers is a complicated process, requiring the services of a forensic specialist, and the cost could be substantial. The estimates that we have been given are well into the five figures; but even the cost of several thousand dollars would be an enormous imposition on this small company.
It really is quite a difficult issue, and if the ruling stands, could become a massive headache for any company in California.
Separately, we should not ignore the First Amendment and shield law issues. DMN is not a party in this case, and it’s not even clear why this information is needed. Escape/Grooveshark can and should point out that the information contained in the comment is pure hearsay so it shouldn’t have to deal with it in the original case. The company has not filed a defamation claim against the commenter and does not appear to have met the high bar required to unveil an anonymous commenter anyway. This is a pretty big concern for any journalist or blogger out there. Being dragged into a third party dispute because someone comments on your site can represent a pretty big problem for a lot of smaller sites.
While Grooveshark’s legal fight against the major labels certainly raises some interesting copyright questions, it’s disappointing to see them going down this path and potentially creating serious problems not just for Digital Music News, but tons of journalists and websites.
Filed Under: anonymous speech, evidence, first amendment, log files, subpoena
Companies: digital music news, grooveshark, universal music
Comments on “Judge In Grooveshark Lawsuit Orders Blog To 'Preserve' Logs That Had Already Been Deleted”
Easy solution
That’s easy. Just request that the judge put everything on hold (lawsuit, procedings, etc.) until DMN can fund and research going back in time to change the past. Once there, they can change the past so logs are kept for several years, whereby they teleport back to existing time to present the logs. Easy. Shouldn’t take more than eight hundred years. Otherwise, they’ll just have to tell the judge “Sorry, your S.O.L.” Bummer.
Re: Easy solution
*”Sorry, you’re S.O.L.”…. Darn typos.
Does the order actually require any action?
If the company has a good faith belief that the logs have been deleted and cannot be recovered, there would be nothing to preserve.
IANAL but to me it seems that unless the judge proscribed specific measures and the company doesn’t believe it there is anything to preserve, the order is pretty much moot.
You keep arguing that this information should not be discoverable because it’s “pure hearsay.” The rule against hearsay evidence would only keep it from being used at trial There is no rule at all from conducting discovery based upon hearsay statements.
Considering that 99.999999999999999% of all statements are hearsay, i.e., are made out of court, discovery would be impossible if your rule was in place. When an attorney learns that something was said about his case, he’s going to want discovery on that. Hearsay would not block that discovery from occurring.
Re: Re:
I don’t think he’s arguing that it’s not discoverable. He’s saying that it’s not worth discovering by the defendant. The defendant and judge should simply dismiss it with the same incredulity that should accompany any other anonymous comment on the web.
I could see the plaintiff wanting to subpoena the logs. It could be useful to them if they could show that the message came from a Grooveshark IP address. But the defendant gains nothing in this case by hunting for this. (Other than gratifying an ulterior personal vendetta against the commenter?).
Shredded paper
So, if they had shredded some paper evidence, and it had already been sent to a recycling center, would this judge require the recycling center to set aside all the toilet paper they created from it just in case the evidence was recoverable?
Re: Shredded paper
+1
and yet again, a technology clueless judge orders the technically impossible be done even though it undermines the the First Amendment and journalistic shield law. what next, i ask? uninvent the printing press because a judge doesn’t like what’s being put on the paper?
This raises an additional set of problems
Levy’s analysis is, as usual, incisive and informative. But I think there’s an additional problem which might need to be considered here, so I’m going to pose the question.
Suppose that complete disk images are made of all the relevant systems, and that those are turned over so that a forensic analysis can be conducted in order to determine whether or not the particular disk block with the particular log entry in question here still exists — intact, but unallocated to any (new) file.
The forensic analysis will have access to all the other data on those disks. There may be data there which is required by (a) federal law (b) state low (c) contract to remain confidential. That data may be in still-existing files or it may (like the scrap being sought here) be in fragments in various unallocated blocks on the filesystem’s free list.
Does this create a (legal) problem for respondent? (That’s not a rhetorical question, I’m asking because I’m not an attorney and I don’t know the answer.)
A simple solution to problems like this in the future…don’t keep logs; or if the software you are using insists on keeping logs, save it to /dev/null.
For Sale: One (1) Slightly Used Flux Capacitor. Works Like New!
Make sense?
So… since when does anything or anyone in government have to make sense.
Apparently, to work in government, you must show proof that you’ve surgically removed the “common sense” part of your brain.
This judge could use a lesson or two in technology. He wouldn’t understand a rangeCheck from a regular expression.
Amazing how quickly some stories have practical examples provided...
Let’s see. This story is relevant, as is this. About all the argument we need that we have to get technology training courses into the legal system.
I claim that someone working for Universal Music left the comment.
Techdirt, you might want to consider backing up your logs now.
Oh crap. I didn’t post anonymously.
Obviously it isn’t enough to simply delete log files. Shred them instead. Your customers get added security, and you don’t have to pay arbitrary $10,000 fines.
Re: Re:
The equivalent has already been done to those files. All the “shred” command does is write over the blocks the original data was on. This has already been done by more recent log files. There are ways to get the data back, but damn it’s expensive and not guarantied.
I think the issue here is that hearsay may not apply if the post comes from one of the parties involved. It would depend on who posted it, and thus the logs are very relevant.
Now, Grooveshark may not be pushing the issue if they think it’s someone who perhaps is an insider or somehow attached to their operations. We don’t know their motivations, but it seems odd they aren’t pushing – which suggests there is more here than meets the eye.
Re:
> All the “shred” command does is write over the blocks the original data was on. This has already been done by more recent log files.
There is no guarantee that the filesystem block allocator chose the same blocks for the new log files (the way log rotation usually works is to periodically create a new log file, renaming the previous log files and deleting the oldest of the set).
Even “shred” or similar commands cannot guarantee anything, since there are things like copy-on-write filesystems, journaled filesystems, and even bad block remapping on the lower levels of the storage media itself.
The only guaranteed way is to use encryption and throw away the key. Or, as someone else already noted, do not log anything at all.
lol
ok your honor here is the log ….pass him a tree part and say thats all we logged at the time…
Does it count if I remove the hard disk and dump it in a pickle jar?
1.
You see them everywhere: stomping impatiently in the long lines of Gwinn Commons, running to Otto Miller Hall for an 8 a.m. class or trudging up the hill to Ashton Hall. TOMS shoesare clearly popular among SPU students, but the poverty-conscious shoes are more an altruistic status symbol than a donation, which comes at a hefty price.
TOMS Shoes was founded by Blake Mycoskie under the charitable work principle of "One for One," which has been commended by magazines such as People, Rolling Stone and Elle. The company donates one pair of shoes to a child in need for each pair sold. "Using the purchasing power of individuals to benefit the greater good is what we’re all about," states the TOMS Web site.But charity should be as efficient as possible. Instead of giving Mycoskie a profit and calling it charity, it’s more effective to buy less expensive shoes and donate the left-over money directly tobinikis relief organizations.
Suppose you opt to buy a pair of shoes that cost $20 rather than a pair of TOMS, which are, at is a modest price, a total of $44. Buying the cheaper pair of shoes leaves an extra $24 to go toward donations. You may be wondering what sort of impact a mere $24 could make. According to the ONE Campaign, a donation of that amount can provide two nets to protect against malaria at $10 each, treat a person living with HIV/AIDS for two months, prevent maternal death by providing vitamin supplements at $1.25 per pill or fund six months of education for a child in holister.
The TOMS we see around campus have provided relief for many, but the money spent on those shoes could have provided even more through a direct donation to a nonprofit organization.
A January 2009 Business Week article stated that, TOMS Shoes accumulated $4.6 million in revenue from its first 115,000 pairs of shoes, and the TOMS Web site projects sales surpassing 300,000 by the end 2012 UEFA. While the company does donate portions of its profit to a global cause, it describes itself as a "for-profit company with giving at its core."
Though purchasing TOMS makes a positive impact, it doesn’t equate to making a direct donation. Buying the shoes purely for philanthropy is a waste of money because the amount you spend doesn’t go straight to relieving global poverty. A pair of TOMS cost anywhere from $44 to $98, and while exact manufacturing figures are unavailable, Sustainable Business Design praises the shoe’s low manufacturing cost and retail prices, which allow for both donation purposes and company profit.
Buying TOMS isn’t a bad thing; purchasing a pair of these shoes does more good than buying a pair of Converse. But all too often, a pair of TOMS shoes are merely a symbol to the public that their owner new era charitable person.