I just ran across this article by Annalee Newitz about an on-going intellectual property lawsuit (Columbia v. Bunnel) involving peer-to-peer downloads. In this suit, Judge Jacqueline Chooljian has ruled that anything that exists in computer memory (”RAM”) has left an historical record, however briefly, and is therefore subject to discovery:
Here’s where things get hairy. During discovery, the period in a lawsuit where both sides gather evidence, Columbia ordered TorrentSpy to hand over its user logs: electronic records of what people have done on the site. The problem is that TorrentSpy doesn’t keep user logs. So Columbia’s lawyers came up with a freaky, technically dubious argument. They claimed that TorrentSpy had technically been keeping logs anyway, because user data passed through the website’s computer’s RAM—the part of the computer’s memory that never gets written to disk and saved. The mere fact that the data had flashed through the RAM was enough to make it discoverable, claimed the lawyers.
But all that stuff in RAM was gone. So how to get it back? Columbia’s lawyers told the judge that the owners of TorrentSpy could start keeping user logs during the discovery process and, in essence, re-create the missing logs. This was hugely controversial, because discovery is only supposed to apply to already-existing evidence. You can’t order witnesses or defendants to start gathering data today for you to subpoena in the future. But the judge, Jacqueline Chooljian, went for Columbia’s argument about the RAM. If the data had been in RAM for even a nanosecond, it existed in the past and was therefore subject to discovery.
The ramifications of this decision are far-reaching indeed. If the California ruling holds—it’s in the appeal stage right now—Columbia may have created a legal loophole that allows lawyers to order people to generate new evidence during discovery. Electronic Frontier Foundation attorney Fred von Lohmann, who has been following the case, told me via email, “Because the ruling is based on the notion that ephemeral RAM copies are ‘records’ subject to preservation and production in litigation, it reaches deep into many businesses. For example, if you have a VoIP-based phone system (where conversations appear momentarily in RAM in your data center), are you responsible for recording every phone call for potential disclosure in litigation? What about IM conversations? Does everything created by a computer become a ‘producible’ record, just because it’s digital and therefore must rely on RAM?”
The key issue for the defendant here is that of spoilation, that is, the alleged failure to preserve key evidence. This often leads to judicial sanctions, such as informing the jury that they can consider the accused party of deliberately destroying evidence. Spoilation is a major issue in electronic discovery, since (a) it’s easier to destroy electronic documents than to destroy physical documents and (b) it’s quite easy to do so without even realizing that you’re doing it (e.g., recycling backup tapes). In this case, Judge Chooljian is compelling TorrentSpy (the defendant) to create on-going snapshots of the relevant contents of the computer memory of its systems. Failure to do so could, in theory, result in possible findings against TorrentSpy of spoilation.
I will leave it to the lawyers to argue whether (as noted above) Judge Chooljian’s ruling in effect compels TorrentSpy to manufacture evidence where none existed, and how that holds up to existing law regarding discovery. The potential technological burdens of Judge Chooljian’s ruling are staggering and unsupportable.
Here’s a simple example. We have in our household nine (9) honest-to-goodness personal computers (3 Macs, 5 Wintels, 1 Linux box), all networked together. These machines have among them a total of 13 gigabytes (13 billion bytes) of computer RAM, not counting processor caches, hard disk caches, printer caches, and so on. I’m also ignoring for now the RAM in all of our various embedded systems (mobile phones, iPods, cars, and so on). When all nine systems are up and running, selected portions of that RAM changes on a microsecond-to-microsecond basis (actually faster than that, but we’ll use microseconds for now).
Now suppose I’m being sued and the other party has alleged that relevant and discoverable information is being “written” — however briefly — in the RAM of one or more of our home computers. Under Judge Chooljian’s ruling as I understand it, I would be compelled to write additional software to find, extract, and archive that information so that I can produce it to the other side. Such an effort runs into several significant problems:
- How do I determine what is relevant? If you have ever worked in litigation (as I do), you probably know how broadly most discovery requests are written. How do I translate such requests into the basis for searching through computer RAM?
- How do I capture what is relevant? I cannot capture a single coherent instance-in-time snapshot of all that RAM; it changes faster than I can record it, and the resulting RAM image will not be self-consistent.
- How do I store what is relevant? I am not dealing with a single static 13GB binary image; I am dealing with millions — perhaps hundreds of millions — of distinct 13GB binary images every second. True, the differences from one microsecond to the next might not be that great, but how do I know which ephemeral snapshot is or is not relevant? I am now up in the exabyte to yottabyte level of storage.
- How do I interpret what is relevant? Unlike written documents (the baseline of discovery requests), computer memory contents are purely binary and many require several levels of interpretation in order to produce human-readable information. Relevant text and data may be encoded as ASCII; as images (in any number of image formats); as proprietary application document files; as compressed or encrypted data; or any combination thereof (e.g., an image within a document). And since we’re dealing with RAM, the in-memory representation of data may be quite different than the written-to-file representation of that same data and may not be known. In other words, how Microsoft Word maintains an open document within RAM may be quite different from how it writes that document out to disk.
- How do I find what is relevant? I am now dealing with exabytes of internally inconsistent binary data encoded in any number and combination of ways and have no roadmap whatsoever to tell me what a given byte is or is not.
Now, these are the challenges that I would face under Judge Chooljian’s ruling for a lawsuit just involving my household and work computers. Imagine the complications for a typical corporation that might have hundreds or even thousands of computers. Imagine the complications for Google, which has hundreds of thousands of servers.
Again, with all due respect to Judge Chooljian, RAM is not a record nor a document. RAM is not historical; it is ephemeral. Any attempt to make the transient contents of RAM subject to preservation and discovery opens a trans-stellar can of worms. ..bruce..
