I’ve been trying to find the facts in the case of Capitol Records, et. al. vs. Jammie Thomas where Thomas was found guilty of distributing copyrighted songs and ordered to pay a fine of $222,000 ($9,250 for each of the 24 songs involved in the case). From what I have gathered, Thomas ripped her own CDs. The ripped music files were found in a KaZaA share on her PC. The evidence against Thomas included the use of her ubiquitous user id “tereastarr” as the id for the Kazaa account and that a computer with her IP address was where Media Sentry found the shared files. While this information seems pretty damning, it is not the slam dunk that it seems.

I don’t know whether Thomas did what she was accused of but something obviously went wrong in this case. Even the guilty are entitled to a proper legal defense and in my opinion Thomas did not receive one. She went into that courtroom with an “I’m innocent and the jury should figure that out” defense which doesn’t work even when you are innocent. Her counsel introduced something about IP spoofing as a possible defense as well although this proved ineffective as a forensic examination was done of Thomas’ PC that found that the music files were in fact in a shared folder in “My Music”.

What went wrong? Forget the jury instructions and all the other things I’ve read all over the place. It doesn’t seem that Thomas’ counsel Brian Toder had an adequate grasp of electronic evidence. You don’t counter electronic evidence with testimony, demonstrations and shaky theories. You counter electronic evidence with electronic evidence. Did the defense have a forensic expert of their own?

Typically in cases involving electronic evidence, a forensic (not security) expert in brought in to do a forensic examination of the defendant’s computers and electronic media. Both plaintiff and defendant will hire their own experts to do separate examinations.

Things that I didn’t see mentioned in anything I read about the case that a forensic expert (on either side) should have brought up include:

• Was KaZaA installed on the computer? When?
• When was it last used?
• What other evidence of use of the KaZaA account existed? (email, etc.)
• When KaZaA is installed does it automatically create an account with the same user id as that used on the PC?
• What software was used to rip the CDs?
• Were the ripped songs automatically placed in the KaZaA directory when ripped?
• Were the songs placed on a portable device?
• Was there any spyware/trojans on her computer that would have caused files to be shared?
• Did the music files contain metadata that can be used to determine what user and software ripped the songs?
• The creation dates were very close in time but what about the modified dates?
• Many other questions …

It might very well be that Thomas lost on a fluke. The plaintiff was attempting to settle with Thomas before going to trial. It could be that they knew that their evidence was not “all there”. It is reported that Thomas will appeal her conviction on the basis of the jury instructions. I hope that her defense hires a forensic expert to examine her computer to answer at least these questions.

UPDATE: While continuing to read articles on this topic I ran across this. There was no electronic evidence other than the name of the account, the IP address, and screenshots of the shared folder Media Sentry discovered on KaZaA. Apparently, Thomas had her hard drive replaced at Best Buy after receiving settlement letters from the record labels. So it turns out that the “forensic examination” that was done was done only on the new hard drive which did not contain any traces of KaZaA but did contain music files. So they had almost no real evidence. The replaced hard drive looks suspicious and explains why the questions that I would expect to be answered by a forensic expert were not answered. However, that still does not prove the case. And the Geek Squad supervisor testified that her hard drive was replaced for legitimate reasons.

In addition it turns out that the defense had originally retained a computer forensics expert. What happened with that? The plaintiff called him as a witness but apparently he didn’t say much. It could be that the old hard drive was trashed or destroyed and that there was no way for the forensic expert to examine anything that would find anything that could help (or hurt) Thomas.

Does the old hard drive exist? Did the plaintiff try to compel it from the defendant? Without it, especially since it was proven that it was replaced for legitimate reasons, I don’t see how they could win. But then juries are unpredictable.

In the end, I think that Jammie Thomas got the best defense that her money could buy. A legal defense is expensive (even a bad one) and computer forensic experts are even more expensive. Thorough forensic analysis of electronic evidence was not done and the defense put the defendant up against the plaintiff’s expert to refute his findings instead of an expert. The defense proposed possible scenarios that the jury probably didn’t even understand instead of at least demonstrating that the scenarios are possible. A computer forensic expert’s findings early on could have provided the defense with enough information to decide whether to settle or to go to trial. Instead, they relied on the “I’m innocent – do the math” defense and it didn’t work.

I think that this a sign of bad things to come especially for innocent people that can’t afford a proper defense.

It is important to mention that opinions expressed in this blog are in no way the opinions of my employer.

You might also be interested in:

• Capitol Records vs. Jammie Thomas Revisited
• The Curious Case of Julie Amero