Recording-industry subpoenas spark online-privacy debate.

Exactly who is "nycfashiongirl"? One could assume that she is a girl, that she lives in New York City, and that she follows fashion. Some reports reveal that she enjoys a varied mix of popular music by artists such as the Rolling Stones, U2, and Michael Jackson; in addition, she apparently feels some kind of connection to movies with fairy-tale endings. She is also a "shoplifter," according to the Recording Industry Association of American (RIAA).

Nycfashiongirl's musical and movie tastes are public knowledge because they have been entered into evidence as part of RIAA's aggressive and well-publicized campaign against online music piracy, or "shoplifting," as the association calls it. In early September, RIAA filed 261 lawsuits, claiming that each individual named has engaged in at least 1,000 instances of copyright infringement--a violation that carries a maximum penalty of $150,000 per instance. Nycfashiongirl is not among those being sued, but the fact that she is not goes to the heart of a heated debate about privacy and the Internet: RIAA may know that nycfashiongirl likes Pretty Woman, but they don't know her name.

For the defendant in Recording Industry Association of America v. Jane Doe (a.k.a. nycfashiongirl), the case concerns the constitutionality of a private party's access to her personal information, but for RIAA, the case is all about declining music sales.

RIAA has alleged that nycfashiongirl, a member of the KaZaA file-sharing network, illegally shared hundreds of copyrighted works. In July, the association issued a subpoena to her Internet service provider (ISP), Verizon Internet Services, asking for her real name. Once Verizon notified its subscriber of the subpoena, she--through her counsel--announced her plans to challenge it. Verizon informed RIAA that it would therefore not comply with the subpoena. RIAA filed a motion to enforce the subpoena, which Verizon opposed. Jane Doe filed a motion to intervene and a motion to stay the subpoena, which RIAA opposed. Jane Doe then filed her reply to RIAA's opposition.

The obstacle RIAA encountered is the result of the thin veil of anonymity that exists within online communities because of the widespread use of pseudonyms. The association, which has been quite vocal about its technological prowess, maintains that it has the ability to surreptitiously identify music files stored on an alleged infringer's personal computer and determine whether they came from a legitimate source; however; the association apparently cannot identify the alleged infringer by name. The true identity of a person who wishes to remain anonymous online rests with that person's ISP. In order to sue the person, RIAA must pierce the veil.

The subpoena seeking the identity of Jane Doe is not the first of its kind, but it is the first that an individual subscriber has challenged. Over the past year, the association has issued about 1,500 subpoenas to ISPs and universities that supply their own Internet services, demanding the real names and addresses of individuals that it identified as engaging in illegal file-sharing. One possible reason why Jane Doe stands alone is that many of the individuals whose identities have been sought knew nothing about the subpoenas.

Due process

RIAA's roundup of the usual suspects has forced interested parties to take a closer look at the language of the Digital Millennium Copyright Act of 1998 (DMCA), specifically [section] 512(h)--the subpoena provision. While the act was meant to address copyright infringement in the Internet age, critics argue that legislators could not have foreseen the advent of online file-sharing networks, sometimes known as peer-to-peer or "P2P" communities.

"Our case is testing whether the subpoena provision is constitutional or not, and whether it passes the due process requirements," said Sacramento, California, attorney Daniel Ballard, who represents Jane Doe.

According to Ballard, in a few cases involving first-generation file-sharing networks--most notably a lawsuit by 18 major record companies that eventually shut down the technology's progenitor, Napster--it has been assumed that downloading music is infringement, but the question has never been litigated. In the Napster case the issue was argued solely in the context of a preliminary injunction hearing and solely by Napster, which would not have been subject to the ramifications of an adverse ruling, Ballard said. (A&M Records, Inc. v. Napster, Inc., 114 F. Supp. 2d 896 (N.D. Cal. 2000).) Not a single Napster user was actually before the court in that case.

"I am not arguing that the reproduction or distribution of copyrighted works via peer-to-peer systems is lawful," Ballard said. "I am asserting, however, that no court has ever held a peer-to-peer user civilly liable for doing so."

Storing all of the disputed files in a single location turned out to be Napster's Achilles' heel, making it simpler to assess at least indirect liability. Subsequent file-sharing networks learned the lesson and decentralized, becoming conduits rather than vessels. All of the files that are available within today's P2P communities are stored on the hard drives of individual members, which other members can easily access.

As a result, the recording industry has not yet been able to replicate its Napster strategy with companies such as KaZaA because the extremely popular network does not itself physically store the allegedly infringing material--not to mention that the company is based in the small Pacific island nation of Vanuatu.

This time, RIAA is going after the users. "RIAA is using a provision that was created before P2P file networks even existed," Ballard said. "[The act] was designed to protect copyright owners from unlawful reproduction, not this passive permission to have other people access your hard drive."

RIAA's use of the subpoena provision has been effective, however. Most universities and ISPs readily handed over the requested information. In the case of two subpoenas other than the one seeking the identity of Jane Doe, Verizon mounted ultimately unsuccessful challenges. (In re Verizon Internet Servs., Inc., 240 F. Supp. 2d 24 (D.D.C. 2003); In re Verizon Internet Servs., Inc., 257 F. Supp. 2d 244 (D.D.C. 2003).) Although Verizon was forced to reveal the names in those cases, the U.S. Circuit Court for the District of Columbia has agreed to review the rulings.

"Verizon made the argument that without an underlying case or controversy, an Article III court can't be used as an investigative arm of a private litigant," Ballard said. In reply, RIAA argued that provisions in other federal statutes permit private parties to seek subpoenas through the court without an underlying case or controversy;

"But if you look at all those provisions, they're significantly distinguishable," Ballard said. Only one of the provisions RIAA cited cannot be dismissed easily--one that permits a private litigant to request a subpoena in a patent-interference proceeding--but it has never been used, he added.

Those opposing the DMCA subpoenas argue that no existing statute or case law allows a private party claiming to be a copyright owner--once he or she has made certain declarations under penalty of perjury--to compel a court to issue a subpoena. But tinder RIAA's interpretation of the act, Ballard said, "the district court clerk is obligated to issue a subpoena with no judicial oversight and with no notice to the target of the subpoena."

Civil libertarians, domestic abuse organizations, and ISPs have joined in opposition to RIAA's campaign, arguing that an overly broad interpretation of the DMCA subpoena powers allows private parties unprecedented access to others' personal information. While few people publicly endorse copyright infringement, critics of RIAA's legal tactics claim that the invasion of privacy is out of proportion to the crime being committed.

"Even the attorney general, in furtherance of a terrorist investigation, doesn't b ave this kind of authority," said Ballard.

Anonymous until proven guilty

Some critics say the court's repeated affirmation of RIAA's interpretation of the DMCA in the Verizon cases is clearly the wrong approach.

"The court heard 'copyright infringement' and stopped listening," said Wendy Seltzer, staff attorney at the San Francisco-based Electronic Frontier Foundation (EFF), which filed an amicus brief in Verizon. "Even someone accused of copyright infringement has rights under the First Amendment."

The foundation has urged the courts to adopt procedures similar to those used in .John Doe defamation cases, which involve allegedly defamatory anonymous postings on the Internet, said Seltzer. In those cases, a plaintiff can file a complaint against a John Doe and request a subpoena to compel disclosure of Iris or her identity, but the John Doe would have the opportunity to prove his or her innocence and maintain anonymity.

"Accused copyright infringers should have the same rights as those accused of defamation," said Seltzer. "We don't crack down on all speech when someone is accused of defamation."

Ballard agreed that the copyright infringement cases should follow the defamation example. "In a defamation context, John Doe would have the opportunity' to contest the release of personal information," he said. "That's how [RIAA's] requests for information ought to have been handled."

He noted that RIAA hurt its case by revealing how quickly and efficiently it can gather considerable amounts of information on alleged infringers.

"That's the information that ought to be presented to a judge. Let the judge decide, 'Hey, there's enough information here that I am going to authorize RIAA to invade her personal liberties,'" Ballard said. Under the association's interpretation of the statute, "they don't have to do any of that; they just bypass the due process step."

EFF's Seltzer says the fight is about boundaries.

"We are trying to reassert fundamental rights of privacy. People are already concerned about children's privacy online, identify theft, and spoofing; we need to continue to assert those interests. Copyrights are rights, but they are not the only ones," she said.

Also at issue is the veil of anonymity that members of the online community can use.

"What has been missing in the debate is an articulation of what fundamental rights P2P file-sharers have in cyberspace," Ballard said.

"Those are communities, and, historically, people have the right to join communities and associate within those communities anonymously."

It is undisputed that noninfringing activity occurs within P2P communities, said Ballard, who argued that members of those communities have the right to a presumption that the contents of their home personal computers and their online activities are lawful. They also have the right to participate anonymously in those communities, be said.

"No less than in real space do these rights exist in cyberspace, and in order to invade those rights you have to abide by due process," Ballard said. "That does not occur with the [DMCA] [section] 512(h) subpoena process."

At press time, all the motions in Jane Doe's case were pending before a magistrate judge.