Discovering RAM

The Motion Picture Association of America didn't mean to anger the corporate world when it filed suit for copyright infringement against file-sharing Web site TorrentSpy in February 2006. But that's exactly what it did when it filed a motion to compel the Netherlands-based company to produce key server information that's temporarily stored in random access memory (RAM).

All computers use RAM to store data temporarily. Its contents change frequently, and once a computer is turned off, RAM is completely wiped clean.

In the MPAA's suit the association sought server data stored in TorrentSpy's system that would show the IP addresses of the site's users, what video files they requested and the date and time they made these requests. The MPAA intended to go after TorrentSpy's users for copyright infringement.

In May a magistrate judge issued an opinion forcing TorrentSpy to preserve and produce some of this transitory data. In late August a district court upheld the opinion on appeal. The case, Columbia Pictures Industries v. Bunnell, marks the first time a court has dealt with the issue of whether data stored in RAM constitutes electronically stored information.

"This case sheds light on the complexity of e-discovery in a way that most attorneys who are used to traditional paper-based systems don't understand--that there are these places where information can indeed be found that are off their radar screens," says Ken Withers, director of judicial education and content for The Sedona Conference.

Elusive ESI
RAM is constantly in a state of flux. It's used to temporarily store information without constantly accessing the hard drive, which would slow down the computer. Oftentimes, computers access and alter RAM in fractions of a second, making it virtually impossible to capture and control.

"If RAM is discoverable and you have a duty to preserve it, the question then is how often you would capture it, because it changes second by second," says Doug Rogers, partner at Vorys, Sater, Seymour and Pease. "There are programs out there that can put RAM data in nonvolatile memory, but would you do that every day, every hour or every second?"

And transient data doesn't just come in the form of RAM.

Computers temporarily store files for a variety of purposes. For example Internet cache files, one of the most well-known forms of temporary data, are copies of a user's Web-surfing history, which computers use to reload certain Web pages faster.

Swap files are another form of temporary data. Computers create these files when a user is working within common office software, such as Word or Excel. Prior to saving the document to the hard drive, the computer takes a temporary snapshot of the document and saves it in the form of a swap file.

"Searching for and retrieving this kind of information is the bread and butter of computer forensics," Withers says. "People have been looking for this stuff for years. But it's only within the last couple of years that there's been an effort to bring this stuff into civil litigation."

If the MPAA case becomes the standard, companies could have a duty to preserve all types of temporary information. That means companies could even have a legal obligation to preserve phone conversations conducted over VoIP networks.

"With VoIP literally every conversation over the phone exists briefly in the memory of the computer," says Fred von Lohmann, senior staff attorney for the Electronic Frontier Foundation, a nonprofit organization focused on Internet users' rights. "So do in-house counsel now have the obligation to record every phone conversation to search for potentially relevant information?"

Big Burden
TorrentSpy tried to convince the judge it shouldn't have to produce such data, relying on three key points listed in the amended Federal Rules.

First, the company questioned whether RAM is discoverable as defined under Rule 34(a), which states, "Any party may serve on any other party a request to produce ... electronically stored information." The rule offers no further definition as to what "stored" means, creating two divisive lines of thought: those who consider RAM stored information and those who don't.

"It's incorrect to say information that immediately goes away is stored information," Rogers says. "It's more similar to talking. Having a conversation doesn't constitute stored information, and neither should RAM."

The defense also relied on another provision of Rule 34, which explicitly states parties are not required to produce information if doing so requires creating documents not already in existence. In TorrentSpy's view, capturing server data, which the company did not routinely preserve, constitutes creating a new document solely for the purpose of discovery. The judge disagreed.

"[B]ecause the Server Log Data already exists, is temporarily stored in RAM and is controlled by defendants, an order requiring defendants to preserve and produce such data is not tantamount to ordering the creation of new data," wrote U.S. Magistrate Judge Jacqueline Chooljian in her opinion.

TorrentSpy's third line of defense was that preserving and producing RAM information creates an undue burden, another exception to production cited in the Federal Rules. However, in the end the judge determined that the defense overstated the burden of being forced to produce the information.

Be Prepared
TorrentSpy may have had more luck winning the last point if hadn't used its internal IT team to serve as its experts. The judge believed these experts exaggerated the extent of the burden. That, along with the unique facts of the case, may soften the blow of this decision.

"Most of these cases that rely on transient data will involve some unusual facts where the traffic through the computer had significance, independent of the files themselves," Withers says. "That's rare."

Others, however, believe plaintiffs' lawyers will take this case and run with it.

"What's scary about this case is that maybe next time a lawyer will request transient information under a different set of facts and say to the court, 'We want you to apply the district court's opinion in the MPAA suit here,'" says Ralph Losey, shareholder at Akerman Senterfitt in Orlando, Fla. "Everyone's worried that the ice has been broken, and they don't know how far it will go."

Technology Editor

Keith Ecker

Bio and more articles

Join the Conversation

Advertisement. Closing in 15 seconds.