For those who've missed news of the order, TorrentSpy, one of the large "torrent trackers" has recently been ordered to begin recording server logs.

I'll be the first to admit that I don't understand the internals of IIS 6.0, which is apparently what's in use by TorrentSpy. However, I have written ISAPI filters and extensions which can intercept and modify server log data, and I have serious technical questions about the judge's interpretation of things. Unfortunately, I don't have the declarations cited in the order. I assume these give some technical evaluation on how server log information is "stored" in memory.

Of course, the very notion that content is "stored" in volatile RAM runs counter to standard technical terminology and understandings. Storage is different from memory (or RAM or core.) The notion that what lives in an internal memory structure is the equivalent of stored log files is laughable.

The judge trots out copyright principles, which is not a surprise. It's the first thing that came to mind. She cites the recent Ninth Circuit decision, Perfect 10, Inc. v. Amazon.com, Inc.:

In that case, the court stated: "A photographic image is a work that is 'fixed' in a tangible medium of expression for purposes of the Copyright Act, when embodied (i.e., stored) in a computer's server (or hard disk, or other storage device . . . .) (a computer makes a 'copy' of a software program when it transfers the program from a third party's computer (or other storage device) into its own memory . . . .)"

Well, she has certainly nailed down how software companies get away with licensing use of their software. However, she seems to miss the logical leap she takes after this.

D. Requiring the Preservation and Production of the Server Log Data Is Not Tantamount to Requiring the Creation of New Data Rule 34 only requires a party to produce documents that are already in existence.

Now, just how does the judge figure these logs files are represented in RAM? I have a very hard time believing that an IIS server, told not to keep logs, maintains an honest-to-goodness access log in memory. Instead, at best, I imagine it keeps the request data structures. If we pull out that good old copyright from above, we might find that translating those data structures from their in-memory form to log file format is, in fact, production of new data.

Why is this producing new data? Well, because most likely, the data structure doesn't store all of the log data in one big chunk of contiguous memory in lovely ASCII. Instead, it's no doubt comprised of pointers to memory living throughout the process space. Pulling the data from disparate parts of RAM into a different form is almost assuredly creating new data. Among other things, it will have to be formatted.

From what I can tell, the MPAA wasn't actually asking for a bitmap of the server's RAM at given times. If one were able to take the judge's order seriously at all, that is what I would like to see delivered to the MPAA. Let them figure it out from there.