[Full-disclosure] DMCA letters (testing method)

I'm not sure who is doing the data collection for the RIAA these days, 
but after getting several DMCA notices in the last few days, I've 
noticed that there is never any connection attempts to the IP mentioned, 
during the time mentioned (and yes, I know how to do the math on timezones).

So I conclude the data collection process goes like this :

1) download something and listen to it.
2) retrieve the hash value for the file
3) search directory nodes for who offeres that hash
4) collect the IP addresses
5) provide list to monkeys in room with typewriters.

So they never really *check* to see if the person accused is really 
hosting file, they just trust what the directory server told them.

This of course begs the question :

How can they ask me to take down something they aren't sure is there?

(nevermind that we're a 'provider' under the DMCA and ignore the 
requests unless it's on something we own rather than provide transit to 
-- since it's always residence hall IPs).

When they actually go the distance and sue somebody, do they at least 
check then?

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/