More Prenda Insanity: Lawyer Claims Defendant Erased Infringing Activity Using A Registry Cleaner, Citing A Single EHow Submission

from the BREAKING...-Gibbs-has-filed-a-motion-for-a-'bad-court-thingy' dept

Tue, Feb 5th 2013 2:37pm — Tim Cushing

Are you ready for some more fun courtesy of Prenda Law? While there are many copyright trolls wandering the judicial system, few have proven more entertaining than Prenda Law and its partners in unintentional levity, including AF Holdings, John Steele and superlawyer Brett Gibbs.

Brett Gibbs takes center stage (again) in an ongoing copyright infringement lawsuit that has been winding its way through the courts since May of last year. Once again, Gibbs felt he had found something resembling evidence on the defendant's (Joe Navasca) hard drive, and brought in some outside "expertise" to back up his claim of "spoliation." Specifically, Gibbs felt that a registry cleaner found on Navasca's hard drive was evidence that he had removed all traces of UTorrent and any downloaded files.

Navasca's lawyer fired a letter back challenging Gibbs' emergency motion to compel on the grounds that everything about the motion was severely ignorant.

The instant discovery dispute ultimately centers around a particular bit of software that the defendant had running on his computer – C-Cleaner. Plaintiff alleges, without any support other than an “EHow.com” user submission, that using C-Cleaner is “proof” that Defendant was destroying evidence.

Let's just pause for a moment in appreciation Gibbs' technical source, EHow. While it is generally a vast improvement over Yahoo! Answers, it's hardly the sort of place a lawyer should turn to for technical advice, especially when already over his head in a farcical legal battle, but especially when it's a single user's submission. I guess there's just no time to search for a second opinion when you're in Prenda Law. These holes won't dig themselves!

Navasca's lawyer, on the other hand, decided to quote an actual expert.

As described in the annexed declaration of a Certified Computer Examiner, C-Cleaner’s default functions (the only ones used by Defendant) do not permanently delete data, and only affect data that the average user does not even know exists.

CCleaner's own website describes what the utility does:

It removes unused files from your system - allowing Windows to run faster and freeing up valuable hard disk space. It also cleans traces of your online activities such as your Internet history. Additionally it contains a fully featured registry cleaner.

And here's how the actual Certified Computer Examiner describes CCleaner's functions under the penalty of perjury in a federal civil action, which Navasca's lawyer attached as Exhibit A.

9. CCleaner is not a “wiping program” and is not designed to “permanently remove information from a computer.” By default, CCleaner removes temporary internet files and other system files.

10. ...For the most part, these are files that the average user does not even know exist and cannot even be viewed by most users. None of the files CCleaner deletes would be within the scope of discovery requests or be considered ‘reasonably accessible’ under FRCP 26.

24. The mere existence of a program such as CCleaner is not sufficient to support an allegation that a party has engaged in inappropriate conduct or deliberately attempted to destroy information. I have examined hundreds of hard drives and many of those contained the CCleaner program...it can be considered a useful program.

25. ...I have worked on many other cases where different programs were used to eliminate data – programs specifically designed for this purpose such as “Evidence Eliminator”. Unlike CCleaner, Evidence Eliminator wipes the free space of the hard drive by default. And in all such cases, the programs had been uninstalled before I imaged the hard drive for examination.”

So, on the "strength" of a single EHow submission, Gibbs hoped to bypass any concerns about privilege or privacy, singling out Navasca as a copyright infringer covering his tracks with a program that a.) doesn't even perform that specific function and b.) that he had downloaded years before this suit was filed.

There's more, though. When asked for the name of someone impartial to perform the hard drive inspection, the plaintiff named Peter Hansmeier, an "individual with familial ties to Prenda Law and its predecessor in interest, Steele Hansmeier." Not only that, but Hansmeier has "ties to instant litigation." So much for "impartial."

Navasca's representative also pointed out that while the defendant was willing to have his drive inspected, he could hardly grant that same permission for everyone else in his household. As is pointed out in this rather scathing letter, most (if not all) e-discovery vendors require certification that the owner, or the court itself (via a subpoena) has granted this permission.

Three days later, Judge Vadas added to Prenda's woes, delivering a terse denial of Gibbs' motion to compel. After instructing Navasca to stop running CCleaner on his computer(s), Vadas delivers this bit of advice to Gibbs.

Furthermore, allegations of spoliation are extremely serious, and the court urges Plaintiff to review the facts very carefully before pursuing this avenue based solely on an eHow.com article. In particular, Plaintiff should review the expert declaration that Navasca filed with his letter brief, to fully understand the purpose and effect of CCleaner.

As if it weren't completely apparent by now, AF Holdings, Prenda Law and their personnel are grasping at straws, somehow hoping to fumble their way into a payday while simultaneously burning their collective reputations to the ground, salting the earth and setting fire to the salt.

Defendant Letter (PDF)Defendant Letter (Text)

Motiondenial (PDF)Motiondenial (Text)

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: brett gibbs, ehow, evidence, spoilation
Companies: prenda, prenda law

44 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

Anonymous Coward, 5 Feb 2013 @ 2:47pm

By that logic...
If I format my hard drive, I must be hiding terrorist acts.
[ link to this | view in thread ]
John Fenderson (profile), 5 Feb 2013 @ 2:53pm

Re: By that logic...
Not necessarily. You could be collecting kiddie porn. Just like how if you use a VPN, P2P software, or a file locker, you are obviously a pirate.
[ link to this | view in thread ]
Jeffrey Nonken (profile), 5 Feb 2013 @ 3:00pm

Wow. Tim, what a cushy job you've got here, no pun intended. I mean... this stuff writes itself. All you have to do is spellcheck and format. :)

Excuse me, I need to run out and invest more money in Pop Secret. With extra butter.
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 3:00pm

Re: Re: By that logic...
That's basically what this person at Prenda Law is saying. Also CC cleaner's primary purpose is to optimize your PC getting rid unnecessary files and registry issues that slow you down.
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 3:03pm

I would have loved to have seen the expression on Gibbs' face when he received that bit of advice.

I wonder if he's going to throw another "this judge hates me!" temper-tantrum now? I'm pretty sure he'd get laughed out of court (again), considering he tried to present a random eHow.com article as expert testimony or whatever.
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 3:04pm

And to think, it used to be called CrapCleaner.

For the lulz in this case alone (and while reading these filings), I wish it still was.
[ link to this | view in thread ]
Vidiot (profile), 5 Feb 2013 @ 3:05pm

Re: Re: By that logic...
Don't forget open WiFi!
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 3:07pm

"Your Honor, I present exhibit A."
"You handed me a blank piece of paper."
"Exactly. The lack of illegal content on this piece of paper is proof positive that the Doe is guilty of destroying the illegal content that they had obtained illegally through illegal means."
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 3:14pm

Ccleaner Wiper
Ccleaner does in fact have a wipe function. You can set it to use multiple passes, up to 35, and it will perform this function on the contents of your Trash Bin, or free space. More recently they began offering the wiping of cluster tips, a function I had seen in other drive wipers. This is the tool I use to get rid of cookies I don't want, along with all the other Internet crapola that get left.

The registry cleaner appears to look for entries that have no corresponding file, and then removes those entries. Might be useful to hide having certain previous installations, but I find that uninstaller programs tend to leave a lot of stuff laying about. This does not remove all traces of a program.
[ link to this | view in thread ]
GMacGuffin (profile), 5 Feb 2013 @ 3:16pm

... somehow hoping to fumble their way into a payday while simultaneously burning their collective reputations to the ground, salting the earth and setting fire to the salt.

And Prenda et al. must just love Techdirt for continuing to keep this all so easily searched and retrieved.
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 3:30pm

Question to the techies here

Is this "CCleaner" any better than the "Little Registry Cleaner" I use?
[ link to this | view in thread ]
Mr. Applegate, 5 Feb 2013 @ 3:57pm

Re:
I am not familiar with little registry cleaner. However, it is fairly easy to test. Run one. Then the other if the second finds stuff it is better. If not... run them in reverse order next time. Then you have your answer.
[ link to this | view in thread ]
Franklin G Ryzzo (profile), 5 Feb 2013 @ 4:02pm

Op Gibbs?
Am I the only person that is beginning to think there is no real Brett Gibbs and this has all been an elaborate trolling operation by 4chan or reddit? You seriously can't make this shit up!
[ link to this | view in thread ]
Rich Fiscus (profile), 5 Feb 2013 @ 4:03pm

If he had put that web surfing time into searching Ray Beckerman's archives he would know it only costs $200 an hour to get the RIAA's forensic expert (Doug Jacobson) to testify that a lack of evidence is actually proof there's a second computer. Beckerman already did all the hard work by establishing Jacobson is only "borderline incompetent."

For another C-note he might even change his name to Alan Cooper. Just tell him it's like witness protection from his reputation.
[ link to this | view in thread ]
Raul, 5 Feb 2013 @ 4:19pm

The real lulz will come the day Prenda is forced to disclose its 100% accurate, top secret IP address harvesting program and geolocation tech, probably to the DOJ.
[ link to this | view in thread ]
Raul, 5 Feb 2013 @ 4:19pm

The real lulz will come the day Prenda is forced to disclose its 100% accurate, top secret IP address harvesting program and geolocation tech, probably to the DOJ.
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 4:33pm

And to think these are the hacks that average_joe and hurricane head up the ass are banking their money on.
[ link to this | view in thread ]
kenichi tanaka, 5 Feb 2013 @ 5:02pm

The judge instructed Navasca to stop running CC Cleaner on his computer? Why? I use it all the time to remove files leftover from software I have previously installed on my machine. Plus, CC Cleaner is not the only hard drive or registry cleaner on the market. I can name several of them that I use.

The judge is just about as stupid as Prenda Law is. It's like they're using the same guidebook when it comes to "understanding the internet and computers". lols
[ link to this | view in thread ]
Capitalist Lion Tamer (profile), 5 Feb 2013 @ 5:10pm

Re:
My guess is the judge ordered this to keep Gibbs from revisiting the issue, thus giving the overmatched lawyer one less thing to complain about.
[ link to this | view in thread ]
Pixelation, 5 Feb 2013 @ 5:10pm

Next time they should suggest he erased evidence from his hard drive because he has a pencil eraser in his desk.
"Your Honor, my evidence is, there is no evidence!" "Convict!"
[ link to this | view in thread ]
Capitalist Lion Tamer (profile), 5 Feb 2013 @ 5:13pm

Re:
Wow. Tim, what a cushy job you've got here, no pun intended.

I hear that. I got bedsores just "compiling" it. :) Prenda Law has been linked to muscular atrophy. Yet another reason it must be stopped... eventually... one it stops being entertaining.
[ link to this | view in thread ]
Capitalist Lion Tamer (profile), 5 Feb 2013 @ 5:14pm

Re: Re:
*once
[ link to this | view in thread ]
Anonymous, 5 Feb 2013 @ 5:18pm

I have 3 cleaning programs (Clean Disk Security, Tracks Eraser Pro, and CleanUp) and use them after each use of my computer.
[ link to this | view in thread ]
Anonymous, 5 Feb 2013 @ 5:20pm

Re: Re: By that logic...
But haven't you heard? Kiddie porn funds international terrorism!
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 5:33pm

There was a story a while ago about licensing barriers put in place to keep folks from entering particular markets. Sounds like they need to reevaluate some Bar exams. I have to go to traffic school when I get a ticket for going 10 over the speed limit. The least they can do is make sure this chuckle-head knows which laws he's pissing over when he files nonsensical motions.
[ link to this | view in thread ]
The Real Michael, 5 Feb 2013 @ 6:29pm

Hey, I use CCleaner all the time to keep my computer nice and clean. Otherwise, it gets bogged down, especially on a site like YouTube which eats away at virtual memory. I also use Free Internet Window Washer in tandem. Both do an exponential job. Also, it's a good idea to clean your registry, wipe your HD, defrag, and error check occasionally. It's called keeping your computer clean, healthy and error-free, i.e. what smart people do.

Is everyone who cleans their HD attempting to conceal or destroy evidence of something?
[ link to this | view in thread ]
ltlw0lf (profile), 5 Feb 2013 @ 7:07pm

Re: By that logic...
If I format my hard drive, I must be hiding terrorist acts.

I wonder what they would make of my hard drives, formatted with JFS and not running Windows.

"Your honor, he is obviously hiding weapons of mass destruction which would harm my client's case because he installed Lenux on his computer."
[ link to this | view in thread ]
G Thompson (profile), 5 Feb 2013 @ 8:13pm

Re:
Same here (for Win computers anyway) and I'm actually one of those Certified Computer Examiners (GIAC certified) and CCleaner is something I'm finding more and more lately on devices which is actually a good thing since it means people are becoming more aware of the bloatware and problems that Windows is full of.

In no way by itself does having a program like this mean you are trying to hide, destroy or change evidence. In fact the way a forensic analysis of a HDD works it won't care if you have them or not and unless there is other proof that evidence was contained on the Drive at some previous point in time (before analysis was ordered) that is relevant to the analysis at hand then proving reliably that the lack of evidence means spoliation or destruction of evidence is completely unworkable and any CCE that places their name on such a report needs to be professionally and personally shamed.

For those that are using CCleaner, you also might like to look at ccEnhancer that adds 900+ programs to the rule list list. It also works on BleachBit (an open source equiv for CCleaner that works under *nix too)
[ link to this | view in thread ]
btrussell (profile), 5 Feb 2013 @ 8:50pm

The judge must be killing himself laughing. I mean, how much rope do they need?
[ link to this | view in thread ]
JohnnyRotten (profile), 5 Feb 2013 @ 9:51pm

Re: Re:
Hadn't heard of it, but now installing it. Love the bloatware removal part. Thanks all.
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 11:10pm

Shit if I'm going to nuke my drive I would encrypt,reformat,overwrite it, and repeat to be safe. The password would be absurdly long and unknown since you cannot give what you don't know.
Even if they do find data it would be impossible to recover.

Honestly everyone should encrypt their drives to begin with. It's a good practice to protect your data and having to enter a password when you boot up is not going to kill anyone. I could be wrong though and the extra few seconds could put people in the loony bin.

My computer is protected to the max for one reason, because I can. Sure it might only be some vacation photos and my personal Photoshop collection but it's mine and I have the right to protect it even if it only has value to me.
[ link to this | view in thread ]
Anonymous Coward, 5 Feb 2013 @ 11:12pm

Re: Re: Re: By that logic...
You don't even need open WiFi. WiFi can be easily hacked, or at least it was still the case a few years ago (so anyone with an old router is at risk). I believe the issue was that WEP keys (if I'm not mistaken) were not very secure and just very easy to crack.

Consider also that many people have short and simple passwords that a brute force attack would crack in just a few minutes. Or better yet, anyone can just try to enter '1234', '123456', '4321' and '654321' as a password since apparently more than 50% of people use one of these.

So just having a WiFi should be enough to cast doubt that nobody but you could have connected to the web through your IP address, that WiFi doesn't need to be open.
[ link to this | view in thread ]
alanbleiweiss (profile), 6 Feb 2013 @ 12:40am

Re:
or they'll discover a magnet on his refrigerator. "Your honor, clearly the magnet on his refrigerator is proof he chose to willfully destroy all traces from his computer..."
[ link to this | view in thread ]
G Thompson (profile), 6 Feb 2013 @ 12:53am

Re:
Easier still - encrypt an SSD drive.

They are an absolute PITA to analyse and becoming very very problematic for evidence recovery.
[ link to this | view in thread ]
Ninja (profile), 6 Feb 2013 @ 2:58am

I sincerely didn't think such clueless, stupid people existed in this planet.
[ link to this | view in thread ]
G Thompson (profile), 6 Feb 2013 @ 4:08am

Re:
Who are you and what have you done with the real Ninja who has seen the trolls on TD, articles about Carreon and other batshit crazies (Crystal Cox comes to mind).

Oh and the Darwin awards are a fantastic way to stop De-Evolution of the human species! ;)
[ link to this | view in thread ]
Anonymous Coward, 6 Feb 2013 @ 4:17am

Re: Re:
But if they already imaged his drive, why would that even matter at this point?
[ link to this | view in thread ]
The Real Michael, 6 Feb 2013 @ 5:20am

Re: Re:
Yeah, having cleaning software is very useful. A relative of mine would never clean her PC, so it would become bogged down to the point where just clicking on My Computer would take maybe two minutes(!) to show onscreen. I'd have to go over and clean all the junk out, which would inevitably include sifting through her files looking for whatever junk was still lying around, e.g. uninstall folders, useless downloads, etc. By the time I was finished, her computer was running much more quickly. It's also a good idea to keep anti-virus/malware/spyware programs on online-enabled computers.

Thanks for the link. I'll go check it out.
[ link to this | view in thread ]
Josh in CharlotteNC (profile), 6 Feb 2013 @ 5:36am

Re:
Both are equally worthless, and while unlikely, they could damage legitimate programs you want to be able to run.

Deleting temporary internet cached files is easily done in a safe manner via your browser. Allowing a cleaner utility to remove registry entries for other programs is not likely to be a good idea, as the creator of the cleaner is unlikely to have knowledge of how those other programs work.
[ link to this | view in thread ]
madasahatter (profile), 6 Feb 2013 @ 7:35am

Re: Re: By that logic...
I have often wondered about the competency or computer literacy of many these "experts". While registry cleaning is common on Windows boxes; all computers accumulate miscellaneous trash files that do need eventual purging.

C-Cleaner's removal and other similar software defaults to removing common garbage files that have accumulated over time. The downloaded infringing files probably have an extension *.mov and are not typically removed by these programs.

Also, Linux distros often have frequent releases and I suspect many Linux users update their distro more frequently .

Another question is whether these "experts" realize or know that Linux can use several different formats that Windows does not read because MS chose not to allow it.
[ link to this | view in thread ]
DannyB (profile), 6 Feb 2013 @ 7:49am

Re: Re: Re:
It wouldn't matter. But narrowing the new 'arguments' that Gibbs can use is important to the judge.

It also helps make the case more appeal proof. The last thing the judge needs is for Gibbs to be able to even get this case accepted by the appeals court for any missteps on the part of the judge.

The judge is just being very careful. Dotting all T's and crossing all I's.
[ link to this | view in thread ]
Mr. Applegate, 6 Feb 2013 @ 9:30am

Re: Re:
The registry cleaners work by checking the references made in the registry entries. Do the referenced items exist? Yes, OK move on. No? remove them. there is no need to know about the software that runs on the PC, we are only verifying the data in the registry is valid (all the links are present and that they too are valid).

I can't think of one instance where using a registry cleaner has harmed a otherwise working software. I have seen it help clean up a system so malfunctioning software started working properly.

On systems that have a lot of churn in software they are an invaluable tool to help keep the registry free of errors.
[ link to this | view in thread ]
Josh in CharlotteNC (profile), 7 Feb 2013 @ 7:23am

Re: Re: Re:
can't think of one instance where using a registry cleaner has harmed a otherwise working software.

You want a specific example? This one isn't even related to ad/spyware - just questionable design of software drivers. Back when I worked at Canon, we would occasionally run across a system with a seriously screwed up print spooler that we could never get printing properly. Did some research, and eventually found out that some Lexmark printers used their own version of the print spooler, and would change various registry entries to redirect the standard Windows spooler to theirs(this is the bad software design bit). This worked fine as long as their software was installed, and would work fine if that software was properly un-installed, as the un-installer reset them back to what they should have been. However, if the software was simply deleted, it left those registry entries intact pointing to files that no longer existed. Guess what would happen when those registry cleaners found that little problem? Entire Windows printing systems were fubar'd and couldn't be fixed without an OS reinstall. Without those cleaners, all it took was someone knowledgeable pointing the registry entries back to the standard spooler service.

While that may be a specialized example, there were plenty of other situations with programs using shared files/libraries that could experience the same type of issues.

On systems that have a lot of churn in software

If you've got a system like that, you should be regularly doing clean installs of the whole operating system, and dealing with the cause, not the symptoms.
[ link to this | view in thread ]
Mr. Applegate, 17 Feb 2013 @ 7:00am

Re: Re: Re: Re:
Your example is not about a registry cleaner, but poor software design, which is one of the reasons you need a registry cleaner.

Yes Lexmark used to(not sure if they still do) screw up the print spoolers and I avoided Lexmark printer for years.

I was given a Dell printer that had Lexmark drivers and totally hosed my test system. I don't recall all the details but in the end a registry cleaner actually deleted the incorrect registry entries, Windows was then able to repair the print spooler settings (since they were now 'missing') and get a working system.
[ link to this | view in thread ]