From: Ty Heath [MediaDefender]
Sent: Wednesday, June 6, 2007 7:02 p.m.
To: it <it@mediadefender.com>
Subject: pm webserver

The 65.120.42.146 pm webserver has been compromised […]
As a side note, please do not ever use the old passwords on anything.

The first time Ethan broke into MediaDefender, he had no idea what he had found. It was his Christmas break, and the high schooler was hunkered down in the basement office of his family's suburban home. The place was, as usual, a mess. Papers and electrical cords covered the floor and crowded the desk near his father's Macs and his own five-year-old Hewlett-Packard desktop. While his family slept, Ethan would take over the office, and soon enough he'd start taking over the computer networks of companies around the world. Exploiting a weakness in MediaDefender's firewall, he started poking around on the company's servers. He found folder after folder labeled with the names of some of the largest media companies on the planet: News Corp., Time Warner, Universal.

Since 2000, MediaDefender has served as the online guard dog of the entertainment world, protecting it against internet piracy. When Transformers was about to hit theaters in summer 2007, Paramount turned to the company to stop the film's spread online. Island Records counted on MediaDefender to protect Amy Winehouse's Back to Black album, as did NBC with 30 Rock. Activision asked MediaDefender to safeguard games like Guitar Hero; Sony, its music and films; and World Wrestling Entertainment, its pay-per-view steel-cage championships and pudding-wrestling matches.

MediaDefender's main stalking grounds are the destinations that help people find and download movies and music for free. Sites such as the Pirate Bay and networks like Lime Wire rely on peer-to-peer, or P2P, software, which allows users to connect with one another and easily share files. (See what movies, television shows, and music are most downloaded.) MediaDefender monitors this traffic and employs a handful of tricks to sabotage it, including planting booby-trapped versions of songs and films to frustrate downloaders. When the company's tactics work, someone trying to download a pirated copy of Spider-Man 3 might find the process interminable, or someone grabbing Knocked Up might discover it's nothing but static. Other MediaDefender programs interfere with the process pirates use to upload authentic copies. When Ethan hacked into the company, at the end of 2006, MediaDefender was finishing an exceptional year: Its revenue had more than doubled, to $15.8 million, and profit margins were hovering at about 50 percent.

Ethan and I had first started talking over an untraceable prepaid phone that he carried with him. He eventually agrees to speak in person, as long as I protect his identity. (Ethan is a pseudonym.) We meet after school, in a bookstore that he says is near his house. He hands me a flash drive containing documents that I was later able to independently verify as internal, unpublished information belonging to MediaDefender. He also pulls out a well-creased sheet of paper bearing my name, the first five digits of my Social Security number, a few pictures of me, and addresses going back 10 years. "I had to check," he says. Then he asks me about another Roth he has been researching; it turns out to be my brother. "I was just starting to dig in to him," he says. "There's a lot there." Ethan is a handsome kid, with broad shoulders and a preppy style, and is unfailingly polite, cleaning up the table after I buy him a coffee and patiently walking me through the intricate details of Microsoft security procedures.

Ethan explains to me that the Christmastime break-in didn't proceed very far. While logged into MediaDefender on one computer, he chatted on another with some hacker friends to see if they knew anything about the firm. But the conversation quickly shifted to other exploits the group wanted to pull off on that cold evening—cell-phone hacks, fake pizza deliveries, denial-of-service attacks—and Ethan moved on.

In the spring, however, he decided to explore the company again. Over the next few months, Ethan says, he figured out how to read MediaDefender's email, listen to its phone calls, and access just about any of the company's computers he wanted to browse. He uncovered the salaries of the top engineers as well as names and contact information kept by C.E.O. and co-founder Randy Saaf (with notations of who in the videogame industry is an "asshole" and which venture capitalists didn't come through with financing). Ethan also figured out how the firm's pirate-fighting software works. He passed on his expertise to a fellow hacker, who broke into one of MediaDefender's servers and commandeered it so that it could be used for denial-of-service attacks.

Ethan continued to log in to MediaDefender about twice a week throughout the summer of 2007. Usually, he'd head down to the basement office after his S.A.T. prep classes. After a while, his friends grew tired of hearing about his stunts inside Monkey Defenders, as he began to call the company. And eventually, he himself got bored. So in September, he decided to give the entire thing up, but not before he and a few fellow hackers pulled a prank: They grabbed a half-year's worth of internal emails and published them on the same file-sharing sites prowled by MediaDefender. A comment posted with the messages read, "By releasing these emails we hope to secure the privacy and personal integrity of all peer-to-peer users. The emails contains [sic] information about the various tactics and technical solutions for tracking P2P users, and disrupt P2P services.... We hope this is enough to create a viable defense to the tactics used by these companies." It was signed MediaDefender-Defenders.

A few days later, Ethan and his friends put more material online. One file contained the source code for MediaDefender's antipiracy system. Another demonstrated just how deep inside the company they had gone. This file featured a tense 30-minute phone call between employees of MediaDefender and the New York State attorney general's office discussing an investigation into child porn that the firm was assisting with. (MediaDefender refused to comment for this story.) The phone call makes clear that the hackers had left a few footprints while prowling MediaDefender's computers. The government officials had detected someone trying to access one of its servers, and the hacker seemed to know all the right log-in information. "How comfortable are you guys that your email server is free of, uh, other eyes?" an investigator with the attorney general asked during the call.

"Oh, yeah, yeah, we've checked out our email server, and our email server itself has not been compromised," the MediaDefender executive said.

But, of course, it had.

"In the beginning, I had no motivation against Monkey Defenders," Ethan tells me. "It wasn't like, 'I want to hack those bastards.' But then I found something, and the good nature in me said, These guys are not right. I'm going to destroy them."

And so he set out to do just that: a teenager, operating on a dated computer, taking on—when his schedule allowed—one of the entertainment world's best technological defenses against downloading. The U.S. movie industry estimates that it loses more than $2 billion a year to file sharers; the record industry, another $3.7 billion. "Piracy," intoned Dan Glickman, the head of the Motion Picture Association of America trade group, to Congress in late 2006, "is the greatest obstacle the film industry currently faces." Instead of figuring out whether there is a way to make online distribution work—to profit from downloading—the industry has obsessed for years with battling it. Yet it took only a few months for Ethan to expose just how quixotic that fight has become.

From: Randy Saaf
Sent: Wednesday, April 11, 2007 9:24 p.m.
To: [various MediaDefender employees]
Subject: Fw: .edu filtering

Team Universal is curiouse [sic] if we have any historical data over the last 3 months that show whether .edu IP addresses on p2p have gone down. They want to see if their lawsuits are getting students to stop using p2p (take a moment to laugh to yourself). Let me know if anyone has any ideas.

When Saaf co-founded MediaDefender in 2000, Napster was at the height of its popularity. The file-sharing service was wildly popular on college campuses, where students used speedy broadband lines to amass huge music collections. The Recording Industry Association of America, the music-business trade group, considered Napster to be its No. 1 problem. Saaf thought he had a way to contain it. He invited Cary Sherman, then an R.I.A.A. executive and now its president, to drop by the startup's cramped Claremont, California, offices. As soon as Sherman walked in, he heard a yet-to-be-released Madonna track blaring from a set of speakers. "He was shocked," says Ron Paxson, one of the company's co-founders. "We showed him how we could block it from getting out onto the internet."

Over the next few years, the firm grew as downloading flourished and terrified entertainment execs turned to it for help. The content-wants-to-be-free chant of the internet generation began reverberating in the nightmares of music moguls—and then of executives further and further up the entertainment industry food chain. As broadband speeds increased and data storage got cheaper, it became easier and faster for anyone with a passing interest in pop culture to trade larger files like TV shows, movies, and software.

The technology for trading them also kept improving. When the record industry shut down Napster in 2001, a drove of oddly named services took its place: Ares, eDonkey, Grokster, Kazaa. In 2002, a lone programmer working at a table in his dining room invented BitTorrent, a technology that made file sharing even faster and more efficient. Within a few years of its creation, BitTorrent activity accounted for nearly 20 percent of all internet traffic. Between 2002 and 2006, the file-trading audience nearly doubled, with an average of more than 9 million people sharing files at any given time, according to BigChampagne, a company that monitors P2P traffic. The firm estimates that more than 1 billion songs are traded each month, a number that has more or less remained constant as the trading of feature films and TV shows has exploded.

Yet it has been difficult to quantify the damage supposedly wreaked by downloading. In mid-2007, economists Felix Oberholzer-Gee, from Harvard, and Koleman Strumpf, from the University of Kansas, published the results of their study analyzing the effect of file sharing on retail music sales in the U.S. They found no correlation between the two. "While downloads occur on a vast scale," they wrote, "most users are likely individuals who in the absence of file sharing would not have bought the music they downloaded." Another study published around the same time, however, found there was, in fact, a positive impact on retail sales, at least in Canada: University of London researchers Birgitte Andersen and Marion Frenz reported that the more people downloaded songs from P2P networks, the more CDs they bought. "Roughly half of all P2P tracks were downloaded because individuals wanted to hear songs before buying them or because they wanted to avoid purchasing the whole bundle of songs on the associated CDs, and roughly one-quarter were downloaded because they were not available for purchase."

Still, the entertainment industry believes it knows a bad guy when it sees one and has reacted to file sharing exactly as a character in one of its thrillers or shoot-'em-up games would: with a full-frontal, guns-a-blazing assault. For the past few years, the R.I.A.A. has employed MediaDefender's competitor, MediaSentry, to trace people uploading music so that the trade group can sue them. The R.I.A.A. and the M.P.A.A. have worked to get government on their side: In 2007, the organizations lobbied to water down a California bill designed to crack down on pretexting—the practice of using false pretenses to get personal information about someone. The M.P.A.A. argued that laws against pretexting would cripple its antipiracy efforts by imperiling "certain long-employed techniques to obtain information." In November, the groups lobbied the House of Representatives in support of a bill to make federal funding for universities partially contingent on how effectively they rid their campuses of file sharing.

"This is not Napster," says Harvey Weinstein, the movie mogul who heads the Weinstein Co., a MediaDefender client. "Online piracy has got to be stopped. The biggest spear in the neck of the pirates will be (a) being vigilant, (b) prosecuting, and (c) in a way, making fun of them, finding a way to say, 'That's not cool—that's anything but cool.' If you had people who the young people respect in this industry—Brad Pitt, George Clooney, Shia LaBeouf—if these guys did public service announcements that said, 'Don't steal, stealing's not cool,' I think you can go a long way toward stopping this." Weinstein says that if Democrats maintain control of Congress and gain the White House, he'll flex whatever political muscle he has acquired by being a major donor to achieve one thing: "Tougher, more stringent piracy laws." Does he see any use for P2P systems? "No."

Certainly, the few attempts that entertainment companies have made to accommodate downloaders have come across as halfhearted and have turned out dismally. Five major movie studios—Sony, MGM, Paramount, Warner Bros., and Universal—sank $150 million into a cumbersome film-downloading service called Movielink, rolled out in 2002. In August, they unloaded the unit to Blockbuster for $6.6 million, after concluding that few consumers had the patience to master a technology that didn't match the ease or quality of that being offered by the pirates. NBC and News Corp. are optimistic about Hulu, a site that offers new and archived TV fare, but the shows contain unskippable ads and can't be downloaded, a disadvantage in this era of DVRs and iPods. All this comes after years of the music industry's blundering around for solutions. "The music companies were put on earth to make the video companies seem like visionaries," says Michael Gartenberg, research director of analysis firm JupiterResearch.

So the entertainment business lives by the motto "If you can't join them, beat them." As with all wars, of course, escalation most benefits the arms merchants. In 2005, the music portal ArtistDirect purchased MediaDefender for $42.5 million, making Saaf and his remaining co-founder, Octavio Herrera, multimillionaires at age 29. To retain the two men, ArtistDirect paid them an additional $525,000 each and gave them easy-to-hit bonuses that would keep their income at about $700,000 a year each. And the clients continued to come, even though those inside MediaDefender could see they were losing ground.

From: Jonathan Perez [MediaDefender]
Sent: Friday, June 22, 2007 6:33 p.m.
To: [various MediaDefender employees]
Subject: Sicko Torrents Results 6/22

Attached are today's internal testing results for Sicko. Our overall effectiveness did improve. However, we still have no presence on Pirate bay which is a site they are likely watching as it was mentioned in the AdAge article they referenced.

>From: Ethan Noble [Weinstein Co.]
>Sent: Friday, June 15, 2007 10:41 a.m.
>To: [various Weinstein employees]
>Subject: Re: Piracy—this is a real
>problem
>
>This is AdAge's main story today and
>they talk about ThePirateBay.org
>having [Michael Moore's Sicko] so I
>did a quick search and there are a
>couple of copies of the film on there
>right now. MAYBE and HOPEFULLY
>those are our guy's 'fake' versions…

Before Ethan started toying with MediaDefender, the company's biggest problem was a tall 29-year-old Swede named Peter Sunde. He and two partners run the most popular file-sharing site, the Pirate Bay. It draws about 25 million unique visitors every month; dozens of new movies, games, and TV shows pop up each hour. The R.I.A.A.'s international counterpart refers to the site as the "international engine of illegal file sharing." The Pirate Bay doesn't host any of the actual content; it just lists it and supplies the BitTorrent files that let people connect with each other in order to share their libraries.

Sunde lives in a tranquil suburb of Malmö, Sweden, once the country's shipbuilding capital. Today, he's dressed in jeans and a sweatshirt embroidered with a mushroom from the videogame Super Mario Bros. He opens the MacBook Pro in his living room and starts reading a recent email from an attorney representing Prince and the Village People: " 'The owners of the Pirate Bay willfully and unlawfully exploit and misappropriate both Prince's and the Village People's intellectual property and infringe on their rights of publicity,' blah, blah, blah. 'Regardless of Pirate Bay's wishful thinking and erroneous public-relations position on its website that U.S. intellectual property laws are inapplicable,' blah, blah, blah, 'the Swedish government may not be able to protect you.'

"I was reading this yesterday, and I started laughing so hard," Sunde says, swiveling in his chair. "They're going to reach our company? We're not even a company." The partners run the site more as a hobby: There is no registered trademark and minimal overhead. The Pirate Bay is basically just the domain name and a website. Sunde then reads me the reply he is about to post. "For fuck's sake," it begins, "get your facts straight," and becomes more insulting from there.

Sunde is a bit of a philosopher when it comes to what his site does. As he sees it, the Pirate Bay is simply delivering a service to consumers, giving them the entertainment they want when they want it. He motions to the home theater he has rigged up: "Just look at this. I have my own cinema. When I watch a movie, I'd rather be here with a blanket and a girlfriend than at the cinema with a lot of people that are annoying. And that has nothing to do with file sharing. The technology is here for us, so why shouldn't we do it?" As far as Sunde is concerned, Hollywood should stop attacking him and start listening. According to him, consumers don't care about how Hollywood wants to schedule its releases—movie theaters first, then pay-per-view, and so on. They want the content when and where it's convenient and comfortable. Is that so hard to understand?

Sweden is a file sharer's heaven. Its laws protect internet service providers from being sued for what passes through their networks, which gives them little incentive to turn downloaders over to groups like the R.I.A.A. or the M.P.A.A. The country is one of the most wired in the world, with high-speed-internet penetration as high as 75 percent in some areas and an average broadband speed that's nearly five times faster than that of the U.S. And as a rule, Swedish authorities have never been that interested in going after a bunch of websites that didn't seem to be doing anyone any real harm.

Nonetheless, Hollywood tried lobbying Sweden to do something about the Pirate Bay. In May 2006, partly at the prodding of the M.P.A.A., 52 Swedish police barged into multiple locations, including the Stockholm offices of the I.S.P. run by Sunde's partners, Gottfrid Svartholm and Fredrik Neij. Police confiscated 186 pieces of computer equipment and hauled in Svartholm and Neij for questioning. Sunde, who was at home in Malmö, learned about the raid from an email. He quickly downloaded the entire site to his home computer—source c