Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 1 of 31 PageID 424

Exhibit "K"

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 2 of 31 PageID 425

UNITEDSTATESDISTRICTCOURT MIDDLEDISTRICTOFFLORIDA ORLANDODIVISION FIRSTTIMEVIDEOS,LLC, ) ) ) ) ) ) ) ) ) ) ) )

Plaintiff,

CivilActionNo. 6:12CV01493CEHKRS May25,2013

v. PAULOPPOLD,

Defendant.

DECLARATIONOFDELVANNEVILLE I,DelvanNeville,declareunderpenaltyofperjuryasfollows: 1.IamownerofAMARAGHASSOCIATESandthecreatorofaproprietary BitTorrentmonitoringsuitetitledEUPSC2k.EUPSC2kusesavarietyofsoftwarecomponents conceptualized,developed,andmaintainedinordertocollectdataaboutbothunauthorizedand authorizeddistributionsofanykindoffilethatcouldbesharedviatheBitTorrentprotocol.As theauthorofEUPSC2k,Iamfullyawareoftheefficiencyandaccuracyofthesoftwareand waspersonallyinchargeofitsdevelopment,features,andcodemodification. 2.IwascontactedbytheDefendant'scounselandrequestedtopassivelygatherdata regardingtheuseofaBitTorrentmonitoringsystempurportedlyusedbyacompanynamed

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 3 of 31 PageID 426

"6881Forensics"forlawsuitsinvolvingcopyrightinfringement,aswellastoattemptto determinethelikelyidentityofPirateBayusersharkmp4.Defendant'scounselprovidedme withseveralhashvaluesrelatingtothePirateBayuserusingthealias"sharkmp4"Defendants counselrequestedthatIgatherinformationsufficienttopresumptivelyidentifysharkmp4aswell asthelikelyoriginofthevideosthatsharkmp4wasreleasing.Defendantscounselofferedmea limitednumberoftorrentidentifiersrelatingtotorrentscreatedbysharkmp4knowntobe monitoredby6881Forensics.(hereinafterhashvalues/infohash(es)).Beforebeingcontactedby Defendantscounsel,EUPSC2khadalreadypassivelymonitoredsomeoftheinfohash(es) providedtomebyDefendantscounsel.SuchdatacollectedbeforeDefendantscounsel requestedcollectionwasalsousedinthisanalysis. FearingthatthelimiteddatasetofferedbyDefendantscounselwouldbeinsufficientfor properidentificationof6881forensicssoftware,Iindependentlyreviewedmultiplecourt docketsandextractedalargersetofhashvaluespreviouslyadmittedtobemonitoredby6881 forensics.ThesehashvaluescollectedreflectasamplesetfromawidevarietyofPlaintiff's, filingattorneys,states,andvariousdifferentworks.Gatheringthisinformationwasimpededto somedegreebyfilings(suchasthecomplaintforthecaseathand)wheretheinfohash(es) althoughafundamentalpartofanyforensicevidencenecessarytoshowswarmidentification arenotcitedincourtdocuments. Becauseofanabsenceofevidentialinfohashinthecomplaintinthismatterandthe previousMiamicase,itisunknownwhetherallallegedparticipantsinvolvedinFirstTime

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 4 of 31 PageID 427

Videosv.Does176,1:12cv20921,(MiamiCase)wereallparticipatinginthesameswarm oftheworkFTVTiffanyasthereareseveraluniqueswarmsassociatedwithsimilarlytitled works. IDENTIFICATIONOFTHEMONITORINGSOFTWARE 3.EUPSC2kwasdesignedtomonitormultipleBitTorrentswarmssimultaneouslyand locatecommonIPaddressesamongmanyBitTorrentswarms.Duringa"PassiveSoak"as employedinthiscase(hereaftersoak),EUPSC2kdoesnotdownloadnoruploadanypieces ofpotentiallycopyrightedmaterialitmerelygathersdataregardingtheparticipantsofincluded BitTorrentswarms.Inthismode,EUPSC2knotifiesotherpeersthatithasnopiecesforthat torrent,andthatitisnotinterestedindownloadinganypieces,butotherwisecommunicatesin thesamemannerasanormalpeer. 4.Iwasnotgivenanyinformationastothenatureof6881Forensicsmonitoring software,orwhatIPaddressorInternetServiceProvider(ISP)thatmightbeusedintheirdata gatheringeffortsandthusmyinquiryintoidentificationofthe6881forensicspeerwasblind.I examinedpreviouslygatheredlogsofEUPSC2k,andbeganseveralsoaksoftherecently collectedhashvalues.Inmyexaminationofthedata,Iwaslookingforcommonpeersamong themanyswarms,asdenotedbytheirIP,software,peerIDandanyanomalousbehavior. 5.Iwasabletoidentifyacommonpeeramongmanyinthevariousswarmsbasedon thesetechniquesandseveralanomalousbehaviorsanormalpeerdoesnotexhibit.Basedon theintendedtargetofthesemultipleswarms,thisuniquecommonpeeramongthemanyswarms

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 5 of 31 PageID 428

isthepeercontrolledby6881Forensics.1Iwilladdresseachofthesebehaviorsindividually, whichsuggestthat6881Forensicsisnotmerelycollectinglogs,butactivelysharingthecontents ofthecopyrightedworksinquestion.2 Background 6.Anygivenswarmisdefinedprimarilybytheinfohashforthetorrentinquestion. ThisinfohashisauniqueidentifiergeneratedusingtheSHA1algorithm.Onceconnectedtoa swarm,apeerinitiatescommunicationwithanotherpeerwithaspeciallyformattedhandshake. Thehandshakeidentifies: theprotocolthepeerwishestouse anyadvanced/alternativeprotocolsthepeersupports theinfohashfortheswarm anidentifierusedbythatpeer(peerID) 7.ThepeerIDhastwoparts:thefirstpartusuallyidentifiesthesoftwareandversion numberusedbythatpeer,althoughahandfulofunusualclientsomitthisfirstpart.Thesecond partisarandomlygeneratedsetofcharacters,withtheintentionofgivingthatpeeraunique peerIDinthatswarm.Mostusers,bydefault,willuseadifferentpeerIDfordifferentinfohashes
EUPSC2kisbasedupontheconceptthatanoriginalsharerofmaterialviaBitTorrentwould

betiedtoausernameonawebsiteandthatusernamewouldhavemultipleuploadsofdifferent materialswithdifferenthashvalues.Examinationofthemultiplehashvaluescanleadtoa commonIPaddressorpeerIDamongthemanyhashvalues,leadingtoinformationwhichcan helpidentifytheoriginalpirateofcopyrightedmaterialsortheoriginalsharerofnoncopyrighted material. 2 Duetothepassivenatureofthesoakforfearofclaimsofcopyrightinfringement,EUPSC2k didnotacceptoffers,madebythe6881peer,todownloadpiecesoftheseworks. 4

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 6 of 31 PageID 429

inanefforttomaintainsomelevelofanonymity. 8.Thehandshakeisthentransmittedbythereceivingpeertotheinitiatingpeer.Ifboth peerssupportthesameadvancedprotocols,theremaybeanadditionalhandshakespecificto thatprotocolaswell,identifyingwhichnonstandardmessagesthosepeerssupport.Common advancedprotocolsaretheFastextension,theLibTorrent(LT)andtheAzureus(AZ) protocols. 9.WiththeinclusionoftheLTandAZprotocols,thenumberoftypesofmessagesthat canbeexchangedisimmense.Themessagesrelevanttothisdiscussion,however,arethebasic messagesinterestedandbitfield,andtheadvancedmessageallowed_fast. 10.Thebitfieldmessageisacompletelistofthosepieces3apeerdoesordoesnot have.Theinterestedmessagemeans,inplainEnglish,YouhavepiecesofthefilethatIwould like.Whentwopeershandshake,theyarebothbydefaultconsidereduninterested.The interestedmessageissentafterapeernotesthatanotherpeerhaspiecesthatitdoesnothave andthatitdoeswanttodownload,usuallybasedonarecentlyreceivedbitfieldfromthatpeer. FortheversionandsettingsenabledinEUPSC2kforthissoak,themonitoringsoftware categorizespeersfromthebitfieldintotwotypes:peerswhoareseedersthathave100%of thefileandareonlyconnectedtotheswarmtosharewithothers,andpeerswhoarenot seedersthatstillhavemissingpieces. 11.Theallowed_fastmessageispartoftheFastextension.AplainEnglishmeaningof

Bittorrentdividesavideo,music,oranyotherkindoffileintopiecesforexchangebetweenpeersinthe swarm.

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 7 of 31 PageID 430

theallowed_fastmessagesisIwillletyoudownloadthispiecefromme,evenifyouarent sharinganypiecesback.Itservestwopurposes:1)fortheinitialuploader/seeder,ithelpsease transactionsintheearlieststagesofaBitTorrentswarmwhennootherpeershaveanypieces and2)itbypassesthetitfortatnatureofBitTorrentallowingotherpeersquickdownloadsof pieces.BecausetheBitTorrentprotocolisatitfortatbasedsystem,peerswithintheswarm willnormallyuploadveryslowlytootherpeerswhoareunwillingorunabletouploadanypieces back.Allowed_fast,whenenabled,bypassesthetitfortatnaturebyallowingthoseother peerstoquicklygainpartsofthefilesothattheyareabletosharewithothers. Identificationof6881Forensics 12.WhenseekingoutaforensicsproviderwithEUPSC2k,thereareanomalous behaviorsthatsetthesemembersoftheswarmapartfromnormalpeers.Theseinclude unusuallyaggressiverequests,falsifiedorrotatingbitfields,andfalsifiedsoftwareidentification. Additionally,crossswarmanalysisallowsfortheidentificationofpeerswhoarecommonto manyorallswarmsknowntobemonitoredbytheproviderinquestion. 13.Crossswarmanalysiswasconductedonatotalof15uniqueinfohashesderived fromamixtureofdirectcitationincomplaints,equivalentvideotitlesthatdidnotcitetheexact infohash,andinfohashesprovidedbyDefendant'scounsel,withatotalof997uniqueIP addresses(IPs)betweentheswarms.SomePrendarelatedworksthatwerenotassociated withsharkmp4wereincludedintentionallyif6881andsharkmp4wereseparateanddistinct entities,6881wouldappearonbothsetsofhashes,whilesharkmp4wouldappearprimarilyon

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 8 of 31 PageID 431

his/herownuploads.ThiswastopreventthelikelihoodofatypeIerror(falsepositive).Four IPswerefoundtobeseedscommonto9ofthe15infohashes,whichresolveto de2x.mullvad.net,se2x.mullvad.net,nl5x.mullvad.netandnl4x.mullvad.net(Mullvadexitnodes). TwoadditionalIPsthatresolvetode1x.mullvad.netandse1x.mullvad.netwerelistedfor7of the16infohashesontrackersbutdidnotinitiatecommunicationwithEUPSC2kduringthe soak.AllotherIPsobservedwereactiveinnomorethan2swarms,andnootherIPwaslisted formorethan3swarmsonthetrackers. 14.MullvadisapaidVPNprovider.4WhenausersetsupaVPNconnectionthrough Mullvad,theirexternalIPwillbeoneofthehandfulofIPsthatMullvadcontrols.Thisallows userstoachievesomedegreeofanonymity.However,Mullvadisnotanespeciallycommon VPNproviderforBitTorrenttraffic:forinstance,outof16.4GBoflogsgatheredover15days onapproximately50swarmsunrelatedto6881Forensics,thede2x.mullvad.netexitnodehas notattemptedasingleincomingconnectiontoEUPSC2k. 15.AllfouroftheseIPsreportedtheexactsameclientsoftwareandversion(Vuze 4.7.1.2),listedtheexactsameportnumber5onthetrackerforeachswarm(10203)andwere connectedtotheexactsame9swarms.AsummaryofalltrackermessagesforthesefourIPsis

VPNorVirtualPrivateNetworkserviceshavelegitimateusesbycorporationstoeliminateprivacy concernswhileusingpublicInternetlocationssuchasCoffeeShops,Airports,orHotels.Theymayalsobe usednefariouslybypeopleevadingdetectionontheInternet. 5 FortheBitTorrentprotocoltoexchangecontentorhandshakes,aportnumbermustbedefined.Port assignmentisanecessaryelementofthetransportlayerofInternetcommunication.RFC1122,pages77116 accessibleathttp://tools.ietf.org/html/rfc1122Oddsforanidenticalportnumberbetweentwodifferent peersisroughlya1/16,384chance(basedontheunassignedrangefrom http://www.iana.org/assignments/servicenamesportnumbers/servicenamesportnumbers.xml)or1/65,536 basedontheentirerangeofvalidportnumbers.

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 9 of 31 PageID 432

includedinExhibitK1.Theirclaimedsoftwareversion(Vuze4.7.1.2)wasonlyavailablefor a2monthperiodin2012makingitrareamongtheswarms.Theywereinfacttheonlypeers claimingthatsoftwareversionduringtheentiresoak.ThelikelihoodthatfourseparateMullvad userswouldhappentochoosethesameportnumberis1in72,057,594,037,927,936,oreven higherifweassumeeithermightchooseanIANAreservedport.Ihavethereforeconcluded thatcommunicationsfromthesefourIPsarecomingfromthesamesource,whoismerely changingwhichMullvadVPNproxyisusedasamiddleman.Myanalysisleadtotheopinion thatthissourceisinfact6881Forensics,andwillhereafterrefertothispeerbythatname.

Analysisof6881ForensicsPeer 16.AllfourIPsusedby6881Forensics(6881peers)usedtheMullvadVPNservice andexhibitedthesameanomalousbehavior,noneofwhichischaracteristicofastockversionof theVuze4.7.1.2client.Asummaryofreceivedmessagesisincluded.ExhibitK2.Thefirst anomalousbehaviorwastheunusuallyaggressivetransmissionofinterestedmessages:6881 peerssent33interestedmessagestoEUPSC2kovera12hourperiod.AsEUPSC2kwas operatinginpassivemode,ithadnopieces,andthusnopeercouldtruthfullyclaimtobe interestedinthepiecesithadavailable.Ineachinstance,6881Forensicshadalreadyreceived abitfieldmessagefromEUPSC2kwhenitsentitsinterestedmessage.Ofthe997IPsin theseswarms,nootherpeersentinterestedmessagestoEUPSC2k.Thisbehaviorencourages filepieceexchangefromeverypeera6881peercontactsevidencinganintenttoidentifypeers

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 10 of 31 PageID 433

whoarewillingtosharethefile. 17.Handshakesfrom6881peerswerealsooutsidethenormalcharacteristicsofa BitTorrentclient.ThepeerIDoftheirsoftware,thoughformattedasiftheywereusingVuze 4.7.1.2,onlyusesnumbercharacters(09)intherandomportionoftheirpeerID.For example:AZ4712704276267518.SeeExhibitK3.Genuine4.7.1.2Vuzeclients,as wellasothersoftwareversionsofVuze,usethefullrangeofprintablecharactersfortherandom portionoftheirpeerID,suchasAZ47123evNZLiW6lFq.6881peerhandshakesindicated theysupportedtheLibTorrentprotocol6,buttheLibTorrenthandshakesreceivedfrom6881 didnotincludeanyinformationamodernversionofVuzewouldtypicallyinclude.Exhibit K2(line3islackinga1:v12:Vuze4.7.1.2entryintheLThandshakeaswellasmetadata normallyincludedbyVuzeinsuchhandshakes).Alsooutsideofnormal,the6881peerdidnot claimtosupporttheAzureusprotocol.7Anespeciallyunusualanduniqueoddity,however,was thattheydidnotuseadifferentpeerIDforeachswarmasmostclientswould.Forinstance, AZ4712201614746815isreusedbythe6881peerfor8ofthe9swarms.ExhibitK2 lines43,44,57,59,335,336,376,1123. 18.The6881peersbitfieldsidentifieditasaseeder(apeerwhohastheentire contentsofthetorrent)forall9swarms.ThepeercontinuouslysentEUPSC2kallowed_fast messages,eventhoughEUPSC2khadpreviouslynotifiedthe6881peerthatitwasnot
6

LibtorrentisahighlycustomizableimplementationoftheBitTorrentprotocol. http://www.rasterbar.com/products/libtorrent/ 7 Azureus&Vuzearetwonamesforthesamesoftwarefamily.AftertheimplementationofAzureusversion 3.1,AzureusstartedtousethenameVuze.ItgoeswithoutsayingthatAzureus/Vuzeshouldsupportthe Azureus/Vuzemessagingprotocol.

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 11 of 31 PageID 434

interestedindownloadinganypieces.Asnotedintheabove,thismessageisastandingofferby 6881tohandoutthefile,regardlessofwhethertheygetanythingbackfromtheuser.Thisis notanespeciallyusefultacticforforensicmonitoring:ausershistoryisalreadyestablishedby theirbitfieldmessagesandafewotheradvancedprotocolmessages.Itissolelyusefulforthe 6881peertosharepiecesofthefile.BecauseofthetitfortatnatureofBitTorrent,handing piecesofthefiletoapeerwouldincrease6881slikelihoodofdownloadingpiecesofthefile backfromthosesamepeers. 6881wasparticularlyaggressiveintheareaofbroadcastingtheallowed_fastmessages aswell1,040allowed_fastofferstodistributeweremadeby6881toEUPSC2kovera12 hourperiod.DespitenearlyathousandotherIPsinvolvedintheseswarmsduringthatsame soak,6881wasresponsibleforoverthirtypercentofthetotalallowed_fasttrafficsentto EUPSC2kduringthatperiod.Amongthosehashesintheswarmthatwereoriginallyuploaded byPirateBayusersharkmp4(discussedfurtherbelow),6881wasresponsiblefor96.8%of thetotalallowed_fasttraffic. MullvadVPNsandcommentsfromWebsitesthatOpposePrendaLaw 19.Asmentionedinfootnote3,above,VPNshavealegitimatepurposebutareoften usednefariouslybythosewishingtoconcealtheiridentityonline.DieTrollDie.comand FightCopyrightTrolls.comareDefendantsinthreelawsuitswhereattorneysofPrendaLawhave suedthewebsiteoperatorsandcommentersfordefamation.8DefendantscounselandI

JohnSteelev.Godfread,Cooper,et.al.,1:13CV20744(S.D.Fl.)PaulDuffyv.GodfreadCooper,et.al., 3:13cv00207(S.D.Il.)PrendaLawv.GodfreadCooper,et.al.,1:13cv01569(N.D.Il.)

10

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 12 of 31 PageID 435

requestedDieTrollDieandFightCopyrightTrolls,respectively,toprovidelogsofcomments madeontheirwebsitewhichtendedtoshowintimateknowledgeofthedetailsofPrendaLaw litigation,PrendaLawattorneys,oranaggressivelyproPrendaLawstance.Thelogs generatedbythesoftwareofthevariouswebsitesconfirmedthatseveralcomments9were postedviaIPaddressesfromaMullvadVPNexitnode.ExhibitK3.Othercomments producedbyFightCopyrightTrollsandDieTrollDieappearedfromMinnesota,andFloridaIP addresses.DuetotheadversenatureofPrendaLawwiththewebsites,andthefactthat6881 ForensicsisthetechnicalproviderofPrendaLawintheirlitigationandusesarareMullvad VPN,suchinquiryconcludedwithafindingthatitismerelyprobablethepersonresponsible forthe6881Forensicspeerisactivelycommentingonthosewebsites. RelationOfDieTrollDie.comandFightCopyrightTrolls.com logstoGoDaddyRecords 20.Defendantscounselprovidedmewithexhibitsfromtheinternetdomainregistrar GoDaddy(hereinafterGoDaddyRecords).IaminformedtheywillbefiledasExhibitE. Inrelationtothedomainnames,includedareIPaddressesofseveralISPsthatmadedirect changestothedomainsettingsofwefightpiracy.org.Suchrecordsalsoreflectedtelephonecalls madebyanindividualbythenameofJohnSteelethatalsorelatedrequestsfor wefightpiracy.com.ExhibitEpg.65,66,68,113.SuchrecordsalsoreflectthatJohn

TheseMullvadVPNcommentsappeartoberespondingandcommentingonPrendaLawcaseswitha ProPrendalawstance.ThesecommentswereselectedbytheownersofthosewebsiteasbeingproPrenda Law,oranefforttosettherecordstraightastoPrendaLaw.

11

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 13 of 31 PageID 436

Steeleregisteredthedomainname6881forensics.com,provingthathehasultimatecontrolover the6881forensics.comdomainname,emailaddresses,andwebsites,suggestingthathehas controlof6881forensicsoperations.ExhibitEpg.86,106,107,117. 21.IncludedinthoserecordsprovidedfromtheGoDaddyRecordsaretheIPsof: 24.118.198.196and50.77.50.222whichareMinnesotaComcastIP addresses(whichIaminformedisthestateofresidenceofbothPeterandPaul Hansmeier), 72.28.155.178and174.140.100.242whicharebothAtlanticBroadbandIP addressesinFlorida, 66.202.128.10hostresolvestohost10.connectregus.combelongingtoaRegus businessofficeinFlorida. 22.CommentsidentifiedbyFightCopyrightTrollsandDieTrollDierecordshavemuch incommonwithboththepreviousinformationofboththesharkmp4userandthegodaddy records.ExhibitK4.CommentsstronglysuggestingtheywerefromJohnSteeleoranother PrendaLawinsiderweresourcedfromeither: MullvadVPNexitnodeIPs(95.75.220.253,94.75.220.77,46.21.99.22) MiamiBeachBusiness&ResidentialIPs: 66.202.128.10(host10.connectregus.com) 174.140.100.242(AtlanticBroadbandIPaddressinFlorida) 204.195.150.212(AtlanticBroadbandIPaddressinFlorida) OneChicagoBusiness&ResidentialIP(64.190.14.220) 23.Ofthese,72.28.155.178,66.202.128.10,64.190.14.220,174.140.100.242have beenconfirmedtobeusedbysomeonewithaccesstoJohnSteelesGoDaddyaccount. ExhibitE(72.28.155.178,pg.63,77,78)(66.202.128.10,pg.67)(64.190.14.220,pg. 113)(174.140.100.242pg.58,59,65,66,71,80,81,111). Suchinquiryconcludedwithafindingthatitislikelythatthepersonresponsibleforthe 12

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 14 of 31 PageID 437

6881Forensicspeerisactivelycommentingonthosewebsites,suchcommentsshowing insiderinformationorbiastowardPrendaLaw. PiratebayUsersharkmp4,Ingenuity13andnaughtyhotties.com 24.ThepurposeoftheinvestigationrequestedbyDefendantscounselinthismatter wastopinpointthelikelyoriginoftheusersharkmp4onthewebsiteknownasPirateBaythat originatedtorrentsrelatingtocopyrightsheldbycompaniesnamedAFHoldingsand Ingenuity13. 25.ThewebsitePirateBayisawebsitethathostsusergeneratedcontentrelatingto torrentinformationtohelpotherslocatecopyrightedandnoncopyrighteddatafilesbutdoes notdistinguishbetweencopyrightsasitdoesnoteditthecontentofitsusers.Notoriouslyand openly,thePirateBayhostssufficientinformationtolocateseedsofcopyrightedmaterialsbeing sharedbywhomevercarestoreleasesuchmaterials.ThefoundersofPirateBaywerefound guiltyofpromotingotherpeople'sinfringementsofcopyrightlawsinSweden. Sharkmp4SharesWorksofAFHoldings 26.Sharkmp4postedonthePirateBaytorrentinformationsufficienttolocateworks ofAFHoldings,specificallytheworksPopularDemandandSexualObsessionandposted hashvaluesofatorrentthattheusercreatedontothePirateBay. TheworkPopularDemandsharedbysharkmp4hadainfohashvalueof 96D3F116657D8723EFE8DC6F0ADD398A68D421A8,auniquefingerprintforidentifying thetorrentswarmanddownloadingthework.SeeExhibitK5.

13

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 15 of 31 PageID 438

TheworkSexualObsessionwassharedbysharkmp4intwodifferentformatswith infohashvaluesofF00A7C83D6C7F61FEFA07BD916A50C90A16048E8and B919A8A93612DD2FD623AF90F15926A662522FF2bothuniquefingerprintsfor identifyingthetorrentswarmanddownloadingthework.SeeExhibitK6. SuchworksallegedlyheldbyAFHoldingsappeartobecommerciallyavailablefor bothonlinestreamingandpurchasethroughpornographydistributorsandcouldhavebeen gathered,pirated,anduploadedbysharkmp4inanynumberofwaysaswouldbeexpectedina typicalepisodeofcopyrightinfringement.10 Sharkmp4SharesWorksofIngenuity13 AnythingforDaddy,TeenSexFirstAnal,APeekBehindtheScenesattheShow 27.UnlikethoseworksofAFHoldings,Defendantscounselcontactedmewiththe propositionthatsharkmp4suploadsofcertainworkscopyrightedbyIngenuity13appeartobe worksthatwerenotcommerciallyavailableatthetimethattheyweresharedbysharkmp4. 28.IreviewedthecopyrightdatesofthefollowingworksofIngenuity13gathered fromcomplaintsfiledinFederalCourtsandcomparedthemtotheCopyrightRegistrationdates andfoundasfollows: AnythingforDaddy:5448D6C00CE82F71AE8570EAB2480FC277916E8BHash Value.EarliestfoundreleaseonPiratebaybysharkmp47182011Copyright RegistrationPA0001739839filedon752011(samepublicationdate)
10

SexualObsessionisavailableforpurchaseonDVDandStreamingat http://www.excaliburfilms.com/AdultDVD/829246D1_Sexual_Obsession_dvd.htmandPopularDemandis availableforpurchaseonDVDat http://www.excaliburfilms.com/AdultDVD/3004326D1_Nina_Mercedez_Popular_Demand_dvd.htm.The originalauthoroftheworks,HeartbreakerFilms(whosoldthecopyrightstoPrendaetalsAFHoldings),is theoriginalauthorforothersharkmp4uploads.

14

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 16 of 31 PageID 439

TeenSexFirstAnal:DBEE600A2FCED4FC9E28AB0261909522813BFC44Hash Value.EarliestfoundreleaseonPiratebaybysharkmp410102011Copyright RegistrationPA0001751393filedon8242011forpublicationdate8222011 APeekBehindtheScenesattheShow: 7571E2F7C1972FC5A383A4D87DA00CC3333FB32EHashValue.Earliest foundreleaseonPiratebaybysharkmp408212012CopyrightRegistration PA0001802629filedon8242012forpublicationdate07252012. Informationprovidedbysharkmp4onthePirateBaydidnotreadilyrelayany informationregardingwhetheranysuchIngenuity13workswerecopyrighted. AlthoughthetorrentinformationforAnythingforDaddyrelaysinformationfor locationofaswarmsufficienttodownloadamoviefilethatis702.17MB,thescreencaptures11 madebytheusersharkmp4evidencedafilethatwas1.58GBinsize,roughlytwicethesizeof thefilereleasedandsuchscreencapturesdenoteMASTERinthefilename.

(snippetfromhttp://bayimg.com/haJcmaadDListedasScreenShotsofAnythingforDaddy releasedbysharkmp4onthePiratebay) Thisstronglysuggeststhattheindividualresponsibleforthecreationofthesharkmp4 torrentandsharkmp4screencaptureshadaccesstoahigherresolutioncopythanhe/shemade

11

Screencaptures,orscreencapsastheyarecommonlycalled,refertothegenerationofanimagethrough theselectionofvariousframesofamoviefile.Theresultingimagesareessentiallyachronologicallayoutof scenescreatingasortofstoryboardforthemoviefile.

15

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 17 of 31 PageID 440

availableonBitTorrentandsuchfilenamesuggeststhattheindividualhadanoriginal MASTERofthework. ReferencestotheinfohashforAPeekBehindtheScenesattheShowincomplaints filedbyPrendaet.al.citetheirinitialdetectionofinfringementbytheDoeonthesamedaythe torrentwascreatedbysharkmp4.CompositeExhibitK15Inatleasttwoinstancesthe infringementwasreportedasdetectedanhourbeforetheinfohashappearedonPirateBay (2012082100:54:51GMTuploadtopiratebayversus2012082100:09:42&00:42:12 UTCtimeofallegedinfringement).CompositeExhibitK15How6881Forensicswasable todetectaninfringementonaswarmbeforeitapparentlyexistedcouldbeexplained,tosome degree,if6881didnotaccountfordaylightsavingswhenconvertingtheirsystemclock(local time)toUTC.Anotheralternativewouldbeclockskew,whichinnetworkingrefersto differencesinthetimereportedbydifferentnodesinthenetwork,whichcanbeconsiderable (ontheorderoftensofminutes)whentransittimesordistancesarehigh.Insuchacase,they wouldstillbeconnectedtoaswarmtheyvealreadyidentifiedasinfringingononeof Ingenuity13LLCscopyrightswithinminutesofitscreation.Regardless,itsuggests,atminimum, insiderinformationbetweensharkmp4and6881Forensics. FiveFanFavorites 29.Ifurtherreviewedtheuploadsofsharkmp4tolocateadditionalworkswhichmay beattributabletocopyrightsheldbyIngenuity13.Onework,titledFiveFanFavoriteswasa registeredcopyrightofIngenuity13,PA0001791654on5242012.Sharkmp4usedtheterm

16

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 18 of 31 PageID 441

FanFavoritetodescribesomefilesshared,buttherewasnoindicationfrominspectionof sharkmp4releasesoftheirbeingnumericallydesignatedasFiveFanFavoritessharedby sharkmp4. 30.IinspectedcomplaintsfiledbycopyrightattorneysforIngenuity13andfoundfour infohashesreferencedwithinthemrelatingtoallegedinfringementoftheworkFiveFan Favoritesandcomplaintsfeaturingsuchinfohashesareinthehundreds,butexamplesofthose citationofthoseuniqueinfohashesareasfollows: F016490BD8E60E184EC5B7052CEB1FA570A4AF11fromIngenuity13 v.Doe,8:12cv01691,Doc.1,24(M.D.Fl)(SignedbyattorneyGeorge Banaswithblgibbs@wefightpiracy.comemailaddress) 0D47A7A035581B0BA4FA5CB86AFE986885F5E18EfromIngenuity13 v.Doe,1:12cv22756,Doc.1,24(S.D.Fl)(SignedbyattorneyJoseph Pereawithjoperea@wefightpiracy.comemailaddress) DBB7ABE11CB844FD84686DEAD98F9A6828D7FCC0fromIngenuity 13v.Doe,3:12CV04977,Doc.1,24(N.D.Cal)(Signedbyattorney BrettGibbswithablgibbs@wefightpiracy.comemailaddress) and5985BD79F92F9725772383E89597B58409F82504fromIngenuity13 v.Doe,1:12CV22757,Doc.1,24(S.D.Fl)(SignedbyattorneyJoseph Pereawithjoperea@wefightpiracy.comemailaddress. 31.Afterreviewofthecomplaints,manyofwhichIretrievedfromwefightpiracy.com, InotedthatthoughJohnSteelehascompletecontrolofemailaccounts,thedomain,andFTP (FileTransferProtocol)forthesite,hisnamewastypicallyabsentfromthecomplaintsthatI examined.SeegenerallyExhibitE. 32.UponverifyingeachinfohashforFiveFanFavorites,oftencalledthefingerprint

17

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 19 of 31 PageID 442

ofthework,aspresentinthecomplaints,IagainreturnedtothePirateBayandinspectedthe releasesofsharkmp4. 33.Ifoundthatsharkmp4postedallfourcorrespondinginfohashesrelatingtothe workFiveFanFavoritestothePirateBay.Theycorrespondedas: F016490BD8E60E184EC5B7052CEB1FA570A4AF11fromIngenuity, 8:12cv01691(M.D.Fl)correspondedtosharkmp4releaseon622012GMT: RosemaryRadeva:Petite,SexyAsianPlayswithHerself[2012]alsolabeledin descriptionasFanFavoriteRosemaryRadeva[2012].SeeExhibitK7 0D47A7A035581B0BA4FA5CB86AFE986885F5E18EfromIngenuity, 1:12cv22756(S.D.Fl)correspondedtosharkmp4releaseon612012GMT: AmyBrookeAnalDildoandSquirtingalsolabeledindescriptionasFan FavoriteAmyBrooke.SeeExhibitK8 DBB7ABE11CB844FD84686DEAD98F9A6828D7FCC0fromIngenuity13v. Doe,3:12CV04977(N.D.Cal)correspondedtosharkmp4releaseon612012 GMT:MadisonFoxBustyBeautyinRedLingeriealsolabeledindescriptionas FanFavoriteMadisonFox.SeeExhibitK9 5985BD79F92F9725772383E89597B58409F82504fromIngenuity13v.Doe, 1:12CV22757,(S.D.Fl)correspondedtosharkmp4releaseon622012GMT: FanFavoriteToryLane:PinkHeels[2012]alsolabeledindescriptionasFan FavoriteToryLane.SeeExhibitK10 34.IlocatedoneadditionalFanFavoritesharedbysharkmp4,thatofFan FavoriteSpencerScott:PlaymateonaMotorcycle[2012]butthathashvaluewasnot referencedinanycomplaintthatIcouldlocate.SeeExhibitK11.Withthestrongmatchin copyrightsatthispointintheinquiry,IsoughtouttheUSCopyrightrecordsforIngenuity13 LLC.Ofthe9worksregisteredtoIngenuity13LLCsince197812,8ofthesewereuploadedto

12

Onlinesearchablecopyrightrecordsatwww.copyright.gov/recordsonlyextendbacktoJanuary1,1978. GiventhatIngenuity13LLCdidnotappeartoexistuntilthelate21stcentury,Ideemeditunnecessaryto

18

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 20 of 31 PageID 443

PirateBaybyusersharkmp4shortlyafterthecopyrightwasregistered.InthecaseofA PeekBehindtheScenesataShow,thecopyrightwasntfileduntil3daysaftersharkmp4 uploadedthework. 35.BasedupontheinquiryFiveFanFavoritesIconcludedmyresearchand deliveredmyfindingstoDefendantscounsel,andclosedmyinquiryfinding: a. Usersharkmp4hadaccesstoatleastfouroftheFiveFanFavoritesonorabout 622012GMT. b. ThecopyrightregistrationPA0001791654dateofFiveFanFavoriteswason 5242012. c. Mostsharkmp4torrentswarmscontainauniquepeerintheswarmthatusesaMullvad VPNservicewithbehavioruniquefromthatofanormalclientwithinaswarm, evidencingmonitoring. d. Theunique6881ForensicspeerreportsasaseedandsendsAllowed_fast messages. e. Amongtheseveralswarmsofsharkmp4,theonlyconsistentlycommonIPaddresses andpeerIDswerethoseofMullvadVPNsassociatedwithapeerwhichappearedto beattemptingtosimultaneouslydownload,orbeinterestedinpiecesalthoughsuch peeralsoreportedasaseed,whichisacontradiction.Suchapeerwouldonlybe interestedinpiecesforthepurposeofcollectingevidenceofinfringementandis

seekoutearlierentriesfromthecopyrightcardcatalog.

19

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 21 of 31 PageID 444

thereforelikelyacopyrightmonitor. f. MullvadVPNswereusedtomakeseveralcommentsonFightCopyrightTrollsand DieTrollDie,relayingmessageswhichshowinsiderinformationintoPrendaLaw. g. Itwouldbenearlyimpossibletosearchallpornographywebsitestoverifythatan Ingenuity13workwasntavailablecommercially,orthatitwasavailablecommercially priortopublicationbysharkmp4viaPirateBay. h. Thatuponcursoryinspection,Googledidnotreturnanyresultsofcommercial availabilityofthematerialsofIngenuity13. i. TheactressesnamedinthefourFanFavoriteshavelargevolumesofworklistedonthe InternetAdultFilmDatabase(iafd.com),buthaveneverbeenfeaturedinthesamefilm, nordoanyoftheir2012filmsappearsubstantiallysimilartothescreenshotsand descriptionsgivenfortheFanFavorites. j. Thatapparentagentswithinsideknowledgeandanagendapromotingandlaudingthe activitiesofPrendaLawpostedcommentsonDieTrollDieandFightCopyrightTrolls usingMullvadVPNIPaddresses,MinnesotaComcastIPaddresses,andFlorida RegusVirtualOffice&AtlanticBroadbandIPaddresses. k. ThatJohnSteeleandanindividualnamedPaulusedMinnesotaComcastIP addresses,andRegusVirtualOffice&AtlanticBroadbandIPaddressestologintothe domainregistrarGoDaddy,manyofwhichareidenticalmatchestothoseIPsfeatured intheDieTrollDie&FightCopyrightTrolls..

20

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 22 of 31 PageID 445

l.

Ingenuity13hassuedonworksuploadedbysharkmp4alleginginfringementtimes beforethetimestamponPirateBayshowsharkmp4madesuchworkavailabletothe generalpublic.Ifsuchevidencewasnotcompletelyincorrectorfalsified(adjustingfor possibleclockskewonthePirateBayserverandthesoftwareof6881Forensics,or failuretoaccountforDaylightSavings)6881Forensicsseemedtohaveimmediately locatedtheinfohashofIngenuity13worksattheexactmomentthattheywere uploaded.

m. Thebehaviorsofsharkmp4inobtainingAnythingforDaddyMASTERwithahigher resolutionthanactuallyreleasedbysharkmp4meansthatusersharkmp4islikely someoneontheinsideofIngenuity13. n. Thebehaviorsof6881Forensicsinimmediatelylocatinginfringementofthework, eitherbeforeorsimultaneoustoupload,suggests6881Forensicsshowthattheywere someoneontheinsideofsharkmp4. o. Therefore,itappearsthatthereissufficientevidencetoconcludethatIngenuity13is sharingitsownworksviasharkmp4andidentifyingsuchswarmsto6881Forensics uponcreation.13 36.UnlikethepreviousworksofAFHoldings,Icouldnotreadilyfindthatthese workswerecommerciallyavailableontheInternetinstreamingorDVDformatforsaletothe
13

NotjustAFHoldingsandIngenuity13areinvolvedwithsharkmp4.Sharkmp4alsouploadedtheworksof VPR,Inc.whofiledsuitsunderPrendaLawunderthenameVPRInternationale.Thistitlesofthe copyrightedworksofthiscompany,calledViperalsomatchwiththedomainnamesregisteredtoSteeles Godaddyrecords(i.e.IraqCarePackages.com,MyGirlfriendLostABet.comcorrespondtoworks PA0001732176IraqCarePackageandPA0001732178orPA0001732159.)

21

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 23 of 31 PageID 446

generalpublic.IdidnotinspectallpornographywebsitesontheInternet,assuchataskwould benearlyimpossibleoralifetimetask,andcostprohibitivelyexpensive. 37.Thisportionoftheinquiryalsoconcludedthatsharkmp4isrelatedtoaMullvad VPNviathe6881peerandsuchMullvadVPNisalsolinkedtoPrendaLawinsider commentsonFightCopyrightTrolls.comandDieTrollDie.com.JohnSteeleandPaulare linkeddirectlywithMinnesotaComcastIPaddresses,FloridaAtlanticBroadband&Regus VirtualOfficeIPaddresses.ThesameInternetServiceProviders(Mullvad,Regus,Comcast andAtlanticBroadband)thatshowupaspostingthosecommentsmatchtheGoDaddy Recordsandthesharkmp4swarmsmonitoredby. Theinquiryconcludeduponthesefindingsuntillaterresumed. Ingenuity13andwww.naughtyhotties.com 38.DefendantscounselagaincontactedmeafterIreportedtohimmyfindingsand discussedthematter.HerequestedthatItakealookatthewebsite www.naughtyhotties.com(hereinafterNaughtyHotties)andmakefindingsandreportbased uponpreviousinvestigationandtoanswerthequestionifsharkmp4couldhaveobtainedthe materialsthathewillinglyuploadedtoPirateBayfromthatwebsite. 39.DefendantscounselinformedmethatheinspectedtheNaughtyHottieswebsite offeredontheMay7thwhichcontainedastatementthatAllmodelsonnaughtyhotties.com/ were18yearsofageorolderwhenphotographed18U.S.C.2257RecordKeeping RequirementsComplianceStatementbutlackedanydetailsrequiredby18U.S.C.2257

22

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 24 of 31 PageID 447

Recordkeepingrequirements. 40.OnMay28th,2013,Iinspecteddirectlythewebsiteofnaughtyhotties.comand specificallyvisitedtheURLhttp://naughtyhotties.com/tour/en/legaltolookfor18U.S.C.2257 Recordkeepingrequirements.UnlikethestatusofthepageasreportedbyDefendantscounsel duringhisMay7thvisit,theinformationcontainingtherecordkeepingrequirementwasthen present,listing:2257Sentry,LLC,Administrator,361Rt.31,Bldg.E,Suite1402,2ndFloor Flemington,NJ08822astherecordskeeperfor18U.S.C.2257compliance. 41.BasedupontheobservationsofDefendantscounselregardingtheabsenceof18 U.S.C.2257statement,acomparisonofthewebsiteasitstoodupononmyinspectionMay 28th,2013,andthebelowfacts,leadtotheconclusionthatitismorelikelythannotthatthesite wasstillunderconstructioninMayof2013.Thosefactsare: ThewebsitehasembeddedthefontAngillaTattooPersonalUse,a copyrightedfontthatisnotforcommercialuse.SeeExhibitK12pg.25. Thecodeembeddingthesamplevideoplayeronthepagereferencesvideos thatdonotyetexistonthesite.SeeExhibitK12pg.67. Thecodethatwrapssaidvideoplayerincorrectlyattemptstoapplyanoverlay, andbearsthemarksofhastilywrittencodebyitsuseofundescriptiveclassand variablenames.SeeExhibitK12pg.8. Therearestilllargeswathsofcommentedoutexamplecodelikelypartofthe templateusedtoproducethesite.SeeExhibitK12pg.9. TheCategoryfilterhasadropdownboxthatfeaturesonlyasinglecategory, thegeneric(andlikelyautomaticallygenerated)Updatescategory.Thelinkto thethirdpageofupdatesleadstoanemptytemplate,andselectingCategory fromthedropdownboxinsteadofUpdatedirectsthebrowsertoan erroneouspage.TheModelspageissimilarlydevoidofitspropercontent. 23

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 25 of 31 PageID 448

SeeExhibitK12pg.1013. 42.OnMay28th,2013,Iinspectedthecontentinthefreetourportionofthe naughtyhottiespornographywebsite.Imadethefollowingobservations: a. UponenteringthewebsiteIwaspresentedwiththeabilitytoplaya42secondcliptitled IllDoAnything.Iimmediatelyrecognizedthisfirstclipfromthepornographic screenshotspostedbysharkmp4athttp://bayimg.com/haJcmaadDasbeingidenticalin visualdepictionof42secondsofthesharkmp4releaseAnythingforDaddy. CompareExhibitK12pg14.andscreenshotsin28at00:08:33. b. ThesecondclipavailabletitledRosemaryIimmediatelyrecognizedfromthe pornographicscreenshotpostedbysharkmp4athttp://bayimg.com/NAOBLAadPas beingidenticalinvisualdepictionof39secondsofRosemaryRadeva:Petite,Sexy AsianPlayswithHerself[2012]alsolabeledindescriptionasFanFavorite RosemaryRadeva[2012].CompareExhibitK12pg.15andK7. c. Thefifthclip,18YearOldHookers(ExhibitK12pg.16)isanotherIngenuity13 LLCregisteredworkthatwasuploadedtoPirateBaybyusersharkmp4. d. BelowthevideosintheLatestUpdatessection,Iwaspresentedwithaseriesof12 images.Iimmediatelyrecognizedvisualstilldepictionsof1.RosemaryRadeva: Petite,SexyAsianPlayswithHerself[2012],2.FanFavoriteSpencerScott: PlaymateonaMotorcycle[2012],3.FanFavoriteToryLane:PinkHeels [2012]and4.MadisonFoxBustyBeautyinRedLingerie.CompareExhibit

24

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 26 of 31 PageID 449

K7,K8,K9,K10,K11withimagesinK12p17&18. e. ExaminingthePHPcallsmadebythepagetoproducethesestills,Inotedthatthe internallanguageforthesiteagreeswithmyrecognition,asthefilenamesreference ToryLane,SpencerScott,RosemaryRadeva,MadisonFox,andAnythingForDaddy Scene3.ExhibitK17.Twooftheotherimagesfoundonthispage(JynxMaze& TashaReign)alsomatchscreenshotsfromsharkmp4uploads(infohashes 4582A802B1299DC8F692FE29B1FA1F5118FFD79A& 4CD530FB5541E587B1254A58A1885C4A18F3D819).ScreenshotsfromAPeek BehindtheScenesattheShowandtheAmyBrookeFanFavoriteappearonthe secondpageofupdates.ExhibitK12pg19. f. UponlocatingfouroutofFiveFanFavorites,Iconductedaninquiryintotheownership ofthedomainnaughtyhotties.com.Whoisrecordsattached,acquiredMay28th,2013 fromdomaintools.com,showthattheownershipofthedomainname naughtyhotties.comwasonlyveryrecentlyacquiredbythecurrentowners..See ExhibitK13,presentedinreversechronologicalorder.Thecurrentownersofthe domainacquireditonDecember20th,2012(),registeredthroughGoDaddy.comby DomainsByProxy,LLC.SeeExhibitK13pages24.DomainsByProxy,LLC providesitsclientswithalevelofanonymity,preventingaWhoisrecordfrom demonstratingtherealoperatorsofthesite.Thepriorownersofthedomain, naughtyhottiesorganizedinHouston,Texasreleasedownershipofthedomainsome

25

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 27 of 31 PageID 450

timebetweenJanuary2nd,2012andMarch13th,2012(ExhibitK13pages56). GoDaddyrecordsacquiredbyDefendantscounsel(ExhibitE)showthatJohnSteele hasusedDomainsByProxy,LLCforall11domainsregisteredandmaintained between2010and2013withtheexceptionofsnakebite.ccandnotissues.com(which listAlanCooperforthenamebutwiththeemailaddressofJohnSteele). g. IalsoconductedinquiryintothehistoryofIPaddressestowhichnaughtyhotties.com hasbeenregistered.Thedomain,thoughregisteredbyitscurrentownerDecember20, 2012,hasnorecordsIcouldlocateofactuallyresolvingtoanIPuntilJanuary3rd, 2013.ExhibitK13pg.13.Giventhattheitisthecurrentownersofthedomain whoalsopurporttohavetherightstodistributeIngenuity13LLCcopyrightedworks, andsaidownersdidnothaveanaccessiblewebsiteuntil2013,thereislittlechancethat sharkmp4obtainedthematerialsheseeded(in2011&2012)fromthewebsiteof naughtyhotties.com(inaccessibleuntil2013). h. Iconductedfurtherinquiryonthedomainnamenaughtyhotties.combyusinginternet domainnameserverstoresolvethecurrentIPaddressfromthehostnameofthe naughtyhottieswebsite. i. OnMay28th,at9:05amPDT,theIPaddressassociatedwiththewebsite naughtyhotties.comhadaddress75.72.88.156,matchingthepriorhistoryforits registration(ExhibitK13,page13).ThisIPaddressisaMinnesotaComcastIP addressresolvingtoc757288156.hsd1.mn.comcast.net,indicatingthatComcast

26

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 28 of 31 PageID 451

haslabeledthatIPaddressvianameserverasaMinnesotaIPaddress.Irana traceroutetotheIPaddress75.72.88.156andnotedthepathofthetraceroutewent throughrecognizableInternetlocationstowardMinnesota. j. Thelasthopinthetraceroutete100ten02.nmpls.mn.minn.comcast.net (68.85.167.162)suggeststhattheendpointlocationforthedeviceroutingtrafficfor 75.72.88.156islocatedmorespecificallyinMinneapolis,MN.Geolocationfor 75.72.88.156viawww.plotip.comaswellaswww.ipdb.atalsoconcurwith Minneapolis,MNbasedonthelocationofotherusersfromthesameIPblock. k. IinquiredofDefendantscounselhowhefoundnaughtyhotties.com,andhereported thathereceivedinformationfromDieTrollDiestatingthattheIPaddress75.72.88.156 madeacommentonawebsiteshowingintimateknowledgeorpresenceinPrendaLaw litigation.14ExhibitK14 l. InotedthatthesameIP,75.72.88.156,wasusedbysomeonewithJohnSteeles GoDaddyloginandpasswordon11/13/2012at10:57:37AMtologintohis GoDaddywebhostingaccount.SeeExhibitK16.SuchdomainnamesinJohn SteelesGoDaddyrecordsappeartobecontrolledbyIPaddressesinFloridaand Minnesota.PaulorPeterHansmeiersGoDaddyrecordswereunavailabletome. 43.IconcludedmyinquiryintotheInternetpresenceofnaughtyhotties.com,witha
14

YuenfiledactionsonbehalfofDoedefendantsagainstagentsofPrendaLawandPrendaLawingeneral. ItisobviousfromthetextstatementsKeepwastingyourtimeYuen.Itwashilariouswatchingyourface whenyougotyourentirecasekickedoutwith$0after6monthsofwork.Iknewthefirstdayyoufiledyour sillinessthatyouwouldnotbeallowedtoproceed.Ifigured,whynotletyouspend6monthswastingyour time.

27

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 29 of 31 PageID 452

findingthatsuchwebsitecontainedmaterialcopyrightedbyIngenuity13.Suchwebserverisa devicelocatedinMinneapolis,MN.AnidenticalIPaddressmadecommentsonthewebsite DieTrollDietormentingattorneyStevenYuenwhohasopposedPrendaLawinlitigation. ExhibitK14 44.TheGoDaddyrecordsnotedthattheIPaddressofnaughtyhotties.comisrelated toJohnSteelesdomainaccounts.ExhibitK16.Suchbillingrecordsindicatethatshortly afterprendalawfirm.comwasregisteredasadomain,suchGoDaddyaccountwasaccessedby anindividualwiththeIPaddress75.72.88.156,anaddressnowbelongingtothe naughtyhotties.comwebsite.ExhibitK16 45.Therefore,IconcludedthatJohnSteeleorhisagentsareincontrolofIngenuity13, thenaughtyhotties.comdomainname,andthewebserverattachedto75.72.88.156.Dueto SteelesapparentuseandcontrolovertheIPaddress75.72.88.156intheGoDaddyrecords, JohnSteelehadaccesstothecopyrightedworksofIngenuity13. 46.PirateBayusersharkmp4alsohadaccesstotheoriginalworksofIngenuity13 beforetheexistenceofthecurrentincarnationofthenaughtyhotties.comwebsite. 47.ItappearsfromalltheevidencethatJohnSteele(orsomeoneunderhiscontrolor withaccesstohisGoDaddyaccountrecordswithauthorizationtomakechangestodomain names)isthemostprobablecandidatefortheidentityofPirateBayusersharkmp4.Sharkmp4 wastheoriginatoroftheonlyfoundpublicreleasesofIngenuity13workspriortothecreation ofnaughtyhotties.com.Someworksweresharedbysharkmp4priortotheregistered

28

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 30 of 31 PageID 453

copyrightdatewithindicationsofaccesstoahigherresolutioncopy(morerelatedtothedirect source).ThereforefurtherinquirywouldneedtobemadeuponJohnSteele,andallthose withinhiscontrol,toidentifyifheisinfringingthecopyrightsofIngenuity13,AFHoldings,and othersthroughthePirateBayusersharkmp4. 48.Thenatureof6881Forensicssoftwarewhichappearstobeseedingfiles,paired withitsdetectionofallegedinfringementsomehowbeforeorimmediatelyuponcreationofthe swarmbysharkmp4alsosuggeststhattheidentityofsharkmp4maybesomehowlinkedwith anemployeeoragentof6881Forensics.Because6881forensics.comisownedbyJohn Steele,itleadsagaintotheconclusionthatJohnSteeleorhisagentsaresharkmp4. IconcludedmyinquiryintotheidentityoftheInternetpiratesharkmp4uponthe foregoingconclusions,notexcludingallpossiblecandidates,butwithoutanyothercandidate available.Thereisanincredibleweightofcircumstantialevidenceforfurtherinquiryinto identitiesandinvolvementofJohnSteeleand6881ForensicsandthereforePrendaLaw,with regardstoInternetpiracyofIngenuity13registeredworks. 49.IaminformedbyDefendantscounselthatheisunabletoconductdiscoveryor issuesubpoenatoconfirmfindingsregardingtheidentityofwhoeversharedthework FTVTiffany,thenatureof6881Forensicssoftware,theinvolvementofJohnSteelein6881 Forensics,thelogsofthe6881ForensicsevidencingtheDefendantsallegeddownloadofthe workFTVTiffany,informationfromComcastregardingtheownershipof75.72.88.156and naughtyhotties.com,informationregardingMullvadVPNsubscriptions,oreveninformationas

29

Case 6:12-cv-01493-CEH-KRS Document 37-11 Filed 06/03/13 Page 31 of 31 PageID 454