Are universities protecting students from the RIAA?

As I wrote earlier this week, the Recording Industry Association of America has now expanded its campaign against illicit file-sharing to students at George Washington University.

One thing I noticed when reading through the court documents is how sluggish the RIAA's attorneys and its MediaSentry contractor have been in filing these lawsuits. Even though the complaint was filed on September 19, this excerpt lists IP addresses in use as long ago as February:

Doe # 1 IP Address:  128.164.100.11 2007-02-02 05:59:17 EST 
Doe # 2 IP Address:  128.164.100.11 2007-03-05 04:29:42 EST 
Doe # 3 IP Address:  128.164.100.158 2007-04-14 16:57:39 EDT 
Doe # 4 IP Address:  128.164.100.22 2007-03-26 02:02:52 EDT 
Doe # 5 IP Address:  128.164.100.72 2007-05-10 00:24:36 EDT 

If GWU has deleted its logs of who was using what IP address back then, the RIAA is going to be out of luck. So this becomes an important question: how long do universities keep logs showing who's been assigned a particular IP address? And why won't they say what the duration is?

"We have not systematically surveyed our members regarding their data retention practices, especially IP addresses," Rodney Petersen, Educause's government relations officer, told me in e-mail. "Anecdotally, our members have reported varying retention practices--ranging from keeping them for as little time as necessary, usually a few days, for internal security purposes to keeping them indefinitely. There is little uniformity in practice based upon our informal inquiries." Educause is, of course, a nonprofit group that represents higher education institutions and oversees the .edu domain.

The RIAA's lawsuit against GWU students in Washington, D.C., is not an outlier. The RIAA sued 21 "John Does" at Boston University on May 2. The alleged infringing activity in that case goes back to January 15, meaning the RIAA waited nearly four months.

Now, there's no legal obligation for colleges or universities to keep records of temporary IP address assignment, assuming addresses are allocated on demand through a protocol like DHCP. (They also can be allocated semi-permanently based on geographic location such as residence hall or campus office.)

"Georgetown University uses DHCP to assign IP addresses but in order to protect the integrity of our computer security systems we do not release information about length of storage," Georgetown spokeswoman Julie Green Bataille told me on Wednesday. For its part, GWU didn't reply at all.

The reason I know there's no legal obligation is that I spent much of the last three years writing about precisely this topic: lobbying Congress to enact mandatory IP address logging was a favorite hobby of former attorney general Alberto Gonzales. Even though some companies like Comcast decided to extend their logging policy to six months, Gonzales still resigned without getting what he wanted.

Universities may want to keep longterm logs of IP addresses assigned in hopes of discouraging file-sharing. Multi-month logs may help identify network misuse. On the other hand, schools may try to protect their students' privacy by keeping logs for only a few days (and then may not want to publicize it for fear of being publicly criticized by the RIAA or Congress for being "soft on piracy").

While schools have the right to set whatever policies they want--in a pro-copyright or pro-privacy direction--they should at least be public about it. That would let students, faculty, and staff debate the topic in the open rather than let rules be set in private by attorneys or administrators who tend to be far too risk-averse. It would also, I suppose, let students who are wavering between one school and another decide whether they'd rather attend a school that has chosen copyright as a paramount value, or one that has embraced privacy instead.

(If you know more details about a particular university's data retention policy, please post them below...)