Day 13: Honeypot becomes sticky point in iiNet trial

ISP iiNet allegedly "misunderstood" the method used by film industry investigators to gather data for AFACT's letters and infringement notices, affecting the way it treated them, the Federal Court heard yesterday.

iiNet chief Michael Malone first alleged on Tuesday that he and others at the internet service provider mistakenly believed investigators had created a so-called "honeypot" user on its network to snare iiNet customers.

"We thought the investigator put a honeypot there and watched who came to the pot," Malone alleged.

"As we found out later it was the reverse of that."

The film industry's lead barrister Tony Bannon SC explored that response in more detail in yesterday afternoon's proceedings. Malone was forced to repeat - and expand on - his earlier assertions.

"I mistakenly thought it was other way around - that the [customer was] downloading from [the investigator] rather than [the investigator] downloading from the customer," Malone alleged.

"I didn't understand the way DtecNet collected its information."

It was only after confidential material about DtecNet's investigative processes was made available to Malone and the ISP's engineers in the wake of the court case that his perception of the reliability of evidence collected by the film industry changed.

Until that point, Malone had viewed the AFACT notifications as not dissimilar to any of the thousands of others the ISP received per week - including those that used data collected by MediaSentry, a tool Malone had previously alleged was "rife with errors".

"I think once we stepped through how [this investigation] was being done, we came to a conclusion that on the balance of probabilities it was quite a reliable way to collect the data," Malone told the court.

Bannon SC pressed Malone on what in the confidential DtecNet process documents made the difference "between making [the evidence] reliable or not".

"Was it the fact DtecNet downloaded a portion of the file [from an iiNet customer]?" Bannon put to Malone.

"That was one of the elements," Malone conceded.

Bannon had Malone write down a couple of words hinting at what a second element was.

"Can you write down on a sheet of paper words that might identify the topic and I'll have a stab [at it]?" Bannon asked.

"I'm trying to avoid having to close the court."

Malone penned a couple of words that were passed to Bannon via a court official.

It was then revealed that the second element considered by Malone and the ISP's engineers was the alleged frequency with which investigators attempted to download parts of films and TV shows from iiNet customers.

"My understanding [prior to receiving the confidential DtecNet process] was it was done... on multiple occasions to make sure a person was really there and that investigators restricted the number of peers," Malone alleged.

"[But] DtecNet... only downloaded once from each alleged infringer didn't they?" Bannon put to Malone.

"Yes," Malone said.

Malone was unable to tell the court how he had formed the view that film industry investigators had set up a honeypot, other than to repeat he was "mistaken".

"I don't have anything," Malone stated.

"[The view] was formed simply in trying to consider how [the data] was collected. Between November 20, 2008 [when the case was filed - PDF] up until April when we had access to DtecNet technical information, I certainly understood better how this was done."

The court also heard that Malone did not seek the assistance of the ISP's engineers to examine "the underlying data" in AFACT's letters prior to the commencement of proceedings.

Malone's cross examination continues. You can follow the case in-full here. For a background on the case, click here.