Policy —

Kim Dotcom: US “planted” evidence to obtain illegal search warrants

Megaupload says it kept infringing files—only because US ordered it to do so.

Kim Dotcom living large in happier times.
Kim Dotcom living large in happier times.

Megaupload has accused US investigators of "planting" evidence the government used to prove that Megaupload knowingly kept copyrighted files on its servers and ultimately shut the file-sharing site down. In a new brief, Megaupload argues that the key evidence being used against it—36 unauthorized copies of various movies—are files that the company kept specifically in order to satisfy the government's demands.

Megaupload's domain names were seized by the feds one year ago. In addition to the case against Megaupload founder Kim Dotcom, there is the case of innocent bystander Kyle Goodwin, who wants to regain the legitimate files he lost because of the Megaupload shutdown. The Goodwin case resulted in the unsealing of affidavits used to obtain the search warrants leading to the seizure of Megaupload domain names. Dotcom's legal team argued in a brief filed yesterday in United States v. Kim Dotcom (PDF) that the affidavits show the government "omitted critical, exculpatory information regarding whether, why and how Megaupload knew it was hosting criminally infringing files."

In the unsealed affidavits, government officials say they informed Megaupload in June 2010 that 39 infringing copies of copyrighted movies were on the servers Megaupload leased at Carpathia Hosting, and that Megaupload still had not removed 36 of them by November 2011, according to the Dotcom brief. This statement "appears in each relevant affidavit and is the only direct, corroborated evidence the Government purports to offer as proof that Megaupload had requisite knowledge" that it was hosting copyrighted content, the brief states.

The June 2010 event is from a separate case in which the government had a criminal search warrant apparently targeting a Megaupload user, and Megaupload says it was led to believe that it was not a target of that case itself. Government officials never communicated directly with Megaupload, "instead deputizing Carpathia to communicate on its behalf" because of "complex jurisdictional issues."

As for those 39 movies, Megaupload says it cooperated with Carpathia to supply the files to the government while preserving the files in their original condition so as not to tip off users to the investigation. Because the warrant was sealed, Megaupload was supposed to cooperate with Carpathia to comply with the warrant "without publicly opening a ticket as it normally would." Carpathia told Megaupload that it must move the infringing files to a disk so they could be passed on to the government, but did not specify whether the originals should be maintained.

"Megaupload's preservation of the status quo, particularly by not taking down or otherwise disturbing the files identified in the June 24, 2010 warrant, was faithful to the Government's express desire, reflected by the Magistrate Judge's order sealing the warrant… and by Carpathia's instructions on the Government's behalf, for Megaupload to ensure that evidence would remain preserved and that the target users would remain unaware of the investigation," the Dotcom brief states.

The brief then argues that the government used the June 2010 warrant to collect evidence against Megaupload in the ostensibly separate case that led to the January 2012 shutdown of the website:

Although it is now apparent that Megaupload, itself, was the target of a criminal investigation at the time it received the June 24, 2010 warrant from Carpathia, Megaupload was led to believe otherwise at this time. Indeed, it was steered to cooperate with the Government by Carpathia's express assurance that the Government had given it 'no reason to believe the [sic] MegaUpload is the target of the investigation.' By all indications, the Government tapped Carpathia to convey the June 24, 2010 warrant to Megaupload, thereby planting what the Government would later claim, for purposes of this case, amounted to criminal knowledge that Megaupload was hosting infringing files, while simultaneously lulling Megaupload into thinking it was not a target of its ongoing investigation … and, what is worse affirmatively leading Megaupload to understand from the warrant's sealing order and Carpathia's representations that Megaupload should take no action with respect to the infringing files lest it tip off the ostensible targets.

A separate warrant shows that the government's investigation into what it called the "Mega Conspiracy" began in March 2010. Although Megaupload speculates that the June 2010 warrant targeting one of its users was used deliberately to entrap Megaupload, it seems plausible that the cases were unrelated at the time.

An e-mail concerning the warrant that Carpathia's Philip Hedlund sent to Megaupload on June 25, 2010 shows the delicate balance Carpathia tried to strike, one that might satisfy both the government and one of its biggest customers. The e-mail does not tell Megaupload to keep infringing material, but also contains no request that Megaupload delete any files. The e-mail reads:

Please find attached a Search Warrant received by Carpathia today. Over the past days (since our return from our visit to you); Carpathia has been negotiating with the Government to avoid receiving a search warrant that could result in a seizure or imaging of the servers Carpathia provides to Mega. Instead, we've managed to convince the Government to issue this sealed (meaning we cannot disclose to anybody) warrant with an exception to disclose to you. Please know that we attempted to convince the Government to work directly with Mega on this matter, but given the complex jurisdictional issues, they have been unwilling. Nonetheless, Carpathia feels as if we've achieved a small victory by preventing the Government from issuing a search warrant giving them power to seize or image the servers themselves. Kim, we were able to do this specifically because we relayed to the Government Mega's willingness to work with the Government for these types of requests -just as we discussed during the last day of our visit (boy, am I happy we discussed it).

Carpathia needs your help collecting the information sought in this warrant so Carpathia can hand the information over to the Government. We have no reason to believe the MegaUpload is the target of the investigation. Mega's assistance in providing this information is the path most likely to avoid any disruption of services.

The e-mail then asks Megaupload to "move all the files" to a disk to be passed on to the government.

Separately, the warrants used to raid Dotcom's home in New Zealand have already been ruled illegal by a New Zealand judge. The US government's method of obtaining warrants "calls into grave question the legality of any and all seizures effected pursuant to those warrants," and is also relevant to Goodwin's request to get back his own files, the Dotcom brief from yesterday states. Dotcom's legal team stops short of asking the judge in the United States v. Dotcom to invalidate the warrants used to seize Megaupload domains, but asks for permission in future hearings to "address the validity" of the warrants and any related materials that might be unsealed in the future.

This article was corrected to better describe Carpathia's e-mail to Megaupload. Carpathia did not tell Megaupload that it must keep evidence related to the infringing movie files. Carpathia told Megaupload to provide the files to the government, but did not specify whether the original copies should be maintained or deleted.

Channel Ars Technica