Hacker News Reader

Comment by wmil | Hacker News Reader

> "As for the denial of wiping, the Court’s independent expert found 92 percent of Carmack’s hard drive was wiped—all data was permanently destroyed, right after Carmack got notice of the lawsuit, and that his affidavit denying the wiping was false. Those are the hard facts."

Lines like this are why the expert reports from the lawsuit should be public. Carmack would naturally have very unusual computer use patterns.

It's easy to picture him creating an editing tool that accidentally used up almost all available swap space. Or filling up almost all of his drive space with generated textures and immediately deleting them.

That would look like use of obfuscation tools to a mediore expert.

View on HN

I strongly agree. Although Carmack's usage patterns might seem unusual for an average office computer user or even an average developer, the scenarios that you mentioned are common in AAA games, even if you aren't a programmer.

A new feature or bug in a AAA asset pipeline can cause a wipe and rebuild of hundreds of GB of generated data. Compressed textures for multiple platforms, compiled optimized level geometry, platform encoded audio and baked light maps are standard culprits.

He also searched on how to format a drive[1] (presumably securely) after receiving notice of litigation. I know that the folks here really, really love Carmack, and want to give him every benefit of the doubt; but, for most people, that's pretty damning evidence.

[1] http://www.pcgamer.com/zenimax-statement-reveals-john-carmac...

One might want to wipe their drive even if they hadn't copied code, for any number of nefarious and non nefarious reasons.

Is there any level of evidence that could convince you?

Dunno about him, but it would have to be a hell of a lot better than what they presented. They accuse Carmack of securely wiping evidence, so they had better present evidence that adequately proves it. And they haven't, so tough for them.

Whether anyone wiped evidence was not a fact that Zenimax had to prove. That data was deleted from Carmack's hard drive after he received a litigation notice is simply a piece of evidence the jury considered alongside all the other evidence (including testimony about alternative explanations for why data was deleted). From that evidence, Zenimax just had to prove that it was more likely than not code had been copied.

> Zenimax just had to prove that it was more likely than not code had been copied.

Isn't the standard in the US that one must "prove beyond a reasonable doubt", which seems like a higher standard than "more likely than not"?

"beyond a reasonable doubt" is only required in criminal cases. a "preponderance of evidence" is the requirement for civil cases.

Yup, and it's not a preponderance of evidence. As has been shown, it's quite possible the things they state are quite innocent.

I don't even have an opinion at this point, I'm not educated enough on the case. Though I think the case is sort of fundamentally absurd, in that Zenimax made games, Carmack helped get their games working on a VR headset. Then left to make VR headset, which Zenimax didn't make. The whole premise is odd to me. I wouldn't really care if he did copy his own code.

many of us wouldn't. In fact, this was my initial reaction.

However, many (especially people within the industry, so most of HN) disagree, as does the US legal code.

It's generally a good idea not to delete anything on a relevant drive after receiving a litigation hold. The jury is not going to draw a favorable conclusion from that combination of facts if you do.

And they shouldn't. A good way to think about the task of a jury is to ask: if I take 100 situations where these facts are present, what conclusion is correct in the plurality of cases? They are not there to speculate about alternative explanations, they are there to pick the explanation that is more likely than the others.

Who wouldn't perform a search on secure wipe when they learn they're being sued for computer related stuff?

Pretty much nobody in my opinion. From that premise, probability theory says this is a tiny piece of evidence.

Then again, most people are very bad at probability theory.

Most people wouldn't.

Destroying evidence is very very very bad.

I'm not talking about destroying evidence. I'm talking destroying unrelated yet embarrassing or potentially incriminating stuff: porn collection, downloaded movies…

One would hope you aren't storing that sort of thing on your work computer to begin with.

…non-commercial software you didn't pay a licence for (yet?), harsh email you regret…

We all have something to hide.

So, faulty premise, faulty conclusion.

I'm not sure if I'm interpreting you correctly.

Do you mean "Most people aren't paranoid enough to be afraid to search for 'secure wipe' after being sued for an unrelated matter"?

Or do you mean "Upon being sued, most peoples immediate reaction would be to search the web about how to destroy evidence"?

My guess would that most people who believe they are innocent would have no interest in destroying evidence, and that most people who considered themselves guilty would have already taken care of hiding the evidence before being sued.

probability theory says this is a tiny piece of evidence.

In which direction? Slightly more likely to be guilty, because why else would the person be searching? Or slightly more likely to be innocent, because any guilty person would know not to search?

> Or do you mean "Upon being sued, most peoples immediate reaction would be to search the web about how to destroy evidence"?

That one, but not exactly. It's not just about destroying evidence, but about destroying unrelated stuff such as the porn collection or downloaded movies. Or that "non-commercial" shareware you installed but did not bother to pay just yet. I bet everyone here have a couple such skeletons in their hard drives.

> In which direction?

Frankly, I don't know. I haven't consider how a guilty person would have covered their tracks before hand. I just figured most people would just panic and search for various way of covering their asses, regardless of their guilt.

---

My point was more, while most people would see guilty-looking behaviour as strong evidence of guilt, it is not necessarily so. And in this particular case, I don't think it is.

Formatting a drive is fairly common when doing game development/3D, in other cases you would often use VM's and, but you don't want the extra abstraction layer. It's also both imortant and uncommon enough that you may do this search on a regular basis.

His search history over the last 10 years has probably included formatting instructions several times.

It's not common when you're an engineer involved in an IP lawsuit. Getting notified of this type of lawsuit also means getting a data retention notice requiring you to not do this. All sorts of special requirements come into play, and not complying with them is an immediate and huge red flag. Even if it was innocent, it looks incredibly fishy.

If he did securely wipe a volume on the drive of a machine he worked on after being notified of the suit, there are literally only four explanations, all of which can be attributed to malice or ignorance:

(1) Malice: he intentionally destroyed evidence. This would be on him.

(2) Ignorance: he was given a retention notice by Facebook's lawyers, but didn't understand it and innocently blew away the volume. This would be on him.

(3) Ignorance: Facebook's lawyers didn't immediately give him a retention notice when the suit started. This would be on Facebook's lawyers.

(4) Ignorance: Facebook assigned the most incompetent IP lawyers imaginable to defend Carmack, and it never occurred to them to issue a retention notice. This would be on Facebook.

This all only applies if Carmack actually did securely reformat a volume on a work machine that was relevant to this case, after being informed of this lawsuit. If that's not true, then there are other possible explanations, and this could in fact be a misrepresentation by ZeniMax.

You are ignoring the vastly more likely 5) he wiped a test machine that lacked relevant information or 6) he wiped a new machine that had no data from him or his company.

If you break something, starting over and not doing the same thing is often a vastly better than trying to debug what happened and then fixing it.

The subject of a data retention order isn't the person that gets to decide what data is or is not relevant.

That's not actually true, cache files for example are wiped as a basic fact of web browsing. Unless specified, continuing to brows the web on an unrelated machine is not in violation. Note, demonstrating something is unrelated is easiest when it was purchased after the fact.

PS: And yes, I have had training and been required to deal with data retention issues as a basic part of my job for years.

"he wiped a test machine that lacked relevant information" != "cache files for example are wiped as a basic fact of web browsing"

Depends, CI servers are sometimes setup to do a fresh OS install on a regular basis. Formatting a machine that was formatted last night and will be formatted tomarrow is hardly suspicious behavior.

Now that's unusual for web servers, but client software that gets installed is it's own little world. VM's snapshots are generally better for this, but 3D software can have issues with VM's.

Well tough shit. You don't get to decide what's relevant once you're served. He's not a dumb guy. If he was aware of the notice then his actions are 100% suspicious.

That's not actually how things operate.

Now, it is best to set aside a relevant machine or HDD etc. But, for example if you buy a new phone and then brows the web on it, then as a basic fact of browsing the web cache files get deleted.

So, if you get such an order. Box up your current machine. Buy a new one, wipe it clean, reinstall from version control that's in no way suspicious. Assuming such things where documented and normal procedure.

PS: I would add, the court of public option may ignore such things. But, the court of law is actually far from stupid.

If he had done either of those two things I found this anyone would have found it suspicious. Of course, he didn't, so what's your point?

About (4) ... Facebook is a big company. Here's what may happen in real life.

High up person X, gets that notice and takes it to his boss, and they talk about it. They agree to ignore it and just let the lawyers deal with it. 10 minutes later a lawyer assistant storms in, demands an immediate meeting with the accused and tells gives them a list of 10 things, including data retention, to immediately do. They get started on item 1 on the list, then tell some junior team member to do the remaining 9, and get back to work.

Two days later, lawyer finds out the net result of all this is that several computers in use and under discovery are lost. Several others were used in a manner totally ignoring the order, along with an angry high up VP complaining that complying with this order "effectively shut down the department" (read: inconvenienced a few people involved in the lawsuit). An employee that's due to be interviewed in preparation for testimony in 15 days just took a 14 day leave, another that's on the list of experts left under bad circumstances. And of course, all of this is the fault of the legal department.

Lawyer spends the next 30 minutes under his desk fighting the urge to buy a gun.

Mind if I give people a bit of advice: whilst deleting stuff once it's under discovery is of course very bad practice (it is not simply illegal though, the situation is more complex), limiting the amount of time you hold on to files, mails, chat logs, browser history, ... is a good thing. I would advise no more than 2-3 months unless there's a specific reason. If you're part of a big company, do this especially for your work related files. Oh and of course, whatever mechanism you put in place to do this, needs to be deactivated once you do have a discovery order and reactivated afterwards.

I like Carmack, but my first instinct is actually that there's something to the claims. He and Romero basically founded ID software by using their than current employers resources/paychecks. So engaging in similar behavior when going from Zenimax to Oculus wouldn't exactly shock me.

Good point.

OTOH, that wasn't actual theft, IP or otherwise, just abuse of office materials and computers. Infocom did similar things at MIT in their early days, IIRC.

So this accusation is much more serious than anything that Carmack did when he was founding id.

Reply on news.ycombinator.com