There seems to be a snag in the net the recording industry is using to catch illegal file-sharers.

On Friday, the Recording Industry Association of America withdrew its lawsuit against Sarah Seabury Ward of Newbury, Massachusetts, after the 66-year-old grandmother said she had never used or even downloaded any peer-to-peer file-sharing software. Bolstering her claim is the fact that Ward and her husband own a Macintosh computer, which is incompatible with the Kazaa file-sharing network they're accused of using to share more than 2,000 songs.

Ward was one of 261 computer users hit with copyright-infringement suits earlier this month. So far, one defendant, the mother of 12-year-old Brianna LaHara, has settled for $2,000 (see [article id="1478036"]"One Sued File-Sharer Settles With the RIAA ... 260 To Go"[/article]).

In preparation for suing suspected file-sharers, the RIAA subpoenaed users' identity from their Internet service providers. A legal precedent grounded in the 1998 Digital Millennium Copyright Act orders ISPs to fork over information on their subscribers if a copyright holder like the RIAA suspects one of them of infringement. By providing the ISPs with users' Internet protocol addresses (the digital ID numbers assigned to computers connected to the Internet) and the time the suspected infringement occurred, the RIAA was able to obtain the names and addresses of the suspected pirates.

And therein lies a possible flaw. Because some ISPs, like Ward's, don't have enough unique IP addresses for each of their subscribers, they routinely shuffle them around, in what is called dynamic IP addressing. So if one of the IP address' 12-digit numbers is off, or the time of the infringement is incorrect, the wrong person could be hit with a multimillion-dollar lawsuit.

"That's the reason we have due process protection and privacy protection," said Cindy Cohen, a lawyer for the Electronic Frontier Foundation, an organization devoted to protecting privacy and defending free speech online. "The reason that we think you should get notice if somebody is seeking your identity is so that if they make a mistake, you can catch it before you end up with a process server at you front door.

"And that's what happened to Sara Ward," continued Cohen, who has been working with the Wards on the case. "Nobody called her to tell her that her name was being sought. Nobody called her to tell her she was a suspect in this litigation crusade. The first she heard about it was a call from the Boston Globe saying, 'So you're a file-sharer?' Then two nights later, after she had gone to bed, there's a process server at her door saying that she was being sued by five large record labels."

An RIAA spokesperson said the withdrawal doesn't necessarily mean the organization made a mistake; it is simply giving Ward the benefit of the doubt until the matter can be further investigated.

Cohn said she expects mix-ups of this variety could recur. She estimated that roughly 10 percent of those sued have contacted the EFF, claiming they were wrongfully sued. In addition, many more users have gotten in touch with one of the lawyers listed on the EFF Web site.

For complete digital music coverage, check out the Digital Music Reports.