Anderson didn't tell Garfield he was the "informant," and that he'd already hacked into TorrentSpy's systems. The hacker, then 23 and living in Vancouver, British Columbia, claims he had cracked TorrentSpy's servers by simply guessing an administrative password. He knew the password was weak -- a combination of a name and some numbers.
"I just kept changing the numbers until it fit," he says. "I guess you can call it luck. It took a little more than 30 tries."
Once inside, he programmed TorrentSpy's mail system to relay e-mail to a newly created external account he could access.
There's a trace of pride in his voice as he details the hack. "The e-mails weren't forwarded using the mail command. They were sent actually before it reached anyone's mailbox," he says. "So it was more like interception before delivery. I could even stop certain mail from reaching their box."
In this manner, Anderson says, he sucked down about three dozen pages of e-mails detailing banking, advertising and other confidential information. "Everything they were talking about was sent to my Gmail," he says. "Everything they sent, anything sent to them, I got: invoices; in one case they sent passwords."
Among the purloined files was the source code for TorrentSpy's backend software, says Anderson. Anderson alleges this interested the MPAA, which he says wanted to set up a fake BitTorrent site of its own. According to Anderson, the MPAA said, "We'll set up a fake Torrent site. We'll contact the other Torrent sites. We'll get their names, address books, contact information and banking information.... (They) wanted to run this as a shadow portion of the MPAA."
MPAA spokeswoman Kaltman says the MPAA had no such plans, and says the accusation that the MPAA wanted to set up a phony Torrent site is "patently false."
On June 30, 2005, after Anderson collected the data, Garfield sent Anderson a contract to sign. The contract, seen by Wired News, says the information the MPAA was seeking would "include, but is not limited to, the names, addresses, and phone numbers of the owners of TorrentSpy.com."
The contract also requested information on The Pirate Bay, and called for Anderson to look for "evidence concerning and correspondence between these entities."
The contract prohibited both parties from disclosing "the existence of this agreement to anyone," and said the MPAA would pay $15,000 for services to Anderson's business, Vaga Ventures. Finally, the contract dictated that the confidential data would be obtained "through legal means."
But according to documents filed in support of TorrentSpy's wiretapping countersuit: "Dean Garfield expressly told the informant (Anderson), on behalf of the MPAA, regarding the information that he requested, 'We don't care how you get it.'"
It continues: "(T)he MPAA knew, or had reason to know, that such information was obtained from plaintiffs unlawfully and without authorization."
The details of Anderson's conversations with Garfield could not be independently verified, and Garfield -- now the MPAA's executive vice president and chief strategic officer -- did not respond to repeated requests for comment.
But MPAA spokeswoman Kaltman says the organization's contract with Anderson clearly required any information to be obtained lawfully.
Anderson says he signed the secret pact, and immediately sent in what he says was stolen information.