When Tanya Andersen opens the door to her modest apartment in suburban Portland, Ore., her Maltese-terrier mix, Tazz, runs over and wags his tail in a friendly hello. The 45-year-old single mother doesn't seem like much of a fighter. She spends most of her days sitting on an overstuffed sofa with a heating pad behind her back to ease chronic pain and migraines that have kept her on disability for nearly five years. Her voice is soft and halting. Yet this woman is behind a fierce assault on the music industry and its tactics for combating music piracy on the Internet. "I've just got to keep doing what I believe is right," she says, with Tazz curled up next to her on the couch. "And that's fighting and letting people know what's happening."

After being sued by the music industry for stealing songs and winning the case's dismissal, Andersen is now taking the record industry to court. Her case is aimed at exposing investigative practices that are controversial and may be illegal, according to the lawsuit. One company hired by the record industry, she claims, snoops through people's computers, uncovering private files and photos, even though it has no legal right to do so. A different industry-backed company uses tactics similar to those of debt collectors, pressuring people to pay thousands of dollars in settlements even before any wrongdoing is proven. In Andersen's case, the industry's Settlement Support Center said that unless she paid $4,000 to $5,000 immediately, it would "ruin her financially," the suit alleges.

Andersen is going after the recording industry under conspiracy laws. She argues the Recording Industry Association of America, the industry's trade group, and its affiliates worked together on a broad campaign to intimidate people into making financial payoffs. The defendants "secretly met and conspired" to develop a "litigation enterprise" with the ultimate goal of preserving the major record companies' control over the music business. Andersen is requesting class action status for her case, seeking at least $5 million in compensation for the class.

The RIAA says Andersen's allegations are categorically false. It says it isn't violating any laws. In fact, the courts have sided with the industry a number of times when it has faced claims similar to Andersen's. The RIAA emphasizes that it doesn't want to sue music listeners. But aggressive steps are necessary, it says, to stop rampant piracy that it figures costs the U.S. record industry at least $3.7 billion annually in sales. "The magnitude of this [theft] is incalculable," says Richard L. Gabriel, lead national counsel for the RIAA and a partner at the Denver law firm Holme, Roberts, & Owen. "We don't have an illusion that we can shut it down completely, but we do think that the suits will help get the marketplace to a fair place, where the illegal doesn't control the legal."

While the recording industry has gone after thousands of people, Andersen is unusual. Of the 40,000 people the RIAA says it has targeted for legal action, at most 100 have decided to defend themselves in court, says Fred von Lohmann, a lawyer at the Electronic Frontier Foundation, a civil liberties group. Few want to pay the legal costs of fighting the music industry, so most settle cases quickly, even if they believe they're innocent. Of the people who defend themselves, only a handful have taken the next step of suing the record industry for their lawyers' fees, and only a couple have won reimbursement. Andersen, one of the few winners on all counts, is the first to file a broad lawsuit that has put the RIAA on the defensive.

JURY AVOIDANCE?

Lawyers around the country who defend people accused of music piracy often share information, and the evidence Andersen uncovers could have a broad impact on the legal sparring. Already, the Oregon Attorney General cited the arguments in Andersen's case when he asked a court to quash a request by the music industry for the names of 17 students at the University of Oregon who allegedly shared music online. "The RIAA is fighting very hard to make sure that [Andersen's case] never reaches a jury," says Heidi Li Feldman, a professor at Georgetown University's law school. "The minute this reaches a jury, they will have to think about settling." Gabriel says the RIAA will pursue the case as vigorously as necessary.

The woman at the center of the dispute grew up in Woodburn, Ore., outside Portland. Her father died of leukemia when she was six, leaving her mother to raise Tanya and her younger sister, Tye. Her mother, Sonja Patzer, worked double shifts as a clerk at the local grocery store, giving up time with the girls for the money to support them. Tanya started working in a nursing home cafeteria when she was 16 and moved away two years later to go to community college in nearby Salem. "The girls were raised that you need to take care of yourself in life," says Patzer, now 66.

When the RIAA first set its sights on her three years ago, Andersen was looking after her eight-year-old daughter by herself in the wake of a divorce. It was December, 2004, and she pulled an envelope out of her mailbox. Ripping it open, she found a letter from Verizon Communications (VZ), her Internet service provider, saying it was releasing information about her. With it was a copy of a page from a subpoena. Andersen had earned a two-year legal secretary degree while in community college, but she had no idea what the documents meant. "I thought to myself: "I haven't done anything wrong,'" she says.

A second, more ominous letter arrived in early February, 2005. The document, from a law firm in Los Angeles, said she was being sued by several record companies for copyright infringement because she had shared their music with others over the Net. "The evidence necessary for the record companies to prevail in this action has already been secured," the letter states. It informed her that the minimum damages for each copyrighted song shared was $750 and encouraged her to contact the Settlement Support Center to discuss a financial settlement. If she didn't resolve the issue, she would be sued.

For the first time, Andersen was scared. She tried to e-mail a contact listed in the letter and called the law firm. A few days later her phone rang. "Ms. Andersen, I am calling to discuss settlement," she recalls the person on the other end of the line saying. "Settlement of what?" she responded. The man explained he was calling from the Settlement Support Center as a representative of the RIAA. He had information that she had been caught sharing songs online. To avoid a lawsuit, she would have to pay $4,000 or $5,000, he said. "You're going to have to pay us, or this won't go away," she says he told her.

THE SECRET SHARER

Andersen didn't know it at the time, but she was part of a new RIAA piracy crackdown. The music industry had spent years shutting down startups that make technology for sharing music over the Internet, such as Napster (NAPS). But for every tech company shuttered, two more seemed to pop up. In the fall of 2003, in a public effort to take on piracy, the RIAA started suing individuals it suspected were giving away copyrighted music. "Nobody likes playing the heavy and having to resort to litigation," said RIAA President Cary Sherman at the time. "But when your product is being regularly stolen, there comes a time when you have to take appropriate action. We simply cannot allow online piracy to continue destroying the livelihoods of artists, musicians, songwriters, retailers, and everyone in the music industry."

The Settlement Support Center was a less public part of the initiative. Its name may suggest a neutral organization set up to resolve disputes with evenhanded objectivity. In fact, it was financed by the record industry and operated like a cross between a call center and a debt collection firm. The SSC has since been dissolved. The RIAA's law firm, Holme Roberts & Owen, is representing the organization in court.

The SSC made its collections by hiring people such as Mark Eilers, an ex-police officer. He called Andersen repeatedly in February and March, she says, reiterating the demand that she pay thousands of dollars. Over the course of the calls. Eilers told her she had shared 1,288 songs on May 20, 2004, at 4:24 a.m. under the screen name Gotenkito. She maintained they had the wrong person and offered to let them look at her computer. She says Eilers told her Verizon had already verified that the illegal activity had come from her home, specified by what's known as an IP (for Internet Protocol) address. Andersen asked to speak with the record industry's lawyers and get a copy of the information they had about her. Eilers said no to both requests, says Andersen. Eilers, who no longer works for the industry, says he doesn't recall speaking with Andersen.

During the summer of 2005, after Eilers stopped calling, Andersen assumed the RIAA had moved on. Then on Aug. 26, while she was having dinner with her daughter, Kylee, there was a knock on the door. Kylee got up to open it, and Andersen followed. A woman standing at the door handed Andersen a piece of paper and said: "There, you have been served," Andersen recalls. In her hand were papers for a federal lawsuit filed against her. "I sat down and I read it. I'm like, "What do I do now?' I'm a single mom. I'm supporting a kid. This is going to destroy my whole life," she says.

Andersen quickly started looking for a lawyer. She searched the Net for a case like hers, although she wasn't sure how she would be able to pay someone on her $1,400 monthly disability check. One local Oregon lawyer suggested she accept a default guilty judgment and then declare bankruptcy. But Andersen had been through bankruptcy before, after her pregnancy with Kylee. She wasn't about to do it again.

Finally she called Lory R. Lybeck, a Seattle lawyer who was handling a similar case. They talked on the phone, then Lybeck sent one of his lawyers down to meet Andersen. "I said to myself, either she's a good actor and a good liar, or what they have done to her is really crummy," Lybeck says. He took the case on contingency, meaning he gets paid only if Andersen collects damages from the recording industry.

Lybeck is a compact 52-year-old with a brawler's attitude. He spent the early part of his legal career at a large litigation firm representing companies such as Chrysler, and in 1992, he set up his own two-person shop. Since then, he has gone after major corporations and government institutions for alleged wrongdoing. "I dislike arrogant bullies," Lybeck says.

What struck him about the RIAA was its negotiation tactics. The record labels accused people of downloading songs worth hundreds of thousands of dollars in damages, but they set the settlement price at a few thousand. Paying was cheaper than hiring a lawyer. "To me, that says this isn't about lawsuits, it's about an extortion campaign," says Lybeck. The RIAA's Gabriel says: "Our goal isn't to bankrupt people; our goal is to send a message that copyright infringement is wrong and get some compensation for the infringement."

As Andersen and the attorney prepared their defense in 2006, his conviction grew. Yes, Andersen had installed on her computer a software program, KaZaA, for sharing music over the Net—one reason the RIAA suspected her. But Andersen deleted the program after a few months and didn't appear ever to have used it. Plus, some of the music Andersen had supposedly shared online just didn't fit her taste. The songs included rap tunes with titles like I Stab People and Dope Nose.

NUMEROUS ERRORS

Lybeck also became convinced that there are fundamental flaws in how the RIAA uses IP addresses to identify suspects. MediaSentry is the investigative firm the record industry employs to track pirates. When MediaSentry sees people swapping music on file-sharing services such as KaZaA, it records their IP addresses and user names. Then it goes to Verizon Communications or another Internet service provider to find out who was using that IP address at the time of the piracy.

But errors can arise in a number of ways. One IP address may be assigned to a device such as a Wi-Fi router that can be used by several people at the same time to access the Net wirelessly. So if a visitor or a neighbor decides to steal music over the Wi-Fi network, the homeowner would still be fingered. In addition, some people have IP addresses that change every time they log onto the Net, so the IP address you use in the morning could be assigned to your neighbor that afternoon. Verizon and other Web service providers try to track who has which IP address at what time, but their records can be faulty.

More troublesome, sophisticated computer users can "spoof" IP addresses, or use one assigned to somebody else. They use a simple piece of software to forge the IP address on packets of information sent from their computer, much like someone who puts an address on the back of an envelope that isn't theirs. The people most likely to spoof are the very tech-savvy youngsters also mostly likely to be stealing music. Even if the RIAA had an IP address it believed belonged to Andersen, Lybeck thought, that wasn't necessarily the case.

In September, 2006, the RIAA asked Andersen a curious question: Did she know anyone named Chad? She didn't. But Lybeck tracked him down. Chad was Chad Alstad, a carpet layer who lived in Everett, Wash. He had a MySpace (NWS) page on which he wrote about downloading content from the Net. And his user name? Gotenkito, the same name Eilers had said was used in the alleged piracy. Lybeck was amazed: Alstad seemed a much more likely suspect than Andersen.

Over the next few months, Lybeck and the record industry tussled over Andersen's computer. The court ordered Andersen to hand over the computer, and the RIAA took it to an expert so it could be searched for signs of music piracy. But then the industry's lawyers refused to release the expert's report. Ultimately, Donald C. Ashmanskas, the U.S. District Court judge overseeing the case in Portland, ordered the RIAA to turn over the information, which it did in January, 2007. The result? No evidence of piracy.

Lybeck was convinced his defense was airtight. On May 14, he asked the Portland court for summary judgment. Ashmanskas gave the RIAA until June 1 to provide more evidence linking Andersen to the alleged infringement. In the week leading up to the deadline, the RIAA told Andersen it would drop its case if she agreed not to pursue counterclaims. She refused. Finally on the deadline, industry lawyers dropped the case without conditions and agreed not to sue Andersen again.

Lybeck still hadn't made a dime for his efforts. He asked Ashmanskas to make the RIAA pay his legal fees. In September, 2007, the judge agreed. In his ruling, Ashmanskas wrote that he was awarding the fees in part to deter prosecution tactics such as the RIAA's. After two years, "no one even remotely connected to the defendant has been alleged to be the actual infringer," he wrote. He was also shocked that the RIAA never interviewed Alstad until well after it had filed suit against Andersen, and then took Alstad at his word that he hadn't stolen music. "Inexplicably, [the RIAA's lawyers] credit his denials and discredit [Andersen's]," Ashmanskas wrote. He ordered the RIAA to pay Lybeck's fees, estimated at $300,000. "That made me feel that justice was being done," says Andersen.

Gabriel says it's not accurate to say the RIAA dropped its suit for lack of evidence. He says the user name Gotenkito may have been inspired by Kylee, since she admitted she liked Dragon Ball Z, a Japanese anime TV series that has a character with a similar name. He also says Andersen said in her deposition that she knew or listened to some of the country and rock artists whose songs were offered for download. "We took the high road," says Gabriel. "The judge inferred that we dropped the case because we didn't have enough evidence; we could have pursued the case until the end of time." Andersen says she and her daughter had nothing to do with the piracy.

An even bigger battle lies ahead. Andersen and Lybeck filed their own suit against the RIAA, the SSC, MediaSentry, Warner Music Group, EMI Group, Sony BMG Music Entertainment, and Universal Music Group last year and updated it with an amended complaint this month. The record labels declined to comment for this story, referring questions to the RIAA.

Lybeck figures that with all the potential errors in IP addresses collected by MediaSentry, the RIAA has gone after thousands of innocent people. He thinks the addresses could be erroneous as often as 20% of the time, which would mean 8,000 people wrongly accused. He believes that many innocent people have been coerced into paying because they can't afford to fight the RIAA in court. (Although the SSC has stopped operating, an organization called Settlement Information Line Call Center now plays a similar role for the music industry.)

"SERIAL BAD FAITH"

MediaSentry declined to comment, deferring to the RIAA. Gabriel says there have been few instances of mistaken IP addresses. "MediaSentry's investigation isn't flawed," he says. "The proof is in the pudding. We have obtained judgments against hundreds and hundreds of people." He declined to specify the number of settlements.

The RIAA did win a partial victory this week. After a conference call on Apr. 21 with Lybeck and Gabriel, the court struck Andersen's complaint and asked Lybeck to refine the claims. As a result, Lybeck plans to drop charges of fraud and racketeering, which the judge thought would be tough to prove. "The judge understands what we believe, that there isn't any merit to these claims," Gabriel.

Still, Andersen's case is very much alive. Lybeck plans to file another amended complaint by May 1, including the charges of conspiracy, negligence, and abuse of the legal process. Shortly thereafter, he plans to start deposing officials from the RIAA and its affiliates in preparation for a jury trial. "The trick to making this case stick will depend on to what extent Andersen can show that the RIAA engaged in serial bad-faith lawsuits," says Richard C. Vasquez, a partner in Seattle at Morgan Miller Blair who is not involved in the dispute.

From her apartment outside Portland, Andersen remains involved in the broader case. She collects files on her suit and tracks other disputes with the RIAA online. One recent winter day, she sipped a Diet Pepsi and watched Tazz jump from the couch and settle on the floor. "You have to find some positive in stuff, too," she says. "For whatever reason, I have been given a unique opportunity to fight this. I feel a responsibility in a way and want to help others. That pushes me along."