Research: Italy’s Piracy Shield Is Just As Big A Disaster As Everyone Predicted

Copyright

from the copyright-breaks-everything dept

Walled Culture first wrote about Piracy Shield, Italy’s automated system for tackling alleged copyright infringement in the streaming sector, two years ago. Since then, we have written about the serious problems that soon emerged. But instead of fixing those issues, the government body that runs the scheme, Italy’s AGCOM (the Italian Authority for Communications Guarantees), has extended it. The problems may be evident, but they have not been systematically studied, until now: a peer-reviewed study from a group of (mostly Italian) researchers has just been published as a preprint (found via TorrentFreak). It’s particularly welcome as perhaps the first rigorous analysis of Piracy Shield and its flaws.

The paper begins with a good introduction to the general area of IP and DNS blocking, also discussed in Walled Culture the book (free digital versions available), before detailing the history of Piracy Shield. As the paper notes, one of the major concerns about the system is the lack of transparency: AGCOM does not publish a list of IP addresses or domain names that are subject to its blocking. That not only makes it extremely difficult to correct mistakes, it also – conveniently – hides those mistakes, as well as the scope and impact of Piracy Shield. To get around this lack of transparency, the researchers had to resort to a dataset leaked on GitHub, which contained 10,918 IPv4 addresses and 42,664 domain names (more precisely, the latter were “fully qualified domain names” – FQDN) that had been blocked. As good academics, the researchers naturally verified the dataset as best they could:

While this dataset may not be exhaustive … it nonetheless provides a conservative lower-bound estimate of the platform’s blocking activity, which serves as the foundation for the subsequent analyses.

Much of the paper is devoted to the detailed methodology. One important result is that many of the blocked IP addresses belonged to leased IP address space. As the researchers explain:

This suggests that illegal streamers may attempt to exploit leased address space more intensively, even if just indirectly, by obtaining them by hosting companies that leases them, leading to more potential collateral damages for new lessees.

This particular collateral damage arises from the fact that even after the leased IP address is released by those who are using it for allegedly unauthorized streaming, it is still blocked on the Piracy Shield system. That means whoever is allocated that leased IP address subsequently is blocked by AGCOM, but are probably unaware of that fact, because of the opaque nature of the blocking process. More generally, collateral damage arose from the wrongful blocking of a wide range of completely legitimate sites:

During our classification process, we observed a wide range of website types across these collaterally affected domains, including personal branding pages, company profiles, and websites for hotels and restaurants. One notable case involves 19 Albanian websites hosted on a single IP address assigned to WIIT Cloud. These sites are still unreachable from Italy.

Italian sites were also hit, including a car mechanic, several retail shops, an accountant, a telehealth missionary program – and a nunnery. More amusingly, the researchers write:

we found a case of collateral damage involving a Google IP. Closer inspection revealed the IP was used by Telecom Italia to serve a blocking page for FQDNs filtered by Piracy Shield. Although later removed from the blocklist, this case suggests that collateral damage may have affected the blocking infrastructure itself.

The academics summarize their work as follows:

Our results on the collateral damages of IP and FQDN blocking highlight a worrisome scenario, with hundreds of legitimate websites unknowingly affected by blocking, unknown operators experiencing service disruption, and illegal streamers continuing to evade enforcement by exploiting the abundance of address space online, leaving behind unusable and polluted address ranges. Still, our findings represent a conservative lower-bound estimate.

It distinguished three ways in which Piracy Shield is harmful. Economically, because it disrupts legitimate businesses; technically, because it blocks shared infrastructure such as content delivery networks, while “polluting the IP address space” for future, unsuspecting users; and operationally, because it imposes a “growing, uncompensated burden on Italian ISPs forced to implement an expanding list of permanent blocks.” The paper concludes with some practical suggestions for improving a system that is clearly not fit for purpose, and poses a threat to national security, as discussed previously on Walled Culture. The researchers suggest that:

widespread and difficult-to-predict collateral damage suggests that IP-level blocking is an indiscriminate tool with consequences that outweigh its benefits and should not be used.

Instead, they point out that there are other legal pathways that can be pursued, since many of the allegedly infringing streams originate within the EU. If FQDN blocking is used, it should be regarded as “a last resort in tightly constrained time windows, i.e., only for the duration of the live event.” Crucially, more transparency is needed from AGCOM:

To mitigate damages, resource owners must be immediately notified when their assets are blocked, and a clear, fast unblocking mechanism must be in place.

This is an important piece of work, because it places criticisms of Piracy Shield on a firm footing, with rigorous analysis of the facts. However, AGCOM is unlikely to pay attention, since it is in the process of expanding Piracy Shield to apply to vast swathes of online streaming: amendments to the relevant law mean that automatic blocks can now be applied to film premieres, and even run-of-the-mill TV shows. Based on its past behavior, the copyright industry may well push to extend Piracy Shield to static Web material too, on the basis that the blocking infrastructure is already in place, so why not use it for every kind of material?

Follow me @glynmoody on Mastodon and on Bluesky. Originally posted to Walled Culture.

Filed Under: copyright, domain names, internet infrastructure, ip addresses, italy, mistakes, piracy shield, site blocking

Litigious Company Demands Removal Of A Tweet Linking To An Article About How Litigious They Are

Defamation

from the clown-innovation dept

It’s not every day you watch a company faceplant so theatrically in public, but Cloud Innovation’s latest stunt deserves a slow clap. Cloud Innovation, which you’d probably never heard of unless you’re neck-deep in African IP registry battles (stay tuned), just managed to make a legal play whose end result should be calling a lot more attention on its own legal actions and threats.

The move? They sent a cease and desist letter to Joe Hall—demanding Hall delete a tweet. Not a tweet where he said anything defamatory. Not a tweet where he made false claims. Indeed, not a tweet where he said anything at all. Just… a tweet with a link. Literally, a URL to a Medium article discussing the AfriNIC saga, in which Cloud Innovation is a central player.

That’s the entire complaint: someone shared a link.

The letter, signed illegibly by someone calling themselves “Legal Counsel,” gives Hall 24 hours to remove his tweet sharing Emmanuel Vitus’s Medium article “AfriNIC: Hope, Hijack, and the Harsh Lessons of African Multistakeholderism” or face a lawsuit for “defamation, unlawful publication and dissemination of defamatory article.”

So, of course: you should go read that article. Cloud Innovation seems desperate for you not to. It’s also both a fascinating and depressing deep dive into what happened with AfriNIC—something I never would have learned about if Cloud Innovation hadn’t been so hellbent on making sure I never saw it.

Still let’s pause here to appreciate the legal theory being advanced by Cloud Innovation: that sharing a link to an article someone else wrote makes you liable for defamation. This is roughly equivalent to claiming that the person who hands you a newspaper is responsible for everything printed inside it.

The Backstory: AfriNIC’s Institutional Collapse

The article Hall shared tells a genuinely important story about AfriNIC, the African Network Information Centre responsible for distributing IP addresses across the continent. What was once a symbol of African digital sovereignty has been paralyzed by a number of issues, with much of it coming from an aggressive legal campaign from Cloud Innovation, which has filed dozens of lawsuits to block the registry’s governance and operations.

Among many other things, the piece details how Cloud Innovation obtained control of millions of IPv4 addresses—worth potentially hundreds of millions of dollars—and those IP addresses appeared to be “redirected to data centers abroad,” rather than used in Africa. When AfriNIC tried to audit and potentially reclaim these resources, Cloud Innovation responded with a legal blitz that has effectively shut down the institution.

More than fifty legal cases were filed in rapid succession. Some were emergency applications. Others aimed to freeze bank accounts, block board meetings, suspend elections, or issue restraining orders against AfriNIC’s leadership. The goal was not just to defend a legal position. It was to paralyze the registry entirely.

And it worked. As AfriNIC tried to clean up its records and assert control, it faced a coordinated legal pushback. Every step taken by the registry was met with a countermeasure in court. Every attempt at reform was slowed by injunctions. The legal process became a tool of exhaustion.

It’s a story of institutional capture, regulatory failure, and the vulnerability of critical internet infrastructure. Oh, and abuses of the legal system. In other words, exactly the kind of story that deserves widespread attention and discussion.

And also, exactly the kind of thing Hall, who is a distinguished technologist at the Internet Society, would want to share with his followers.

Enter the Streisand Effect

Which brings us to… well… you know. By trying to suppress discussion of an article that documents their use of aggressive legal tactics to silence critics, they’ve… used aggressive legal tactics to try to silence a critic.

And they didn’t just go after Hall. According to the response letter, “substantially identical letters were sent to other people who posted links to the same article.” Multiple people have reported receiving similar threats just for sharing the link (and, tragically, it appears at least some removed their tweets).

Either way, the end result is that way more attention is likely to go to the underlying story than it would have received otherwise. Before the legal threats, this was a somewhat niche piece about African internet governance. Now it’s a case study in how not to handle public criticism.

And a reason to read the article.

How to Respond to a Censorial Legal Threat

Hall’s response, crafted by lawyer Kendra Albert of Albert Sellars LLP, is a masterclass in how to handle bullshit legal threats. The letter methodically demolishes Cloud Innovation’s claims on multiple grounds:

Section 230 immunity: Hall shared someone else’s content on a platform (ExTwitter). Section 230 explicitly protects users from being treated as publishers of third-party content. Game over.

Fair report privilege: The article reports on actual legal proceedings that Cloud Innovation filed. Accurate reporting on court cases is privileged from defamation claims.

No false statements identified: The cease and desist letter doesn’t point to any specific false statements, let alone prove they’re false.

Public figure standard: Even if the above didn’t apply, under US law, Cloud Innovation would need to prove “actual malice”—that Hall knew the statements were false or showed reckless disregard for their truth.

The SPEECH Act: Even if Cloud Innovation won a defamation judgment in another country, they couldn’t enforce it in the U.S. without meeting American free speech standards.

You can read through the analysis of all of those, but just to whet your appetite, here was the description of the third item in that list:

Even if Dr. Hall was the original author and thus not immunized by Section 230, and even if the fair report privilege did not apply, Cloud Innovation’s claim would fail for a third reason. Under the First Amendment, Cloud Innovation Ltd would need to show that a defamation defendant published an identifiable false statement of fact that harmed its reputation, and that the speaker did so with the requisite level of intent. Cloud Innovation has already admitted that the facts in Mr. Vitus’ article are true, and any statements of opinion cannot be defamatory under U.S. law. Cloud Innovation would also have to identify those statements with specificity. We note that your letter does not identify any particular false statements in Mr. Vitus’s article, let alone any such statements from Dr. Hall.

The response letter notes that “it would be inappropriate for legal counsel to send a demand letter without research, which should have turned up at least one of the five independent reasons why Cloud Innovation has no claim against Dr. Hall.”

It concludes:

We will refrain from providing a count of the reasons why a lawyer from any jurisdiction should know better than to use baseless threats to intimidate a perceived critic.

Ouch.

The Bigger Picture: Standing Up to Censorial Bullies

This case, once again, illustrates why we need more people willing to stand up to legal intimidation, as Hall has done here. The letter he received was clearly designed to shut down discussion through intimidation, not to address any legitimate legal grievance.

The 24-hour deadline. The vague threats. The failure to identify specific false statements. The targeting of multiple people for simply sharing a link. These are all classic signs of a SLAPP attempt—designed to chill speech through the threat of expensive litigation.

And it’s working on some people. As the letter notes, at least one person has already deleted their tweet in response to the threat. That’s exactly what these campaigns are designed to achieve: silence through intimidation.

Of course, now Cloud Innovation’s legal strategy about the story has become part of the story, perhaps the key part of the story. The original article documented how the company used aggressive litigation to paralyze AfriNIC’s governance. Now they’re using similar tactics to try to suppress discussion of that very behavior.

The crazy thing about the Streisand Effect is that it’s so predictable, yet people keep falling for it. It’s like watching someone step on the same rake over and over again, except the rake is “trying to suppress information in the internet age” and the person is “a company that should probably know better.”

So, if you hadn’t checked it out yet, now is a good time to read Vitus’ reporting on AfriNIC.

Filed Under: censorship, defamation, ip addresses, joe hall, linking, slapp
Companies: afrinic, cloud innovation

Top EU Court Says There’s No Right To Online Anonymity, Because Copyright Is More Important

Copyright

from the copyright-exceptionalism dept

A year ago, Walled Culture wrote about an extremely important case that was being considered by the Court of Justice of the European Union (CJEU), the EU’s top court. The central question was whether the judges considered that copyright was more important than privacy. The bad news is that the CJEU has just decided that it is:

The Court, sitting as the Full Court, holds that the general and indiscriminate retention of IP addresses does not necessarily constitute a serious interference with fundamental rights.

IP addresses refer to the identifying Internet number assigned to a user’s system when it is online. That may change each time someone uses the Internet, but if Internet Service Providers are required by law to retain information about who was assigned a particular address at a given time, then it is possible to carry out routine surveillance of people’s online activities. The CJEU has decided this is acceptable:

EU law does not preclude national legislation authorising the competent public authority, for the sole purpose of identifying the person suspected of having committed a criminal offence, to access the civil identity data associated with an IP address

The key problem is that copyright infringement by a private individual is regarded by the court as something so serious that it negates the right to privacy. It’s a sign of the twisted values that copyright has succeeded on imposing on many legal systems. It equates the mere copying of a digital file with serious crimes that merit a prison sentence, an evident absurdity.

As one of the groups that brought the original case, La Quadrature du Net, writes, this latest decision also has serious negative consequences for human rights in the EU:

Whereas in 2020, the CJEU considered that the retention of IP addresses constituted a serious interference with fundamental rights and that they could only be accessed, together with the civil identity of the Internet user, for the purpose of fighting serious crime or safeguarding national security, this is no longer true. The CJEU has reversed its reasoning: it now considers that the retention of IP addresses is, by default, no longer a serious interference with fundamental rights, and that it is only in certain cases that such access constitutes a serious interference that must be safeguarded with appropriate protection measures.

As a result, La Quadrature du Net says:

While in 2020 [the CJEU] stated that there was a right to online anonymity enshrined in the ePrivacy Directive, it is now abandoning it. Unfortunately, by giving the police broad access to the civil identity associated with an IP address and to the content of a communication, it puts a de facto end to online anonymity.

This is a good example of how copyright’s continuing obsession with ownership and control of digital material is warping the entire legal system in the EU. What was supposed to be simply a fair way of rewarding creators has resulted in a monstrous system of routine government surveillance carried out on hundreds of millions of innocent people just in case they copy a digital file.

Follow me @glynmoody on Mastodon and on Bluesky. Originally posted to Walled Culture.

Filed Under: cjeu, copyright, data retention, eprivacy directive, eu, ip addresses, privacy

LastPass Tries To Bury The Full Scope Of Its Disastrous Privacy Breach Behind The Christmas Holiday

(Mis)Uses of Technology

from the dysfunction-junction dept

Back in August, password storage app LastPass vaguely admitted that hackers had accessed the company’s systems. In the company’s original August reveal, the company generally tap danced around the subject, claiming that while they had identified some “unusual activity,” consumer data had not been accessed.

By November, LastPass had begun shifting its story a bit, acknowledging that the unauthorized August access to its systems had allowed an unidentified third party to “gain access to certain elements” of customer info later on. Then, right before the Christmas holiday on December 22, LastPass finally revealed something closer to the full truth. And it’s not pretty:

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.

That vault data included company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service. All of that information, including numerous IP address records allowing the tracking of user locations and movement, is now in the hands of an unknown third party.

The vaults also included copies of encrypted user passwords. And while those passwords might be safe for users with strong master passwords and updated default account settings, some users with older account settings and weaker master passwords may have had their entire password list exposed, meaning those folks are now spending the holiday updating potentially thousands of website and service passwords all across the internet.

Security researchers weren’t impressed for numerous reasons. For one, it took LastPass numerous months to fully reveal the full scope of the intrusion. And when they did reveal it, they not only buried it ahead of the big holiday in the hopes it would minimize attention, security researchers like Wladimir Palant argued the announcement was aggressively misleading from beginning to end:

LastPass is trying to present the August 2022 incident and the data leak now as two separate events. But using information gained in the initial access in order to access more assets is actually a typical technique used by threat actors. It is called lateral movement.

So the more correct interpretation of events is: we do not have a new breach now, LastPass rather failed to contain the August 2022 breach. And because of that failure people’s data is now gone. Yes, this interpretation is far less favorable of LastPass, which is why they likely try to avoid it.

That entire post is worth a read, as it outlines the numerous instances in which LastPass attempts to distort both event history and the scale of the breach. And again, this wasn’t just some fly by night shop selling garbage smart home doodads. This was a company purportedly dedicated to consumer security, and this is just one major event in a string of bad decisions and previous breaches.

Filed Under: encrypted data, ip addresses, location data, password managers, passwords, privacy, security
Companies: lastpass

German Court Fines Site Owner For Sharing User Data With Google To Access Web Fonts

Legal Issues

from the getting-fined-the-odd-way dept

The European Union’s data privacy law, the GDPR (General Data Protection Regulation), has caused all sorts of problems since its debut. Its debut was itself a mess, something that immediately resulted in a whole lot of websites simply refusing to allow European users to connect with them.

Since it was unclear how to avoid running afoul of the law, it was easier to avoid potential fines by simply cutting European users out of the equation. For everyone else, it was being greeted with a new warning about cookies at nearly every website they visited — a small hassle to be sure, but a hassle nonetheless.

Then there were the truly unexpected consequences of the new law that imposed data-gathering and data-sharing restrictions on any business, whether they were internet-based or not. In some areas, GDPR was read as requiring retailers to notify purchasers of items when the items were returned — something that would make the exchange of unwanted Christmas gifts extremely awkward.

In another weird case, post offices in Ireland removed waste bins from their facilities because customers were throwing out unwanted mail and receipts, resulting the offices’ unintentional collection of personal data. When the waste bins went missing, customers resorted to throwing their trash on post office counters and floors, leaving it even more unregulated than it was when the waste bins were still in place.

Yet another side effect no one saw coming: the use of Google’s Font API was enough to get a website fined by a German court. (via Slashdot)

Earlier this month, a German court fined an unidentified website €100 ($110, £84) for violating EU privacy law by importing a Google-hosted web font.

The decision, by Landgericht München’s third civil chamber in Munich, found that the website, by including Google-Fonts-hosted font on its pages, passed the unidentified plaintiff’s IP address to Google without authorization and without a legitimate reason for doing so. And that violates Europe’s General Data Protection Regulation (GDPR).

The court says whether or not Google did anything with the forwarded IP address is beside the point. The fact is the website engaged in the unauthorized transmission of this IP address to Google by using its font API to access a font to render the text on the site. The court’s decision points out this can be avoided by self-hosting the font and notes that the website operator has chosen to do this going forward. That being said, the court still feels a fine is the only way to ensure future compliance with GDPR.

Risk of repetition is to be affirmed. It is undisputed that the plaintiff’s IP address was forwarded to Google when the plaintiff visited the defendant’s website. Previous unlawful impairments justify an actual assumption of the risk of repetition, which was not refuted by the defendant. The risk of repetition is not eliminated by the fact that the defendant now uses Google Fonts in such a way that the IP address of the website visitor is no longer disclosed to Google. The risk of repetition can only be eliminated by a declaration of discontinuance with a penalty.

The fine here may have been minimal, but the law allows a penalty of €250,000 ($286,000) per violation, which the court warns the website operator is not only possible, but probable, if the problem doesn’t go away. There’s also the (very slim) chance the improper use of Google Fonts could result in prison time, because that’s also a potential GDPR violation penalty.

While the solution here appears to be simple enough — self-host fonts — the reality of the situation is that this decision will lead to yet another pop-up asking for consent that will stand between site users and the content they’re trying to access, and that no one will read before clicking “accept.” It won’t make the web a better place and it won’t do much to limit the sharing of personal data with off-site entities. It will just make everything a little more annoying.

Filed Under: data protection, fonts, gdpr, germany, ip addresses, privacy, sharing, web fonts
Companies: google

It Happened Again: Antipiracy Outfit Asks Google To Delist 127.0.0.1 On Behalf Of Ukrainian TV Station

Copyright

from the where-the-piracy-is dept

We’ve made this point before, but the moment you attempt to scale up copyright enforcement, you run into problems. Collateral damage from automated systems mistaking non-infringing content for infringing, the possibility of fraud and abuse, the blind eye towards Fair Use all become problems. But sometimes those problems are so silly that they expose what a pure fiasco this has become. Several years back, we discussed Universal Pictures asking Google to delist a bunch of supposedly infringing sites, listing one of them as 127.0.0.1. Depending on how computer savvy you are, you may recognize that this IP address is how a computer or system refers to itself. In other words, it essentially means “home.”

And, yet, despite how silly this all is, it just keeps happening. Most recently, the anti-piracy outfit used by a Ukrainian television broadcaster may have outed its own client by also asking Google to delist 127.0.0.1.

Ukrainian TV channel TRK has sent a rather bizarre takedown request to Google. The company’s anti-piracy partner Vindex asked the search engine to remove a search result that points to 127.0.0.1. Tech-savvy people will immediately recognize that the anti-piracy company apparently found copyright-infringing content on its own server.

The request was sent by TKR’s anti-piracy partner Vindex, which essentially flagged a file on its own machine. The ‘infringing’ link is 127.0.0.1:6878/ace/manifest.m3u. This points to a playlist file, possibly for the P2P streaming platform Ace Stream that’s often used to pirate content.

Now, a number of things here should be unsurprising to our regular readers. That an antipiracy outfit sucks at identifying proper sites for delisting is no surprise. Likewise, the idea that a company that is crying about copyright infringement might be guilty of infringement itself also fails to shock the mind. But what is surprising is that the antipiracy outfit may have accidentally outed its own client through its own stupidity as a party infringing copyrights so thoroughly.

Google obviously cannot delist the IP address, as there is nothing to delist. And, frankly, Vindex is known to suck at its one job.

Since 127.0.0.1 refers to the host computer, Google is technically asked to remove a file from its servers. A file that doesn’t exist. Needless to say, Google hasn’t taken any action in response.

The above suggests that Vindex may want to take a good look at its takedown bots. The company doesn’t have a stellar reputation when it comes to DMCA notices. Of all the links that were reported to Google, little more than 10% were removed by the search engine.

Adding to it that you imagine there are some uncomfortable conversations being had between Vindex and its client today and you’re left with the impression that there is a ton of egg on its face right now.

Filed Under: 127.0.0.1, antipiracy, copyright, home, ip addresses, piracy, ukraine
Companies: google, trk

In Trying To Ban Telegram, Russia Breaks The Internet

(Mis)Uses of Technology

from the unintended-consequences dept

Russia’s war on encryption and privacy has reached an entirely new level of ridiculous. We’ve noted for a while how Putin’s government has been escalating its war on encrypted services and VPNs in the misguided hope of keeping citizens from dodging government surveillance. But things escalated dramatically when the Russian government demanded that encrypted messaging app Telegram hand over its encryption keys to the FSB. After Telegram refused, a Russian court banned the app entirely last Friday, and the Russian government began trying to actually implement it this week.

It’s not going particularly well.

Telegram tried to mitigate the ban by moving some of its essential infrastructure to third-party cloud services. But Russian telecom regulator Roskomnadzor responded by blocking upwards of 16 million IP addresses, many belonging to Amazon Web Services and Google Cloud. Not too surprisingly, the heavy-handed maneuver resulted in connectivity problems across massive swaths of the Russian internet:

Some users say the ban has disrupted the functionality of unrelated online games and services:

And even credit card terminals:

While the Russian government has been portrayed as a technological and hacking mastermind in the wake of its escalating global disinformation and hacking campaign, there’s nothing at all competent about this effort. The Russian government is demanding that both Apple and Google pull encrypted messaging apps from their app stores. They’ve also tried to pressure sideloading websites like APK Mirror into refusing to offer alternative access to the Telegram app. But it’s just another game of Whac-a-Mole, with VPN provider NordVPN saying it saw a 150% spike in Russian usage in the wake of the ban.

The Russian government is claiming that its ham-fisted blockade has resulted in a 30% dip in Telegram usage. But Telegram founder Pavel Durov has downplayed the ban’s impact on overall “user engagement”:

“For the last 24 hours Telegram has been under a ban by internet providers in Russia. The reason is our refusal to provide encryption keys to Russian security agencies. For us, this was an easy decision. We promised our users 100% privacy and would rather cease to exist than violate this promise.

“Despite the ban, we haven?t seen a significant drop in user engagement so far, since Russians tend to bypass the ban with VPNs and proxies. We also have been relying on third-party cloud services to remain partly available for our users there.”

Russian state media meanwhile continues to demonize Telegram as a haven for villains, and is directing users to alternatives like TamTam with alleged ties to the Russian government. All told, it’s another wonderful illustration of how filtering the internet doesn’t work (unless collateral damage and annoyance is your stated goal), and a war on fundamental security and privacy tools only makes everybody less secure. This is not a battle Russia can “win,” but it’s apparently too far down the rabbit hole of bad ideas to stop now.

Filed Under: banning, encryption, ip addresses, privacy, roskomnadzor, russia, surveillance
Companies: amazon, google, telegram

Telenor Looks To Lead The Anti-Troll Fight In Europe

Copyright

from the to-arms dept

In what is beginning to look like a much-welcomed trend, it seems like copyright trolls are finally due to receive some pushback from powerful industry players. Whereas previous pushback has been both isolated and chiefly the province of smaller European government groups, the real curtailing of copyright trolling efforts was always going to come from a revolt by tangential corporate interests. It appears that the soldier on the front of that fight might be Telenor, an ISP that has previously pushed back against efforts for wholesale site-blocking in the name of copyright, and one that is is now looking to export its recent anti-troll win in Norway to the country of Denmark by gathering allies in the ISP industry to its side.

To stop the trolling efforts from getting out of hand, Telenor is now preparing to build a new case at the Frederiksberg Court, hoping to protect the identities of its subscribers. In Denmark, Telenor is supported by fellow Internet provider Telia, which says it will be more critical toward trolling efforts going forward.

The branch organization Telecommunications Industry in Denmark notes that other ISPs are backing Telenor’s efforts as well. The group’s director, Jakob Willer, describes the copyright trolling scheme as a “mafia-like” practice, which should be stopped.

“There is full support from the industry to Telenor to take this fight and protect customers against mafia-like practices,” Willer says.

This language choice is not remotely inappropriate. Copyright trolls rarely find themselves before an actual court against defendants, instead relying on well-crafted and often deceptive threat letters to generate settlement income for themselves and their clients. It should be immediately clear exactly what is going on here when a law firm so haphazardly threatens litigation yet never conducts it. Extortion is a word that leaps to mind, even if these wolves are garbed in the sheep’s clothing offered by the imprimatur of legal language and the status of being an otherwise valid law firm. What’s required to break these efforts is the unmasking of these tactics and the tenuous evidence on which they are based, as well as having the privacy erosion that these tactics require laid bare for all to see. ISPs are the perfect paladin for this, as they are the ones giving up customer information based typically on scant evidence.

Individuals will find themselves unable to compete with the legal teams of these copyright trolls. So much so, that the unmasking of account information is quickly getting out of control.

These so-called “copyright trolls” have also landed in Denmark, where the number of targeted Internet subscribers is growing at a rapid rate.

In 2015, rightsholders received permission from courts to obtain the personal details of 6,187 alleged BitTorrent pirates, based on their IP-addresses. A year later the number of accused subscribers increased by nearly 250 percent, to 21,163.

Why courts so often side with industry in this manner is a discussion for another day, but given that reality, ISPs too are an industry that can take up this fight. Seeing them begin to do so, and banding together to provide a more formidable legal defense of what is essentially their customers’ rights, is obviously a step in the right direction. And, while geography plays little role in internet-related questions of this kind, it strikes anyone looking at the map how Telenor appears to be surrounding Germany, the birthplace of copyright trolling, with its legal efforts.

All is not quiet on the copyright troll front, in other words, with ISPs now looking to ally against them.

Filed Under: copyright, copyright trolling, copyright trolls, denmark, ip addresses
Companies: telenor

Singapore Court Tosses Copyright Troll Cases Because IP Addresses Aren't Good Enough Evidence

Copyright

from the preach dept

We’ve been saying this for years, but IP addresses are not good enough evidence on which to base copyright infringement lawsuits. At some level, everyone already knows this to be true. You can tell that’s the case because the typical pretenders stating otherwise are the copyright trolls with a business model that relies on gathering large numbers of supposedly infringing IP addresses, mailing out settlement demands to the supposed pirates that own the accounts of those IP addresses, and then collecting very real money from some percentage of the recipients. On top of that, even these trolls will often claim that the onus is on the account holder of an internet connection to police their own pipe, which is a delightful end-around to the common concept of punishing true infringers as opposed to innocent third parties.

There are places with legal systems that have had enough of this practice and we can now add Singapore’s to the list. The High Court in Singapore recently threw out requests from several copyright trolls made to ISPs there to produce account information for IP addresses they claim were used to infringe on two movies, Fathers & Daughters and Queen Of The Desert.

The oral decision delivered at a closed-door hearing on Monday was on the grounds of “insufficient evidence”, the Attorney-General’s Chambers (AGC) told The Straits Times yesterday. In a rare move, the AGC intervened in civil applications made in the High Court in July last year by Samuel Seow Law Corp (SSLC), the local law firm that represents the two studios.

Last year, SSLC again served papers on Singtel, StarHub and M1 to get details of alleged pirates of Fathers & Daughters and Queen Of The Desert, with a list of over 500 offending Internet Protocol (IP) addresses. The AGC and the Intellectual Property Office of Singapore (Ipos) said they highlighted to the court that SSLC did not submit “sufficient evidence” to show a link between the IP addresses and alleged illegal downloaders. It was on such grounds that the case was dismissed.

It’s an important decision in the country, with the High Court cementing the position that IP addresses are not sufficient evidence with which to demand account information over infringement issues. That the practical use for that account information would have been the type of sleazy settlement demands that have become the norm in copyright trolling circles may have played a role in the decision, but it need not have. Viewed solely on its merits, there are any number of ways an internet connection might be used for copyright infringement by someone other than the owner of the internet account: shared WiFi, brute force break-ins into the connection, etc. The simple fact is that knowing an IP address that was used for infringement doesn’t tell anyone who did the actual infringing. Viewed that way, compelling ISPs to turn over personal account information based solely on IP addresses is crazy.

Some IP attorneys are already whining about the decision.

Mr Lau Kok Keng, an IP lawyer at Rajah & Tann Singapore, said requiring the rights owner to link the IP address to the actual infringer is akin to “putting the cart before the horse” – copyright holders need to know who the account holder is to ascertain if he is the actual pirate.

“So it could mean that individuals who illegally download copyright content will be able to get off scot-free because their identities will never be known, short of being caught in the act,” said Mr Lau.

Which is much to do about nothing, given that, again, the infringing party might not be the IP address owner to begin with. What the copyright trolls are really looking for are essentially lead lists for settlement letters. They don’t really care if the recipient of those letters is the infringer or not, they care if they can scare enough people into paying settlements to make money.

In that light, it’s nice to see a government get it right on this question about IP addresses as evidence, even if we have to look all the way to Singapore to see it.

Filed Under: copyright, copyright trolls, ip addresses, singapore

How Bad Are Geolocation Tools? Really, Really Bad

(Mis)Uses of Technology

from the what-a-mess dept

Geolocation is one of those tools that the less technically minded like to use to feel smart. At its core it’s a database, showing locations for IP addresses, but like most database-based tools, the old maxim of GIGO [Garbage In, Garbage Out] applies. Over the weekend Fusion’s Kashmir Hill wrote a great story about how one geolocation company has sent hundreds of people to one farm in Kansas for no reason other than laziness. And yes, it’s exactly as bad as it sounds.

Most people often aren’t the most technically minded, give them a tool, tell them it CAN produce an output, and they’ll assume that any output that looks like the best quality possible, IS the best one available. It’s extremely common with ‘forensic evidence’ and jurors in court cases, where it’s given weight well beyond its actual evidentiary value (to the point that they now distrust cases without it) ? there’s even a name for it, “the CSI effect“, named after one of the TV shows that uses it as a cornerstone.

One of the latest tools to get the blind trust of morons is IP Geolocation. At its basic level, it’s a database of IP addresses with latitude and longitude listed, so when you look up an IP address, you get a pair of coordinates you can associate as an ‘origin’ for that.

However, there’s a number of problems with that.:

• First, what about those that don’t have a lat/long listed?
• Secondly, how often are they updated?
• Third, how do they deal with cellular or ‘mobile’ devices?

So let’s quickly address them.

Those that don’t have a lat/long listed.

Well, there’s a few ways to do it, but the way some chose to do, is just to guess. In the article that started me on this, it points out that the company MaxMind decided to guess at the average closest place it could ? the geographical center of the US, except 39?50’N 98?35’W. is a messy decimal (39.8333333 N,98.585522W) so it rounded them to 38N, 97W. It’s the front yard of a farm in Kansas.

Other times they just guess and get a town and put it somewhere there, although even that can be off a bit. It can be a lot off, as you’ll see shortly.

How often are they updated?

There’s no telling. With the great shortage of IPv4 addresses now, but with an ever-expanding list of devices, from cell phones to thermostats and even fridges, IP addresses are shifting around everywhere. There’s also mergers and splits of companies, bankruptcies and so on. So unless the database is frequently updated, there’s no chance that anything it has to say will be accurate ? again we’ll see that directly.

Finally, how does it deal with cellular devices?

Simply put, they don’t. The handoff mechanism means that you’ll often carry one IP address from one tower to the next (otherwise you’d have to terminate and restart any data transfer as you shifted between towers. In addition most cellular providers hide their cell customers behind NAT, precisely because of the lack of discreet IPv4 addresses to give out (and their? slowness in migrating to IPv6)

Odds are you’re going to get a local network control center, or regional corporate office instead, which means it’s practically no use at all.

Oh dear….

This all assumes as well that entries are made in good faith. One of the more common uses of geolocation is for targeted adverts, especially with ‘adult websites’, where they promise there’s a horny woman (or man, if your browsing is detected as such, or the ‘content’ suggests you may be female) close by. Or you may have seen it in the scam adverts on news sites that should know better than to accept low-rate advertising based on scams (with easy to tell, clickbait headlines about insurance ‘tricks’ or similar).

This means that if you can ‘rig’ the database, you can expose the stupidity in parts of it, as was best demonstrated by Randall Munroe in his XKCD comic series.

So just how inaccurate are these systems? The easiest way to tell by far is to run some IP addresses where you know the location through these systems and see how far off they can be. So I did.

The most obvious one to start with is my own home connection’s IP address. So I tried the link in the story, and boy was it off! Just for the record, I live on the south side of Atlanta’s metro area, near Macon ? Walking Dead country in fact

That’s right, it put me in Ottawa, capital of Canada, roughly 1900km (1180 miles) and 1 whole country off. Part of that comes from the second question, how current the data is. It’s listing my IP as belonging to Nortel networks. Problem is, I’m not a subscriber to Nortel ? no-one is, the company was wound down years ago. Yet some databases still have them listed.

Cellphones don’t fare much better either. I used the same service on a 4G Verizon phone sitting at my computer. It’s location, San Diego. That’s 1900 miles (3050km) off. Others services gave locations of New York, Atlanta, and Macon.

Wondering if it’s just my semi-rural system that’s messed up, I called a few friends who live in the Atlanta suburbs (a few streets from each other) and asked for their IP addresses, one used Comcast, and the other AT&T. Maybe things will be better and more accurate in a big-city environment?

I ran a number of different GeoIP services, and it was a very mixed bag of results.. One thing’s certain though, none of the four set of coordinates gave an accurate location for the person (for obvious reasons I’m not going to give you their address, or mine for that matter)

Of them all, only one service ? IPCIM.com ? gave an error circle with a location, (twenty five mile radius), but it didn’t do it for all. To me that indicates knowledge of its inaccuracy, but it’s lack at other times seems to show it just doesn’t care.

The second and third locations are the same coordinates, but they’re less certain of the third than the second, despite both being off.

There’s also something specific to note. There’s 4 providers covered here. Two were done from the exact same location, yet their locations came nowhere near matching. Two more were IP addresses just streets away, but they also didn’t match that well, although many went to the same default locations, including two which went to the ‘lazy US Center’ investigated in the Fusion piece.

More importantly, of the 30+ geolocating attempts made here, not a single one managed to be within a mile of the actual location (although one location was within a mile and a half, while another was within 3 miles ? again, I’m not going to give out specifics). So for those who want to rely on them as being a source of where something is, the simple answer is “don’t“. This applies as much to those tracking down people who are leaving spammy comments, as it does to police officers and lawyers seeking to use them for court actions criminal or civil.

In fact lawyers and the police have absolutely NO excuse to use these kinds of databases in litigation at all as there are better, more accurate tools at their disposal ? the courts themselves. In criminal cases a warrant is the preferred method, obtaining subscriber information from the ISP (fixed or cellular) which is far more accurate than any geolocation service because it’s data coming from the entity actually providing the connection. In a civil trial you have a discovery subpoena to do pretty much the same thing and for the same reasons.

If you’re doing it ‘on your own’, remember that these tools are as accurate as taking a dart and throwing it not at a map on the wall, but at a Google map display on your computer screen. Sure you’ll be out a display, but you won’t be potentially facing criminal charges when you go to act on what it basically bullshit data. At the very best, it can be used to advise, but it can be INCREDIBLY off, sometimes thousands of miles.

Data

The following services were used

• Checkip.org
• IP2location (Product: DB6, updated on 2016-4-1)
• IpInfo.io (Product: API, real-time)
• EurekAPI (Product: API, real-time)
• DB-IP (Product: Full, 2016-4-2)
• IPCIM.com
• MaxMind (Product: GeoLiteCity, updated on 2016-4-5)
• MaxMind (Product GeoIP2)

There were 4 IP addresses used, three residential and one cellular comprising four of the biggest ISP’s in the US.

IP addresses

• 32.99.122 (Charter fixed line cable internet connection ? K`Tetch)
• 193.166.88 (Verizon 4G cellular connection ? K`Tetch )
• 137.147.28 (Comcast fixed line cable internet connection ? James)
• 172.126.144.9 (AT&T gigapower fixed line internet connection, less than 6 months old ? David)

The first two were located in south metro Atlanta, near Macon. David and James are located approximately half a mile apart in north Cobb county, Georgia.

Raw coordinates

NOTE: One data source was extremely interesting in its provision of 11+ decimal places in its results. While this might seek to imply accuracy, it actually underscores how inaccurate it actually is. Eight decimal places gives a resolution of 1.1 millimeters ? half the thickness of a CD/DVD. 11 decimal places as given in all their results is going to extremes, with locations given to less than a hair’s thickness. It has been rounded down.
The “Marietta (bedroom)” label was actually on the output from their database.

I would like to thank David and James for their help with this. And for obvious reasons, we have forced changes in IP addresses for all our connections (and the release of this article was delayed to ensure that).

This is a repost from Andrew Norton’s Politics & P2P blog

Filed Under: errors, geolocation tools, ip addresses