[Today we welcome my Princeton Computer Science colleague Mike Freedman. Mike’s research areas include computer systems, network software, and security. He writes a technical blog about these topics at Princeton S* Network Systems — required reading for serious systems geeks like me. — Ed Felten]
In the past few weeks, Ed has been writing about targeted and inaccurate copyright enforcement. While it may be difficult to quantify the actual extent of inaccurate claims, we can at least try to understand whether copyright enforcement companies are making a “good faith” best effort to minimize any false positives. My short answer: not really.
Let’s start with a typical abuse letter that gets sent to a network provider (in this case, a university) from a “copyright enforcement” company such as the Video Protection Alliance.
This notice is intended solely for the primary Massachusetts Institute of Technology internet service account holder. Someone using this account has engaged in illegal copying or distribution (downloading or uploading) of …
Evidence:
Infringement Source: BitTorrent
Infringement Timestamp: 2009-08-28 09:33:20 PST
Infringers IP Address: 128.31.1.13
Infringers Port: 40951
…
The information in this notification is accurate. We have a good faith belief that use of the material in the manner complained of herein is not authorized by the copyright owner, its agent, or by operation of law. We swear under penalty of perjury, that we are authorized to act on behalf of DISCOUNT VIDEO CENTER INC..
…
You and everyone using this computer must immediately and permanently cease and desist the unauthorized copying and/or distribution (including, but not limited to, downloading, uploading, file sharing, file ‘swapping’ or other similar activities) of the videos and/or other content owned by DISCOUNT VIDEO CENTER INC., including, but is not limited to, the copyrighted material listed above.DISCOUNT VIDEO CENTER INC. is prepared to pursue every available remedy including damages, recovery of attorney’s fees, costs and any and all other claims that may be available to it in a lawsuit filed against you.
While DISCOUNT VIDEO CENTER INC. is entitled to monetary damages, attorneys’ fees and court costs from the infringing party under 17 U.S.C. 504, DISCOUNT VIDEO CENTER INC. believes that it may be beneficial to settle this matter without the need of costly and time-consuming litigation. We have been authorized to offer a reasonable settlement to resolve the infringement of the works listed above. To access this settlement offer, please follow the directions below.
Settlement Offer: To access your settlement offer please copy and paste the address below into a browser and follow the instructions:
https://www.videoprotectionalliance.com/?n_id=AB-XXXXXX
Password: XXXXXXX
In other words: we have a record of you (supposedly) uploading and downloading BitTorrent content. That content is copyrighted. We could pursue costly and painful litigation, but if you want us to just go away, you can pay us now.
Now, any type of IP-based identification is not going to be perfect, especially given the wide-spread use of Network Address Translation (NAT) boxes and open WiFi at homes. Especially in dense urban areas, unapproved third parties might use their neighbor’s wireless network for Internet access, potentially leading to the wrong homeowner being blamed. And IP-based identification relies on accurate ISP mappings from IP addresses to users, as these mappings change over time (although typically slowly) given dynamic address assignment (i.e., DHCP). But one could rightly claim that such sources of false positives are rare in practice and that a enforcement company is still making a best effort to accurately identify IP addresses engaging in copyright-infringing file sharing.
So what’s a reasonable strategy to identify such infringing behavior?
Let me first give a high-level overview of how BitTorrent works. To download a particular file on BitTorrent, a client first needs to discover a set of other peers that have the file. Earlier peer-to-peer systems like Napster, Gnutella, and KaZaA had peers connect to one another somewhat randomly (or, in Napster, through a more centralized directory service). These peers would then broadcast search requests for files, downloading the content directly from those peers that responded as having matching files. In the basic BitTorrent architecture, on the other hand, the global ecosystem is split into distinct groups of users that are all trying to download a particular file. Each such group—known as a swarm—is managed by a centralized server called a tracker. The tracker keeps a list of the swarm’s peers and, for each peer, a bit-vector of which file blocks it already has. When a client joins a swarm by announcing itself to the tracker, it gets a list of other peers, and it subsequently attempts to connect to them and download file blocks. How a client discovers a particular swarm is outside the scope of the system, but there are plenty of BitTorrent search engines that allow clients to perform keyword searches. These searches return .torrent files, which includes high-level meta-data about a particular swarm, including the URL(s) at which its tracker(s) can be accessed.
So there are three phases to downloading content from BitTorrent:
- Finding a .torrent meta-data file
- Registering with the .torrent’s tracker and getting a list of peer addresses
- Connecting to a peer, swapping the bit-vector of which file blocks each has, and potentially downloading or uploading needed blocks
Unfortunately, the verification that copyright enforcement agencies such as the VPA use stops at #2. That is, if some random BitTorrent tracker lists your IP address as being part of a swarm, then the VPA considers this to be sufficient proof to warrant a DMCA takedown notice (such as the one above), with clear instructions on how to pay a monetary settlement. Now, a very reasonable question is whether such information should indeed constitute proof.
Last year, researchers at the University of Washington published a paper with the subtitle Why My Printer Received a DMCA Takedown Notice. Their conclusions were that:
- Practically any Internet user can be framed for copyright infringement today.
- Even without being explicitly framed, innocent users may still receive complaints.
The title came from the fact that they “registered” the IP address of a networked printer with BitTorrent trackers, and they subsequently received 9 DMCA takedown notices claiming that their printer was engaging in illegal file sharing. (They did not, however, receive any pre-settlement offers such as the one above, which suggests a possible escalation of enforcement techniques since then.)
I have had my own repeated experiences with such false claims. This September, for instance, a research system I operate called CoralCDN received approximately 100 pre-settlement letters, including the one above. A little background: CoralCDN is an open, free, self-organizing content distribution network (CDN). CDNs are widely used by commercial high-volume websites to scalably deliver their content, such as Hulu’s use of Akamai or CNN’s use of Level 3. CoralCDN was designed to help solve the Slashdot effect, which is when portals such as slashdot.org link to underprovisioned third-party sites and cause that site to become quickly overwhelmed by the unexpected surge of resulting traffic. CoralCDN’s answer was to provide an open CDN that would cache and serve any URL that was requested from it. To use CoralCDN, one simply appends a suffix to a URL’s hostname, i.e., http://www.cnn.com/ becomes http://www.cnn.com.nyud.net/. CoralCDN’s been running on PlanetLab—a distributed research testbed of virtualized servers, spread over several hundred universities worldwide—since March 2004. It handles requests from about 2 million users per day.
Because CoralCDN provides an open platform, one can access any URL through it via an HTTP GET request (with the exception of a small number of blacklisted domains and those for content larger than 50MB). Thus, requests to BitTorrent trackers can also use CoralCDN, as these are simply HTTP GETs with a client’s relevant information encoded in the tracker URL’s query string, e.g., http://denis.stalker.h3q.com.6969.nyud.net/announce?info_hash=(hash)&peer_id=(name)&port=52864&uploaded=231374848&downloaded=2227372596&left=0&corrupt=0&key=E0591124&numwant=200&compact=1&no_peer_id=1.
Notice that the HTTP request includes a peer’s unique name (a long random string) and a port number, but notably does not include an IP address for that client. It’s an optional parameter in the specification that many BitTorrent clients don’t include. (In fact, even if the request includes this IP parameter, some trackers ignore it.) Instead, the tracker records the network-level IP address from where the HTTP request originated (the other end of the TCP connection), together with the supplied port, as the peer’s network address.
When this request is via an HTTP proxy, things go wrong. Here, the BitTorrent client is connecting to an HTTP proxy, which in turn is connecting to the tracker. So this practice results in the tracker recording an unusable address: the combination of the proxy’s IP and the client’s port. Needless to say, the proxy isn’t running BitTorrent, let alone on that particular (often randomized) port. Not only does this design damage the client’s BitTorrent experience—other clients won’t initiate communication with it, leading to fewer opportunities for “tit-for-tat” data exchanges—but this also damages the entire swarm’s performance: Others’ requests to this hybrid address will all fail (typically with an RST response to the TCP connection request). I was rather surprised to find this flaw in the BitTorrent specification.
So how is this related to CoralCDN and the VPA? For whatever reason, some publisher started including a Coralized URL for the tracker’s location, as shown above (http://denis.stalker.h3q.com.6969.nyud.net/). I could only surmise why this was done: perhaps on the (mistaken) assumption that it would reduce load on the server, or perhaps in the hope of offloading abuse complaints to CoralCDN servers. The latter might have been useful if copyright enforcement agencies were going after the trackers, instead of the participating peers. In fact, we initially thought this was the case when these pre-settlement letters from the VPA started rolling in. More careful analysis, however, exposed the above problem: when the BitTorrent URL was Coralized, peers’ requests to the tracker were issued via CoralCDN HTTP proxies. Thus, the tracker built up a list of peer addresses of the form (CoralCDN IP : peer port), where these CoralCDN IPs correspond to PlanetLab servers located at various universities.
Hence, when the VPA began sending out pre-settlement letters claiming infringement, they sent them to network operators at tens of universities, who turned around and forwarded them to PlanetLab’s central operations and me.
What is particularly striking about this case, however, is that these reports were demonstrably false! There was no BitTorrent client running at the specified address (in the above letter, 128.31.1.13:40951), for precisely the reasons I discuss. Thus, we can fairly definitively conclude that the VPA never actually tested the peer for actual infringement: not even by trying to connect to the client’s address, let alone determining whether the client was actually uploading or download any data, and let alone valid data corresponding to the copyrighted file in question.
This begs the question as to what should be required for a company to issue a DMCA notification and pre-settlement letters that assert:
Someone using this account has engaged in illegal copying or distribution (downloading or uploading)…The information in this notification is accurate. We have a good faith belief that use of the material in the manner complained of herein is not authorized by the copyright owner.
Of course, the incentives for the VPA to actually ensure that “this notification is accurate” are pretty clear. The cost of a false positive is currently nothing, and perhaps some innocent users will even “buy protection” to make this problem and the threat of costly litigation go away.
DISCOUNT VIDEO CENTER INC. believes that it may be beneficial to settle this matter without the need of costly and time-consuming litigation. We have been authorized to offer a reasonable settlement to resolve the infringement of the works listed above.
It appears that the VPA and other such agencies have been rather effective at getting some settlement money. Our personal experience with DMCA takedown notices is that network operators are suitably afraid of litigation. Many will pull network access from machines as soon as a complaint is received, without any further verification or demonstrative network logs. In fact, many operators also sought “proof” that we weren’t running BitTorrent or engaging in file sharing before they were willing to restore access. We’ll leave the discussion about how we might prove such a negative to another day, but one can point to the chilling effect that such notices have had, when users are immediately considered guilty and must prove their innocence.
I am not arguing that copyright owners should not be able to take reasonable steps to protect their copyrighted material. I am arguing, however, that they should take similarly reasonable steps to ensure that any claimed infringement actually took place. When DMCA notices are accompanied by oaths under “penalty of perjury” and these claims are accepted as writ, as they have de facto become, there should some downside for agencies that demonstrably do not act in “good faith” to verify infringement. Even a simple TCP connection attempt would have been enough to dispel their flawed assumptions. That currently seems to be too much to ask.
Update (Dec 15): A follow-up post can be found here.
The so-called “notice” represents everything Unsolicited commercial e-mail stands for.
Allow me to demonstrate:
This notice is intended solely for Emmanuel Goldstein internet service account holder. Someone using this account has engaged in illegal copying or distribution (downloading or uploading) of content from http://go-here.nl
Evidence:
Infringement Source: BitTorrent
Infringement Timestamp: 2010-03-26 09:33:20 PST
Infringers IP Address: unknown
Infringers Port: unknown
The information in this notification is accurate. We have a good faith belief that use of the material in the manner complained of herein is not authorized by http://go-here.nl the copyright owner, its agent, or by operation of law.
You and everyone using this computer must immediately and permanently cease and desist the unauthorized copying and/or distribution (including, but not limited to, downloading, uploading, file sharing, file ‘swapping’ or other similar activities) of content owned by http://go-here.nl , including, but is not limited to, the copyrighted material listed above.
http://go-here.nl is prepared to pursue every available remedy including damages, recovery of attorney’s fees, costs and any and all other claims that may be available to it in a lawsuit filed against you.
While http://go-here.nl is entitled to monetary damages, attorneys’ fees and court costs from the infringing party under 17 U.S.C. 504, http://go-here.nl believes that it may be beneficial to settle this matter without the need of costly and time-consuming litigation. We offer a reasonable settlement to resolve the infringement of the works listed above. To access this settlement offer, please follow the directions below.
Settlement Offer: To access your settlement offer please copy and paste the address below into a browser and follow the instructions:
http://go-here.nl/
Show me the money Emanuel!
It just seems really lazy of them to not actually bother proving unauthorised content exchange actually occurred. I gather they do things this way because it’s just really efficient for them… nice and profitable, maybe.
BitTorrent’s an open protocol and there’s a load of open source implementations out there that they could be easily modified to help prove unauthorised distribution (I know you know this). All they’d need do is receive a single piece from a peer in a swarm, verify its checksum, then verify that it indeed is a piece of the unauthorised content in question. How hard can it be for these companies to do this? I suspect not hard at all, hence they’re probably just doing the absolute bare minimum they need to to bring the money in.
In Germany they pretend to do that, and the legal claims often refer to a private expertise.
I have seen parts of that paper (which a UK law firm showed in court) that talks about adding a database for recording events to edonkey.
I have never seen claims including actual amount of data shared and speed of sharing, or any substantial proof that could help a NAT operator to pinpoint a misdoer.
So, in my opinion they simply do not care for false accusations – hardly any accused person would risk a lawsuit against a multi-million company
I used to get MPAA takedown notices from my ISP for movies being posted on Usenet. Nobody had made the slightest attempt to actually track the IPs in the news headers. They saw the forged @somewhere.com address, looked up my web address, and fired off a takedown notice to the ISP. Until there are penalties for not making a best effort, this kind of garbage will continue forever.
Its worth pointing out that Video Protection Alliance uses an anti-piracy company called Nexicon http://www.nexiconinc.com to collect data. Some recent articles from Torrentfreak:
– http://torrentfreak.com/automated-legal-threats-turn-piracy-into-profit-090628/
– http://torrentfreak.com/tag/video-protection-alliance/
Looks like the founder/cto is this Tommy Stiansen guy:
– http://www.nexiconinc.com/corpblog
‘I am not arrogant, just very tired of ignorant people that does not have enough knowledge and facts and creativity and imagination to write something actually worth reading’
And so am I….
‘imagine a BANK that does not insall adequit firewalls and security measures’
adequit?
I am sorry to point out that your theory behind the Bitorrent solution is wrong, if you want correct information we are happy to share our technology with you, so that you can bring to light the right facts and not the wrong facts. The irony of your article is that you are doing the same thing yourself as you are accusing copyright enforcement systems for doing. (Not performing all steps of verifiaction in the quest for perfection and utter total accurancy) Pertaining to that, is your analysis and blog as reliable you claim copyright notices would be, your entire thesis and blog is very moot and contradicts itself and reveals your true motive and undermines copyright holders and the whole education system that focuses on carrers within any form of content industry. Here is a thesis for you to grub about in the next years to come: Pertaining to NAT, DHCP, IPV6 and all other issues down that same avenue, let us imagine a BANK that does not insall adequit firewalls and security measures on their internet provided by their ISP, a hacker penetrates their network and does unrepairable harm to their network millions disappear and all other horrible things that hacked does out of pure pleasure. Who’s fault is it that this happened and who is there to blame? The hacker? The bank? The ISP? The laws? The technology? The budget? The firewall manufacturer? The Bank security officer? All the bloggers blogging about it after-the-fact? Let us imagine the feds are to investigate? Due to the world of NAT and DHCP and the fancy ability for people like me to manipulate internet and packets the way we see fit and want concluding from your blog above the feds might as well just put this in the unsolvable pile and move on? No I am not arrogant, just very tired of ignorant people that does not have enough knowledge and facts and creativity and imagination to write something actually worth reading and taking into account as an educational lesson or moral guideline, and actually contribute towards problems and challenges in the world instead of pointing to the line in the sand that others have before and more will in the future! Thanks for reading (my email is posted if something constructive is to be discussed) I also reserve the right to use your blog and content as a good sales point for copyright holders you can send me a DMCA on it also if you can find the right ISP 😛
Can you clarify?
tommy: next time make some substantive counterpoint; 422 words and 0 make any logical argument. don’t forget to check your your spelling and grammar too!
mike: perhaps the only thing you are off on is that this extortionate business model is far from lucrative. you can get a 2 for 1 on shares of tommy’s stock these days: http://finance.yahoo.com/q?s=NXCO.PK
that is 2 shares for 1 penny!
phil
I am sorry to point out that your reply to the blog posting is not only verbose but misguided, wrong and obviously motivated by the fact you’re a cretin.
I reserve the right to use your posting as a example of how a cretin writes and uses the internet.
Let’s consider another analogy in addition to a bank as Tommy S. did – the public library, for example. They distribute millions of copies of copyrighted material daily. Should every reader, every listener, every potential user that walks through their doors be required to pay for anything that they may use? Or, should those works be the exclusive right of the rich? Do the children of the children of any writer in that library need compensation for being born to the right parent – forever? Do Plato’s progeny need to be paid before reprinting any of his thoughts for use in our universities? “Software” has a finite lifetime in this new world, and even that category is expanding, after which, it takes even more creativity to make it pay…
Makes my head hurt just thinking about how the originator can get exclusive rights for a reasonable period of time, for which he can get compensated. After which it becomes public domain. Or is that what’s happening now on the internet? Just thinking…
Imagine the FBI finds an IP in a log. Imagine they find out who it belongs to. Imagine they put the guy in jail for 10 years, right away. And that this is all that happens, and that the log is their only evidence.
Is this the world you want? It seems like it, because *this is the core argument* that the blogger states, and you are denying it!
I think you just found the solution to comment spam. Sign the spam sites up for every skeevy pir8 tracker you can find. Brilliant!
Well, I’m not clear how far this can go, but there are penalties for bad DMCA laims. Perhaps we just need a group that pursues these like the RIAA pursues the claims themselves?
http://news.cnet.com/8301-1023_3-10163337-93.html
What’s more, this particular tracker (denis.stalker.h3q.com) has for a long time been deliberately adding fake IP addresses to create deniability. From their blog post announcing this almost three years ago:
“While we certainly do not encourage anyone to share files they’re not supposed to, we do not feel well being misused as evidence distributors. ,,, So we decided to insert truely random IP addresses from known-to-be-used sub nets into all our answers. … we are sure that this kind of deniability, when adopted by other trackers as well, will force copy right spies to acquire hard evidence against file sharers.”
This was later incorporated into The Pirate Bay’s trackers as well.
Uh.
How many more responses will it take before anyone wonders whether Crosbie Fitch is having them on?
Crosbie Fitch isn’t trolling, he’s just a real douchebag that is in favor of all things short of one hundred years rape as a punishment for file sharing.
Check out his website and his info. Crosbie Fitch is the cancer killing this world.
Crosbie Fitch is anything but. Read his comments at Against Monopoly.
Crosbie Fitch was being sarcastic.
ACTA is already addressing the problem you outline concerning the veracity of evidence.
The change to a graduated response of ‘notice and disconnect’ simply requires a good faith accusation or expression of suspicion that the user of an IP address is engaging in copyright infringement.
In those rare cases that an incorrect IP address is identified for an infringer, the user can gather the evidence that it was incorrect and present it at a tribunal, and, if the evidence is found to be convincing, a judicial appeal process can commence, ultimately resulting in a resumption of the user’s permission to connect via any ISP.
As you observe, the gathering of evidence of is a most straightforward process and will not be a significant burden in those regrettable, but fortunately rare cases.
Actually, proving a negative is neither trivial nor straightforward. How would one prove that they’ve never run a bit-torrent client? The article does not observe that gathering defensive evidence is straightforward: “We’ll leave the discussion about how we might prove such a negative to another day,”
Computer logs won’t help as they aren’t easily authenticated. Also, what if that particular computer has been wiped or scrapped since the supposed infringement?
As an example, one could get the IP address for digitalproductions.co.uk (82.69.2.114) and start sending that to various tracker sites (via spoofing or other methods). This would then be considered sufficient evidence for infringement.
Proving that the server at 82.69.2.114 hasn’t infringed is not easily possible after the fact.
-Perros-
The point of ACTA’s ‘graduated response’ is that ‘notice & disconnection’ is far, far superior to litigation. In exchange for not taking the infringer to court, prosecuting them and having them pay million dollar fines, this way the infringer simply suffers a period of disconnection (and potentially seizure of computer equipment and assets depending upon the severity of the infringement).
This solution is eminently feasible and has the advantage of not overburdening the courts. It also obviates the need for copyright holders to budget for considerable expense in terms of lawyers’ fees. It is after all, the copyright holders’ interests that are at risk here, and their intellectual property that is to be protected from theft..
The minor downside that a few IP addresses will be misidentified is trivially remedied, especially given how easy experts say it is to demonstrate that misidentification has occurred.
As to malicious incrimination of an IP address, I’ve no doubt that possibility has already been considered with particularly appropriate penalties liable.
Don’t forget that many membership organisations will have paid considerable sums on license fees that exempt their members and their sites from this ‘graduated response’. We’re talking here of addressing infringement and other unlicensed use by domestic users and other non-members.
Have you considered that ” a period of disconnection (and potentially seizure of computer equipment and assets depending upon the severity of the infringement)” could leave an innocent person without the means to:
1. Communicate
2. Respond to personal financial matters
3. Prepare the evidence to defend themselves
What if ” a period of disconnection” is over 6 months or more?
Please, Crosbie Fitch, tell me your IP.
How would you like to recieve 15 cease-and-desist letters in a day, and find out that your internet is gone for 6 months? Without ability to prove otherwise? While being treated as a criminal by the police, judges, and everybody else?
As the poster you’re replying to has already pointed out, it’s non-trivial to prove the negative. Can you prove that you weren’t running a BitTorrent client on a particular port a week ago, and that you didn’t send any copyright data over that port without the appropriate license? How would you go about proving such a thing?
We have a judicial system with the eminently sensible “innocent until proven guilty” presumption for a very good reason. A bill that eliminates this in favor of easier enforcement by copyright owners is fundamentally flawed.
May I add that simply running BitTorrent is likewise insufficient to prove anything. I use it mostly to fetch new releases of Fedora (i.e. to make copies authorized by the copyright holder).
To represent that I don’t run BitTorrent in order to restore my internet connection isn’t feasible.
So in my article, I pointed out a few things that the VPA could have done to reduce their false positives:
1. Try to actually connect() to the IP:port
2. Try to see if the peer is speaking BitTorrent and is publicizing the specified file
3. Try to actually download/upload said file with the peer
So #1 would be about 3 lines of code, #2 might be another 10-20 lines, and #3 maybe another 20-50 (depending upon libraries). Certainly not undue cost for these companies. A single server could also be used to test millions of IP addresses. (One might argue that clients could blacklist that server’s IP address. If that’s the case, trackers could do the same blacklisting to prevent said IP from crawling it…)
Notice I never argued against this type of “graduated” response in my article. I did argue, however, that agencies should actually engage in some reasonable practices to reduce false positives. I also feel strongly that when they contact ISPs, they should at least be required to show some logs to demonstrate that the peer was involved in BitTorrent.
Right now, the onus is on accused peers to demonstrate they were *not* infringing copyright, as opposed to companies demonstrating that they were. Unsubstantiated accusation is deemed to be 9/10th of the law.
You’re absolutely right. If simple precautions can be taken to avoid false positives then these should certainly be taken. The publishing industry has no interest in alienating its customers, and every intention of rewarding them with the highest quality content they deserve, as well as in turn rewarding the talented professionals who produce that content. This keen interest in rewarding custom and talent demonstrates that considerable pains will be taken to restrict moderate and fair penalties to those infringers who have for so long stolen rather than paid for other people’s hard work.
“This keen interest in rewarding custom and talent demonstrates that considerable pains will be taken to restrict moderate and fair penalties to those infringers who have for so long stolen rather than paid for other people’s hard work.”
How does one follow from the other? Even if we assume that the content industry has everyone’s best interests at heart, why would they have any desire to reduce penalties, or even any incentive to avoid false positives? Whatever avenue they think will yield the highest profits is the one they’ll pursue.
You say, “The publishing industry has no interest in alienating its customers…”
Then why do you do it on a daily basis? Why do you pay 60 Minutes to do a propaganda piece where it starts out talking about organized crime and then segueways straight into file sharing without differentiating the two?
I’m 46 years old and you have alienated me. And I guarantee you have lost a whole generation younger than me. Even if you win, you have already lost.
Your failure to address the technical failures outlined in this article prove that you have no interest in putting forth a good faith effort, which alienates even more potential customers.