Thursday, May 27, 2021

TorrentFreak's Latest News

 

OpSec Says DMCA Notice System Was "Spoofed" To Target Ubuntu Download
Andy Maxwell, 27 May 07:52 PM

UbuntuYesterday we reported that Reddit user NateNate60 had received a DMCA notice, apparently from Comcast, declaring that he'd breached copyright law by downloading and sharing a legal copy of Ubuntu.

"We have received a notification by a copyright owner, or its authorized agent, reporting an alleged infringement of one or more copyrighted works made on or over your Xfinity Internet service," the posted notice reads.

"The copyright owner has identified the IP address associated with your Xfinity Internet account at the time as the source of the infringing works," it continues, adding that NateNate60 should search all of his devices connected to his network and delete the files mentioned in the complaint.

According to the Xfinity notice, the sender was OpSec Security so to find out more we contacted the anti-piracy company for an explanation. That came in late last night and while it provides some answers, it also raises even more questions.

OpSec: Our Anti-Piracy System Was "Spoofed"

In a response from OpSec Marketing Communications Manager Amanda Hershey, the company explained that the notice was malicious and was sent to damage its reputation.

"OpSec Security's DCMA [sic] notice sending program was spoofed on Wednesday, May 26, 2021 by unknown parties across multiple streaming platforms," Hershey explains.

"The content in question all appears to be Ubuntu Linux ISO. We have incontrovertible evidence that proves these DMCA notices were not perpetrated by or originated with OpSec Security."

Why OpSec references "multiple streaming platforms" is unclear. People do not 'stream' Ubuntu packages, they download them – in this case via torrents distributed by Ubuntu's own tracker. And while OpSec says it has "incontrovertible evidence" that shows the DMCA notices were not sent by the company, it is yet to reveal details in public.

"OpSec's enforcement efforts are occasionally spoofed by a third party in an attempt to damage OpSec's reputation. These attempts are easily identifiable, and easily disproven," the company explains.

While the security company says that third parties are "spoofing" its system, it does not explain how that was possible. And, at least in this case, the bad DMCA notice was apparently not "easily identifiable", since it clearly managed to cause confusion. So how did this happen?

Inside Information Acquired?

In our initial report we noted that it's not impossible for someone to fake a DMCA notice. In this case, however, it is difficult to dovetail events on the ground and the statement from OpSec because a certain amount of more difficult-to-acquire information would be needed to be this targeted.

Firstly, NateNate60 says he did download the content in question after obtaining a torrent directly from Ubuntu's own tracker. That would, of course, expose his IP address both to the tracker and everyone else sharing the content. However, in order to send the DMCA notice via email (whether that was from Comcast or a spoofed email address purporting to be Comcast), anyone obtaining NateNate60's IP address would necessarily need his email address too.

This raises the question of how that email address was obtained. OpSec Security wouldn't ordinarily have it, neither would the alleged malicious party, but Comcast clearly would. That's how DMCA notices sent to ISPs work. The sender doesn't know the contact details of the alleged infringer so they ask someone who does to forward the notice, in this case, Comcast.

So, if we take OpSec's statement at face value, at least in theory a third-party could've tricked Comcast into sending the notice after "spoofing" OpSec's "notice sending program". This raises more questions.

If these allegedly malicious efforts to undermine OpSec's reputation are "easily identifiable, and easily disproven", how was Comcast not put on alert? And if this has happened before as the company claims, why hasn't the loophole been closed?

In any case, the allegedly malicious third-party would also need to know how to contact Comcast in a convincing manner, in order to masquerade as OpSec. It's not easy to determine how that could be achieved without knowing how OpSec usually communicates with Comcast. This could be explained if OpSec's system had been hacked or illegally accessed in some way, but the company does not use that terminology, instead going with the term "spoofed", i.e imitated, not compromised.

Furthermore, even if we adopt the scenario that Comcast didn't send the email and it was a spoofed fake, how did the sender a) discover NateNate60's IP address, b) the exact time he downloaded the torrent, and c) manage to match that IP address to his email address? It sounds like a lot of effort simply to tarnish OpSec's name, especially since there was no guarantee that NateNate60 would ever publish the notice online.

Both OpSec and Canonical Say They Are Taking Action

While OpSec's statement is helpful to an extent, it clearly raises even more questions. We have put these questions to the security company and will publish an update when it responds. In the meantime, OpSec says the matter is now being escalated.

"We are notifying the appropriate authorities about this incident," OpSec says.

Ubuntu owner Canonical says it has launched its own investigation.

From: TF, for the latest news on copyright battles, piracy and more.

Cox Appeals $1B Piracy Liability Verdict to 'Save the Internet'
Ernesto Van der Sar, 27 May 09:00 AM

Late 2019, Internet provider Cox Communications lost its legal battle against a group of major record labels.

Following a two-week trial, a Virginia jury held Cox liable for its pirating subscribers. The ISP failed to disconnect repeat infringers and was ordered to pay $1 billion in damages.

Heavily disappointed by the decision, Cox later asked the court to set the jury verdict aside and decide the issue directly. In addition, the company argued that the "shockingly excessive" damages should be lowered. Both requests were denied by the court, which upheld the original damages award.

Despite the setbacks, Cox isn't giving up. The company believes that the district court's ruling isn't just a disaster for Internet providers. If it stands, the verdict will have dramatic consequences for the general public as well.

Cox Files Appeal Brief

This week the ISP submitted its opening brief at the Court of Appeals for the Fourth Circuit, hoping to reverse the lower court's judgment. The filing begins by placing the lawsuit in a historical context.

"The music industry is waging war on the internet," Cox's lawyers write. First, the music companies went after thousands of file-sharers and software companies such as Napster. When those tactics didn't deliver the desired result, Internet providers became a target.

"So, 15 years after Napster, the music industry launched an aggressive new strategy: Attack the internet itself, suing the internet service providers — the cable and phone companies, like Defendant Cox Communications, that deliver the internet."

How to Handle Repeat Infringers

The entire dispute revolves around the legal obligations Internet providers have when it comes to pirating subscribers. According to the law, ISPs must adopt and reasonably implement a policy that allows them to terminate the accounts of repeat infringers in appropriate circumstances.

According to the music companies, this means that ISPs should terminate accounts after rightsholders send several infringement notices, regardless of the circumstances.

However, Cox and other ISPs have historically been very hesitant to disconnect subscribers, in part because they believe it's 'not appropriate' to disconnect entire companies or households from the Internet. Cox reiterates this stance in its appeal brief.

Impossible Spot

"The legal rules Plaintiffs advocate put ISPs in an impossible spot. ISPs will have to boot entire households or businesses off the internet— cutting their lifelines, their livelihoods, and their social connections— based on a few isolated and potentially inaccurate allegations.

"Or they will have to invade our privacy by developing new capabilities to monitor our internet usage 24/7 to ferret out illegal activity. The internet will never be the same," Cox adds.

This doesn't mean that Cox simply ignored piracy. The company was actually one of the first US ISPs to implement its own 'graduated response' system to address copyright infringers. According to the music companies, however, these warnings and temporary disconnections were not good enough.

According to Cox, the district court and the jury were wrong to side with the record labels for a variety of reasons.

Vicarious Infringement

The first argument is that an ISP should not be held vicariously liable for pirating subscribers when it doesn't directly profit from this activity.

"Cox receives no 'direct financial benefit' from infringement. Its subscribers pay the same flat fee for internet services whether they infringe or not. Subscribers are in no sense acting in Cox's financial interest by downloading songs," Cox writes.

Adding to that, the ISP stresses that it can't control or supervise its six million subscribers. Blocking or policing infringing activity is impossible, which also weighs against vicarious liability.

Contributory Infringement

The contributory liability verdict should be overturned as well, according to Cox. The district court was wrong to conclude that past infringement notices gave Cox enough reason to believe that subscribers would pirate again in the future.

Separately, Cox argues that the district court was wrong to conclude that the ISP 'materially contributed' to pirating activities simply because people can use Internet access that way.

"That means Cox cannot be liable based on 'generalized knowledge' that people infringe on its network; instead, Plaintiffs had to prove Cox knew of the 'specific instances of infringement' for which it was being held liable."

Excessive Damages

In addition to overturning the vicarious and contributory liability verdicts, Cox also argues that the $1 billion damages award was wrong. This figure covers thousands of works that should not have been counted and is many times higher than the actual harm.

"The district court's errors have resulted in an award of historic proportions. The $1 billion judgment is entirely untethered from both the harm it caused —$692,000 in displaced downloads — and Cox's culpability."

Cox says it didn't directly infringe any of the music tracks, nor did it encourage anyone to infringe. Its liability rests on the decision to keep subscribers connected longer than the music companies liked.

The ISP hopes that the Court of Appeals will reverse or vacate the district court ruling. If not, the consequences will be devastating.

"If sustained, this judgment would elevate the interests of the music industry over those of ordinary, and often blameless, people who depend on the internet. The consequences will be devastating," Cox concludes.

—-

A copy of Cox's opening brief, filed at the Court of Appeals for the Fourth Circuit, is available here (pdf).

From: TF, for the latest news on copyright battles, piracy and more.

 
 
Powered by Mad Mimi®A GoDaddy® company

No comments: