This week an eye-catching post made the rounds on X.
The video is about an IP trolling for legal extortion scheme, but also includes a surprising twist about Meta allegedly using illegally downloaded porn to train its models. I will look at the Muse guy differently from now on.
Thankfully the compelled revelation of IP addresses is more relevant to our work so I can focus on that today. The scheme works as follows:
Strike3 Holdings is an adult film company that owns many of the largest brands in the business. As the producer, it owns the rights to a huge number of adult videos. It monitors BitTorrent for sharing of its videos. When it identifies one being shared, it files a lawsuit against “John Doe” and has the court subpoena ISPs for the names and addresses associated with IP addresses that downloaded the file.
Now the company has someone’s name and a list of potentially embarrassing files associated with them. The company sues, and the person, often enough to make the enterprise profitable, chooses to settle out of court for fear of their private interests becoming public.
Judge Royce Lamberth didn’t mince words when calling the business extortionate:
Little wonder so many defendants settle. Indeed, the copyright troll‘s success rate comes not from the Copyright Act, but from the law of large numbers. According to PACER, over the past thirteen months, Strike 3 has filed 1849 cases just like this one in courts across the country—forty in this district alone—closely following the copyright trolls who together consumed 58% of the federal copyright docket in 2015. These serial litigants drop cases at the first sign of resistance, preying on low-hanging fruit and staying one step ahead of any coordinated defense. They don‘t seem to care about whether defendant actually did the infringing, or about developing the law.
There are a few issues here. For one thing, IP is an imperfect system for proving who exactly committed the alleged offense. A few months ago, Strike3 Holdings stunned a South Florida grandma by suing her for allegedly downloading 26 of their videos. As she puts it, “It certainly wasn’t me because I’ve never been on a pornographic site.” She has the confidence to go public with her story and fight. Many others do not.
This goes beyond adult content. When the Southern District of New York sought to establish jurisdiction in a case on alleged misconduct using the Ethereum blockchain, it reached for the same power.
Setting aside the absurdity of the claim that anyone running a validator for a blockchain in your district gives you jurisdiction over anyone using that blockchain anywhere in the world, a topic we will give the thorough treatment it deserves soon, the method is concerning. It’s an even deeper issue still: just how readily available these bulk IP collection and unmasking demands are.
Etherscan publicly shares a list of IP addresses associated with nodes.
Was SDNY able to subpoena Verizon to get real names and addresses of all customers running a node in its district? How will they use that data in the future? Are they securing it adequately?
I’m also struck by the fact that Strike3 Holding’s targets were at least supposedly doing something illegal to get unmasked. Node operators are not. Why were they revealed?
Even this story is marked by the imprecise nature of IP for identifying a person doing a particular activity. Dylan’s story begins with his roommate being identified as the one running the validator and being contacted by SDNY because he was the one who set up the account initially. I’m sure the roommate got scared by the scary email he received. Imagine if it was from Strike 3 Holdings.
This reminds me of a recent ransomware wave. The target would receive an email claiming that hackers had been able to access their webcam while they were on an adult site and threatened to release the footage. It was a bluff. But, as most of my friends’ go-to guy for crypto, I got a few panicked calls and messages from people I hadn’t heard from in ages. It was fake that time, but more recently malware that actually does use your webcam for this purpose has been discovered.
What Strike3 Holdings does is obviously much less extreme but it preys on the same fear–that our most intimate habits may become known. - Neeraj
What else we’re reading:
This one is particularly interesting to us. We have covered GrapheneOS before.
Here’s what Peter had to say about that. Knowing now that the allegations were a ruse makes his point even more important:
Agents invoked the most morally repugnant accusation available. But if you think the moral turpitude of an accusation should override procedural checks on police when apprehending Americans, then you do not understand American values. Constitutional protections matter most when the government’s accusation makes them unpopular.
FinCEN’s Financial Surveillance of Real Estate Transactions - Pacific Legal Foundation
If you found this interesting, please subscribe or share. It helps us grow.