Omnify: Investigating the Visibility and Effectiveness of Copyright Monitors

Abstract

Abstract. 1The arms race between copyright agencies and P2P users is an ongoing and evolving struggle. On the one hand, content providers are using several techniques to stealthily find unauthorized distribution of copyrighted work in order to deal with the problem of Internet piracy. On the other hand, P2P users are relying increasingly on blacklists and anonymization methods in order to avoid detection. In this work, we propose a number of techniques to reveal copyright monitors' current approaches and evaluate their effectiveness. We apply these techniques on data we collected from more than 2.75 million BitTorrent swarms containing 71 million IP addresses. We provide strong evidence that certain nodes are indeed copyright monitors, show that monitoring is a world-wide phenomenon, and devise a methodology for generating blacklists for paranoid and conservative P2P users.

The Unbearable Lightness of Monitoring: Direct Monitoring in BitTorrent

“…We only disclose the identity of copyright enforcement agencies that have publicly announced that they are monitoring BitTorrent. Following previous work in this area (e.g., [18]), we indicate Autonomous Systems (ASes) that appear to host large numbers of monitors, but we do not disclose individual ranges inside an AS.…”

“…Potharaju et al [18] offer a blocklist generation technique for BitTorrent based on peers' participation in multiple swarms sharing the same content, arguing that simultaneously downloading multiple copies of the same content is suspicious. The blocklist approach only prevents direct monitoring and it is only effective if reliable techniques exist for identifying monitors.…”

“…As with previous studies in this area, we do not take a side in this arms race: the results we present could benefit both users (e.g., by improving the detection and blocking of monitors) and copyright enforcement agencies (e.g., by improving monitoring techniques). Furthermore, it has been noted previously [18] that the monitoring process used by copyright enforcement agencies may wrongly implicate researchers performing experiments in BitTorrent swarms. The features we present may enable them to design more conservative research experiments or to better interpret their results.…”

“…Monitoring agencies may use a large proportion of their subnet for monitoring. Features 1-4 have been suggested by Siganos et al [20] and Piatek et al [17], and feature 5 by Potharaju et al [18]. Potharaju et al also leverage web search engines to derive a database of the content being shared by each torrent, and look for peers that download multiple copies of the same content.…”

“…The study also demonstrated the high rate of false positives caused by this approach by implicating innocent devices such as printers and wireless access points as file-sharers, which later received cease-and-desist letters. More recent studies have confirmed that these flawed practices continue to be used [6,18].…”