The War on Illicit File Sharing

By Eric A. Packel

he Pirate Bay case in Sweden was seen as a dramatic blow to the sharing of copyright protected material via the . The TPirate Bay web site was infamous for providing an index of links for a peer-to-peer (P2P) file-sharing application called BitTorrent, which allows users to share TV shows, movies and music. Of course, much of the shared digital material infringed on copyrights.

Illustrations by Wesley Terry n April 2009, a Swedish court found three Pirate During the proceedings, Comcast finally confessed that it did Bay administrators guilty of copyright infringement, intentionally interfere with P2P traffic. But Comcast claimed sentencing them to a year in prison and more than $3 that it did this as a form of reasonable network management, I million in fines. The site administrators had flagrantly in order to relieve congestion on its network from the heavy ignored takedown letters sent by copyright holders’ lawyers, P2P traffic. and posted obscene retorts on the Web. Thus, it was easy for In a lengthy opinion issued on Aug. 20, 2008, the FCC found the court to find that the administrators knew of copyright that Comcast violated rules by selectively infringement and intentionally did nothing about it. blocking P2P connections, including the BitTorrent protocol. Naturally, the Pirate Bay case will not end file sharing. Comcast’s practices were deemed to discriminate among Internet service providers (ISPs) continue to grope with the applications and protocols, rather than treating all equally. ramifications of P2P traffic traveling through their networks. Further, the FCC found that Comcast monitored its Powerful new tools being marketed to ISPs can monitor and customers’ connections and terminated P2P uploads, regardless track this traffic, but these tools may also open the door to net of the level of network congestion, by sending forged “reset” neutrality, privacy and other concerns, thus subjecting ISPs to packets to each computer. In layman’s terms, the FCC said further government oversight and perhaps fines and/or civil “Comcast opens its customers’ mail because it wants to deliver liability. mail not based on the address or type of stamp on the envelope At the same time, there is mounting pressure from the but on the type of letter contained therein.” recording industry and the film industry Comcast escaped an FCC fine because to have ISPs act as the Internet police to it made a commitment during the monitor customers and detect copyright proceedings to end such practices by infringement. This puts ISPs in a difficult year’s end. Comcast promised to institute situation where they are walking a fine a “protocol agnostic” means of network line between their subscriber’s interests in management, a method of managing unfettered Internet access, or proactively Where in the past network congestion and distributing protecting the interests of copyright bandwidth to users that is not based on holders, as well as managing their own an ISP generally targeting any particular type of file or networks. provided a application (such as P2P applications), but is instead based on overall bandwidth Comcast Runs Afoul gateway to the consumption. In other words, identifying of the FCC individual high bandwidth users based on Internet, an ISP their network usage (not the content being In May 2007, Comcast customers began used) and temporarily throttling the flow to notice something strange. Suddenly, can now analyze of data to those heavy users during times transfers of BitTorrent files were slowing exactly what is of congested network traffic. The FCC’s to a crawl, if not stopping altogether. Users order required Comcast to disclose its complained that Comcast was throttling passing through network neutrality compliance plan by BitTorrent traffic. the end of 2008. Comcast eventually At first Comcast denied that it was its network. did announce such a plan, but is also behind the problems. Then the Associated appealing the FCC’s decision. Press and others conducted tests that appeared to verify the complaints. In Deep Packet fact, the AP confirmed the complaints by Inspection attempting to transfer the Bible, which is not protected by copyright. So how did Comcast manage to “open its customers’ mail” These revelations eventually led to a formal complaint filed and thereby step in a Net Neutrality minefield? Somewhat with the FCC, which sought to force Comcast to comply with buried within the FCC’s opinion was the disclosure that the FCC’s 2005 Internet Policy Statement, also known as the Comcast used (DPI) equipment Net Neutrality rules. to monitor its customers. Although the very name of the The Policy Statement provides, in relevant part: technology sounds menacing, it is now increasingly utilized by ISPs for various purposes. • To encourage broadband deployment and preserve and Communication between computers over the Internet is promote the open and interconnected nature of the public based on sending and receiving bits of information called Internet, consumers are entitled to access the lawful packets. Typically, an ISP’s routing equipment would read Internet content of their choice. only the header portion of a packet, which provides the sender • To encourage broadband deployment and preserve and and recipient information, analogous to the envelope of an old promote the open and interconnected nature of the public fashioned letter. Internet, consumers are entitled to run applications and Now, with DPI technology, service providers can also scan use services of their choice, subject to the needs of law the data or payload portion of the packet. This is akin to the enforcement. post office opening a letter. An ISP can read its customers’

38 the philadelphia lawyer Spring 2010 packets and determine the content, be it under the Wiretap Act, may depend on Safe Harbors videos, music or e-mails. Expensive DPI how DPI is implemented in a particular Another DPI concern for ISPs may equipment provides this functionality case. If an ISP simply determines the be the protection currently enjoyed on vast quantities of information general type of traffic, but not the under the safe harbor provisions of speeding through a network, all in the substance, it may not be deemed to the Digital Millennium Copyright Act blink of an eye. intercept its contents. However, a (DMCA). The DMCA grants immunity This is a fundamental change in the more granular packet analysis to allow to “innocent” service providers for nature of ISPs. Where in the past an ISP filtering of suspected illegal content copyright infringement liability, where generally provided a gateway to the could potentially bring on thorny issues the service provider does not have Internet, an ISP can now analyze exactly under the Wiretap Act. actual or constructive knowledge of what is passing through its network. As copyright infringement and where a result, depending on how it chooses TKMQ Ad 4.625x7.375-2:Layout 4 2/25/10certain 9:26 threshold AM Page requirements 1 are met to implement DPI, ISPs can prioritize traffic, block traffic, police for illegal or simply undesirable material and even allow for directed advertising. But as Comcast found, this new role comes with significant risks. Philly has a new Celebrity. A powerful and startling Interception of He's a Killer. indictment of America’s Communications fascination with celebrity killers from a fresh new In addition to Net Neutrality concerns, voice in fiction, Philadelphia DPI could also potentially implicate the attorney Jeffrey A. Cohen. federal Wiretap Act, which prohibits both the intentional interception of electronic communications, and the “The Killing of Mindi Quintana disclosure or use of the contents of such inspires some compelling intercepted information. comparisons: to Dostoevsky’s A key issue under the Wiretap Act Crime and Punishment, Joseph is whether the information intercepted Heller’s Catch-22 and Law & includes the “contents” of the Order: Criminal Intent. The crime communication. This is defined as “any at the heart of the story is brutal, information concerning the substance senseless, sensational.The . . . or meaning” of an electronic investigation absorbing, communication. In general, the term frustrating.The writing is crisp “contents” has excluded addressing and, by turns, romantic and wry. or routing information (such as the But this is a novel about people packet header information traditionally caught up in a complex tragedy scanned by ISP routing equipment). of expectations and contradic- Courts have concluded that “contents” tions, and it’s more than includes the text of e-mails, subject lines memorable – it’s haunting.” of e-mails and bank account numbers. David Bradley, author of Perhaps less obvious is the conclusion The Chaneysville Incident by some courts that search queries (winner PEN/Faulkner and other user-generated information, Award) even if only seen in the URL (Uniform Resource Locator) of the Web page found by the search query, can be Jeffrey A. Cohen is a writer, trial attorney and technology entrepreneur defined as “contents” under the Wiretap who was born and raised in Philadelphia. A 1988 graduate of the Law Act. Thus where captured information School of the University of Pennsylvania, Jeffrey specialized in appellate included search terms associated with and corporate litigation before entering the business world, and now the user’s medical condition, the First writes full time. Circuit found In re Pharmatrak Privacy Litig., 329 F.3d 9 (1st Cir. 2003) that The Killing of Mindi Quintana is published by Welcome Rain Books and is available in “contents” of the communication were bookstores or online at Amazon.com and BarnesandNoble.com. intercepted. Thus, whether DPI will result in an Visit JeffreyACohenBooks.com for more information about the book and author, including an up-to-date schedule of author appearances in Philadelphia and elsewhere. ISP being subject to potential liability

the philadelphia lawyer Spring 2010 39 by the provider. who heads the House Subcommittee on Communications, Much of the DMCA is premised on a service provider being Technology and the Internet, held hearings on the implications protected if it does not know of the infringement. In fact, of DPI. Boucher is now pushing for a broad online privacy law. the 9th Circuit held in Perfect 10, Inc v. CCBill LLC, 488 In an April 23, 2009 hearing, Boucher stated that it is alarming F.3d 1102 (9th Cir. 2007) that a service provider could lose that providers can “track a user’s every move on the Internet, immunity under the DMCA if it fails to take action when “it record the details of every search and read every e-mail.” is aware of facts or circumstances . . . from which infringing activity is apparent.” Summing Up the Legal Pitfalls Of course, the whole point of DPI is to gain knowledge of the content of electronic communications. Thus, if a service Although DPI implementation can have many benefits for provider used DPI in a way such that it could be deemed to ISPs, service providers need to be wary of the potential for have actual knowledge of copyright infringement after a DPI opening the door to legal liability. ISPs should be mindful analysis, yet does not act expeditiously, it could theoretically of precisely how their engineers intend to use the flood of lose the safe harbor protections under the DMCA. information available via DPI. Otherwise, the risks include: Indeed, since many ISPs now commonly provide auxiliary services, such as web site and e-mail hosting, such content • Violating Net Neutrality Rules and possible FCC fines. may not just pass through its network, but reside within. Thus, an ISP utilizing DPI might be hard pressed to argue it did not • Liability under the Wiretap Act (both criminal and have actual knowledge, which voids a safe harbor for stored civil) content. • Voiding of “safe harbors” under the DMCA (copyright Privacy Concerns infringement claims)

Naturally, DPI also presents significant privacy concerns. • Invoking privacy concerns (drawing further regulatory In fact, the use of DPI by ISPs has not gone unnoticed by attention and consumer backlash). lawmakers, particularly in the wake of revelations from the controversial warrantless program instituted after Whether DPI will lead to more government regulation of 9/11. ISPs is by no means certain. However, it would be prudent for The AT&T whistleblower who revealed the secret room ISPs to be aware of the various legal risks and likely consumer where the government was allowed to tap into essentially the wrath inherent in the use of DPI. Comcast and AT&T have entire Internet, confirmed that AT&T used DPI equipment to already faced additional scrutiny relating to DPI. More assist the National Security Agency. This equipment included troubled waters for ISPs may lie ahead. a Narus STA 6400, which according to a report in Wired magazine, “captures comprehensive customer usage data . . . Eric A. Packel ([email protected]) is an associate in the provid[ing] complete visibility for all Internet applications.” Technology, Media & Intellectual Property practice group at Marshall, Recently, Congressman Rick Boucher, a Virginia Democrat Dennehey, Warner, Coleman & Goggin.

40 the philadelphia lawyer Spring 2010