Researchers uncover the full scale and weaknesses of the monitoring of illegal file sharers

Research by computer scientists at the University of Birmingham has found that the monitoring of online file sharing is more prevalent than previously thought. They also conclude that in many cases, the evidence gathered through monitoring is not admissible in court. This research will be presented tomorrow at the SecureComm Conference in Padua.

To provide legal evidence of file sharing, a monitoring company must make a direct connection to a suspected file sharer and log their activity. This three-year study is the first to look at the behaviour of monitors that make direct connections.

The researchers' findings include:

Massive monitoring of all of the most popular illegal downloads from the PirateBay has been taking place over the last 3 years.
On average an illegal file sharer, using BitTorrent to download the most popular content, will be connected to and have there IP address logged within 3 hours of starting a download.
Poor collection methods mean the evidence collected by monitors may not stand up in court.

The research was carried out by developing software that acted like a BitTorrent file sharing client, and logged all the connections made to it. Careful analysis of the logs revealed the presence and behaviour of file-sharing monitors.

Most large-scale monitors hide their identity by using third party hosting companies to run the searches for them, but other monitors are identifiable as copyright enforcement organisations, security companies and even government research labs. The researchers also found that the use of third party hosting companies allowed the monitors to avoid 'block lists',that attempted to stop known monitors from connecting to file sharers.

Dr Tom Chothia, researcher at the University of Birmingham's School of Computer Science, says, "This work reveals the full scale of the monitoring of illegal file sharers. Almost everyone that shares popular films and music illegally will be connected to by a monitor and will have their IP address logged. What is done with this information in the long term only time will tell".

With the number of prosecutions of file sharers increasing there is a legitimate concern of the standard of evidence used in these cases.  Dr Chothia continued: 'All the monitors observed during the study would connect to file sharers believed to be sharing illegal content and verify that they were running the BitTorrent software, however they would not actually collect any of the files being shared. Therefore, it is questionable whether the monitors observed would actually have evidence of file sharing that would stand up in court.'

This work was carried out by Tom Chothia, Marco Cova, Chris Novakovic, and Camilo Gonzalez Toro at the University of Birmingham's School of Computer Science.

Provided by University of Birmingham