Illegal fire-sharers tapped directly by 'monitors'

 

Four in ten log IP address within three hours.

File sharers that use BitTorrent to illegally download popular content could expect to have their IP address logged by a monitoring agency within three hours of starting a download, according to University of Birmingham researchers.

The researchers presented findings from a 3-year study (pdf) aimed at detecting instances and the frequency of copyright enforcement agencies using direct monitoring techniques to collect "first-hand evidence of a peer's [BitTorrent] activity".

Past research had focused mainly on indirect monitoring, where "enforcement agencies rely on indirect clues that a peer is uploading or downloading some content i.e. by the presence of the peer's IP address in the ... swarm of peers reported by a BitTorrent tracker to be sharing the file".

"Forty percent of the monitors that communicated with our clients made their initial connection within three hours of the client joining the swarm; the slowest monitor took 33 hours to make its first connection," the researchers noted in the study.

"The average time decreases for torrents appearing higher in the Top 100 [torrents], implying that enforcement agencies allocate resources according to the popularity of the content they monitor."

Researchers created software that emulated a BitTorrent file sharing client, and logged all connections made to it.

They initially tried to mask their identity using Tor but excessive dropped connections forced them to redo the research.

"Careful analysis of the logs revealed the presence and behaviour of file-sharing monitors," the researchers said.

The study measured the activity of "1033 swarms across 421 trackers for 36 days over two years, collecting over 150GB of BitTorrent traffic", researchers said, though they noted they were "careful not to upload or download any shared files", avoiding any potentially infringing activity themselves.

It found "massive monitoring of all of the most popular illegal downloads from the Pirate Bay".

Some monitors caught by the study were known. Others hid their identity using third-party hosting firms or were companies that did not publicly acknowledge having BitTorrent tracking operations.

Using third party hosting companies "allowed the monitors to avoid 'block lists',that attempted to stop known monitors from connecting to file sharers", the researchers noted.

The researchers used their results to question whether evidence collected by monitors would be admissible in court proceedings.

Copyright © iTnews.com.au . All rights reserved.


Illegal fire-sharers tapped directly by 'monitors'
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1793

Vote
Do you support the abolition of the Office of the Information Commissioner?