Illegal fire-sharers tapped directly by 'monitors'

File sharers that use BitTorrent to illegally download popular content could expect to have their IP address logged by a monitoring agency within three hours of starting a download, according to University of Birmingham researchers.

The researchers presented findings from a 3-year study (pdf) aimed at detecting instances and the frequency of copyright enforcement agencies using direct monitoring techniques to collect "first-hand evidence of a peer's [BitTorrent] activity".

Past research had focused mainly on indirect monitoring, where "enforcement agencies rely on indirect clues that a peer is uploading or downloading some content i.e. by the presence of the peer's IP address in the ... swarm of peers reported by a BitTorrent tracker to be sharing the file".

"Forty percent of the monitors that communicated with our clients made their initial connection within three hours of the client joining the swarm; the slowest monitor took 33 hours to make its first connection," the researchers noted in the study.

"The average time decreases for torrents appearing higher in the Top 100 [torrents], implying that enforcement agencies allocate resources according to the popularity of the content they monitor."

Researchers created software that emulated a BitTorrent file sharing client, and logged all connections made to it.

They initially tried to mask their identity using Tor but excessive dropped connections forced them to redo the research.

"Careful analysis of the logs revealed the presence and behaviour of file-sharing monitors," the researchers said.

The study measured the activity of "1033 swarms across 421 trackers for 36 days over two years, collecting over 150GB of BitTorrent traffic", researchers said, though they noted they were "careful not to upload or download any shared files", avoiding any potentially infringing activity themselves.

It found "massive monitoring of all of the most popular illegal downloads from the Pirate Bay".

Some monitors caught by the study were known. Others hid their identity using third-party hosting firms or were companies that did not publicly acknowledge having BitTorrent tracking operations.

Using third party hosting companies "allowed the monitors to avoid 'block lists',that attempted to stop known monitors from connecting to file sharers", the researchers noted.

The researchers used their results to question whether evidence collected by monitors would be admissible in court proceedings.