On occasion, however, usually as a result of a court case, the veil is lifted and the general public is given a taste of the kind of subterfuge employed by those operating the servers behind The Scene, the so-called ‘Topsites’. A 2012 case in Finland provided one such intriguing example.

It involved a topsite known as Hayabusa / Rainbow (HBR / RBW), which was used by famous movie and TV show release groups including MEDiEVAL and DoNE. The topsite only had about 50 members and was reportedly kept running by just four individuals. How they did so was fascinating.

Three of the men, who worked for a pair of Finnish Internet service providers, were employed in positions that enabled them to not only run but hide the site. The site’s servers were installed by employees of Saunalahti, a company owned by Finnish ISP Elisa. The topsite itself was run from the IP address of a man from Helsinki, who worked for Elisa and had access to their fastest fiber connections.

Then the really clever bit. As employees of Elisa the topsite operators were able to modify the ISP’s network monitoring software in order to hide the existence of their topsite. Unfortunately, however, the police were already on their trail following claims that they had illegally distributed copies of movies including The Bourne Ultimatum, Spiderman 3 and Ratatouille. Despite receiving a timely tip-off, the operators were eventually arrested.

During a 2012 trial at the Espoon District Court the site operators stood trial for copyright infringement offenses. Three were handed suspended jail sentences ranging between four and six months and ordered to pay compensation. A fourth received a fine equivalent to 60 days pay.

That said, things could have been worse. Rightsholders had originally demanded 70,000 euros, so a compensation award of 1,000 euros against the soon-to-be-jailed operators was a relative drop in the ocean. However, the entertainment companies behind the action, headed by anti-piracy group CIAPC/TTVK, aired their dissatisfaction by taking the case to appeal.

This week the Helsinki Court of Appeal handed down its decision and it’s yet more bad news for the site operators. The court increased the amount awarded by the district court from 1,000 euros to 22,000 euros.

“The District Court had sentenced three operators to pay about 1000 euros as compensation for the right holders. The Court of Appeals regarded this as a remarkably low amount of compensation with regard to the specific features of the case,” CIAPC Deputy Director Jaana Pihkala informs TorrentFreak.

Although the amount was considered low, fortunately for the defendants the rightsholders’ claim for more than 72,000 euros was not accepted in its entirety.

“One of the facts that the Court took into consideration as lowering the amount of compensation was that the operators had limited possibilities to control how much the works were copied,” Jaana explains.

The Court of Appeal also said that the claim, which was based on items to be found in the physical domain (DVDs etc), did not directly relate to items which had been electronically created and distributed in the online world. Lower cost of production and distribution meant a lower damages award.

While overturning the District Court’s ruling on compensation, other issues relating to the original sentencing remained untouched as the prison sentences of the defendants were not appealed by the entertainment companies.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

These sites often develop into a source from where all kinds of unauthorized digital media cascade down into the public Internet and file-sharing networks such as BitTorrent.

Complaints were filed in September 2007 by rightsholders of a wide range of content and two months later the site was busted by authorities in Oulu, Finland. They discovered a network of 15 servers containing large quantities of movies, music (170,000 tracks on one server alone), TV shows, video games and software, plus books and other content.

More than 5.5 years later and six men were on trial for their alleged activities on the topsite between January 2006 and November 2007. It was to be the largest case of its type in Finland’s history.

Rightsholders, represented by Pirate Bay-nemesis anti-piracy group CIAPC (known locally as TTVK), said that the individuals running the Angel Falls topsite had caused immense damage to their business. They entered claims for damages totaling 6 million euros, of which 900,000 euros was submitted by Microsoft alone.

The Oulu District Court heard that the topsite was well-organized, with tasks spread between the defendants in order to create an efficient file-sharing system. In addition to international material, Angel Falls was said to have specialized in local content and during 2006 carried copies of nearly all domestically produced movies and artist discographies.

Yesterday the Court handed down its ruling. A 32-year-old man, said to be the founder of the topsite, was handed a six month suspended prison sentence. Two others, also in their early thirties, we given four month suspended sentences. A third received a sentence of 50 days. Two others were found not guilty.

Although the rightsholders involved in the case are pleased that convictions were achieved, they appear somewhat disappointed with the damages award handed down by the Court. Their collective claims amounted to around six million euros but the Court felt that 45,000 euros was an appropriate amount.

“We are pleased the court held clear criminal activity had taken place,” says CIAPC Assistant Director Jaana Pihkala.

Hinting at an appeal, Pihkala said that considering the scope of the defendants’ activities and the damage caused, the anti-piracy group expected a higher compensation award.

“We are now looking carefully look at the judgment and possible ways forward,” Pihkala concludes.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

These private groups train law enforcement officers around the world and are used to gather evidence, as if they were law enforcement branches.

A good example of the above is cable from October 2009, written by Kathleen Stephens, U.S. ambassador in South Korea. In the cable Stephens writes about a meeting between South Korean law enforcement officials, lobby groups IFPI and the MPAA, and a representative from the U.S. Immigration and Customs Enforcement (ICE) unit.

The meeting was organized to discuss enforcement actions against topsites, Scene servers that are at top of the so-called piracy pyramid. These servers are the source for much of the pirated content that eventually ends up at file-sharing websites.

After a failed attempt to bust several Korean topsites in 2008, the parties have come together to make new arrangements. What is immediately clear from reading the cables is that the law enforcement groups and the entertainment industry representatives find it extremely hard to take down these scene servers.

“Locating and penetrating topsites are extremely challenging because people can only gain access by proving that they can make a valuable contribution and gaining trust over an extended period of time. Access to topsite servers is encrypted and shielded and the operators respond to indications of investigation by legal authorities by destroying critical evidence and rapidly moving the servers,” the cable, signed by the ambassador, reads.

The meeting was further used to discuss the problems these topsites pose to the entertainment industry, and what options there are to go after them. One of the options is to infiltrate these servers and bust them from the inside out. This is a strategy that ICE seems to be familiar with, and they are happy to teach their skills to the Koreans.

“In response to questions about the role of his agency, ICE Attache explained that DHS ICE is currently investigating topsite-related issues in the U.S., and that there are numerous types of investigative methods that can be
incorporated to infiltrate topsites,” the cable reads.

“ICE Attache offered to provide training and a tour of the DHS ICE IPR Center in Washington, DC. The tour would allow Korean investigative entities to observe current methods used by law enforcement to combat topsites.”

One of the main problems with infiltration is that the topsite operators have to trust the ‘poser.’ To accomplish this, the ICE representative suggested that copyright holders could give them access to pre-release music that they can use to gain credibility as a source.

“[The ICE representative] also suggested encouraging a rightsholder to purposefully pre-release a song to law enforcement, in order to gain access to a topsite. Law enforcement could use the pre-released song to gain trust and consequent access from the topsite administrator. This idea was met with interest and may be pursued further,” the ambassador writes in the cable.

One of the plans that was brought up in the meeting was to let IFPI do the dirty infiltration work, after which they share their findings with law enforcement.

“As the meeting progressed, a basic investigative plan emerged in which IFPI performs the more arduous task of infiltrating topsites and gathering the IP addresses necessary to locate them. IFPI will then present an evidence
packet, which will include the IP address and the amount of files stored, to the Prosecutors’ Office. The Prosecutors’ Office will track down the physical location of the topsite, exercising maximum operational discretion.”

To avoid making the same mistake as in 2008, at no point during the investigations the ISPs can be notified, as they may be involved in the topsite themselves.

“The Prosecutors’ Office appears to understand that notifying an Internet Service Provider that one of its clients is under investigation, which it intended to do in the failed investigations of 2008, presents an enormous risk of
revealing the investigation to the topsite operator. It is even possible, as Mr. Ng noted, that someone working for the Internet Service Provider itself is operating the topsite.”

The cable further goes on to describe the need for action, and options that can be taken, but no concrete plans are worked out.

Although many have expected that infiltration of topsites was a common investigative tactic, this is the first time that we have it in writing.

In recent years dozens of topsites have been raided, including BAR, LOST, DLR and SC during a massive police action in Europe last year. Whether the above meeting resulted in any action from the South Koreans is unknown, but for as far as we are aware no Korea based topsites have been raided recently.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

The site had connections to a variety of scene groups and allegedly sold access to several well-known private BitTorrent trackers. Although the unplugging will be seen as an inconvenience and might delay some releases, none of the persons connected to the site appear to be facing legal action.

BREIN generally informs hosting providers of its suspicion that ‘illegal activity’ is taking place on their infrastructure and without the authorities getting involved the hosting provider then decides whether or not to take action. According to this scenario it is not impossible that Swan could reappear in a different location, as we’ve seen happening dozens of times after BREIN pulled torrent sites offline. But Scene groups and networks are complex creatures and take more time to reconstruct.

However, BREIN’s head Tim Kuik stated in a comment that his outfit is now in possession of the Swan servers. This is interesting to say the least, because BREIN has no authority to seize any equipment on its own, and the hosting provider can’t just hand over private customer data without a warrant.

In a comment Swan’s hosting provider Worldstream avoided these peculiarities and simply stated that they were happy to cooperate with BREIN.

“We can not accept such activities in our network,” the WorldStream owners explained. “BREIN is known as a reliable partner and provided very clear evidence to demonstrate that unauthorized files were made available on the servers. For us it was therefore quickly decided to cooperate in this action.”

The owner of Swan, who operates under the nickname MrTB, has also responded with a response to the events. With the exclamation “F*** me i’m famous!” MrTB claims that the ‘bust’ is the result of the actions of a rogue member. In addition he claims that BREIN misrepresented the facts since Swan only operated 8 servers holding 175 terabytes of data.

“I’m waiting for BREIN to offer me a job. I’ll be a one man wrecking crew: TaH, TDA, KoP, AUS, TEL, DC, FUK, TITS, PANDORA, NOT, GUK, 100SE plus the other 30 sites I was on,” he added.

“Peace out, and fuck you all!”

The last statement seems to indicate that Swan is not planning to make a return any time soon. This makes the BREIN action, albeit trivial, very effective. BREIN’s head Tim Kuik was asked for a comment regarding the ‘seizure’ of the servers but has yet to respond.

Update: Tim Kuik told TorrentFreak the following in response to the seizure of the servers.

“BREIN exerts the rights and civil enforcement remedies of copyright holders. That includes seizure of servers used for infringements. These can be claimed as property of the right holders. If the owner wants them back, he needs to identify himself, which of course means that he can be held liable as well, if we don’t locate him first. We have ample evidence of the unlawful activities carried out with the servers in question. This evidence convinced the hosting provider to cooperate. Conducting unlawful activities also is in contravention of hosting providers’ terms of use.”

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

There are several large topsites hosted in Sweden, some of which host hundreds of terabytes of pirated material. However, according to ‘scene’ etiquette, the files on these are not supposed to leak to other (more public) file-sharing networks but eventually they all do, with most of the big releases managing this in mere minutes.

This puts these servers close to the top of the ‘Piracy Pyramid‘ and one of the priority targets of anti-piracy outfits. Two weeks ago, Pirate Bay co-founder Anakata told the court that these scene members “hate The Pirate Bay” because they prefer to keep their releases within a select group.

Henrik Pontén from Antipiratbyrån – the Swedish anti-piracy office – applauded the police and said that this was one of the largest busts ever, and the largest in Sweden. According to one of our own sources, several well known scene groups were using the servers, which means that they may have been compromised.

For now, the investigation focuses on the person who operated the server in question. “A person suspected of running the server has been identified and it is now up to the police to investigate this. Now, we will continue to look for similar pirate servers,” Pontén told Aftonbladet.

Pontén also claimed that the Sunnydale topsite was the source of all pirated material available on The Pirate Bay, but this was denied by Peter Sunde. “More than 800,000 people have uploaded to The Pirate Bay, so I don’t believe it’s the source of everything. But it is possible that it’s a major source,” he said.

Antipiratbyrån’s involvement in this raid is questionable. In 2005 the police conducted an similar raid at Swedish ISP Bahnhof, only to be presented with evidence that Antipiratbyrån themselves had hired someone to plant copyright material. It turned out that the infiltrator was far from a passive observer. The infiltrator had transferred 68,000 files and went as far as buying hardware for the server to increase its storage capacity.

Antipiratbyrån was later sued for illegal trespassing and harassment because of these entrapment practices which are illegal in Sweden. Now, four years on and they are again involved in a similar raid, but whether they had any help from an insider this time is unknown. The exact role Antipiratbyrån played in this raid remains unclear, but it is likely that they tipped off the police about the location and existence of ‘Sunnydale.’

Pontén said that his organization will continue its “war on piracy.”

Update: Only one of Sunnydale’s servers was seized, the location of the other servers remains unknown.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.