By design the BitTorrent protocol shares the location of any user in the swarm. After all, without knowing where to send the data nothing can be shared to begin with.

Despite this fairly common knowledge, even some experienced BitTorrent users can be shocked to learn that someone has been monitoring their activities, let alone that their sharing activity is being made public for the rest of the world to see.

Like it or not, this is exactly what the newly launched torrent search engine BTindex is doing.

Unlike most popular torrent sites BTindex adds new content by crawling BitTorrent’s DHT network. This is already quite unique as most other sites get their content from user uploads or other sites. However, the most controversial part without doubt is that the IP-addresses of BitTorrent users are being shared as well.

People who download a file from The Pirate Bay or any other torrent site expose their IP-addresses via the DHT network. BTindex records this information alongside the torrent metadata. The number of peers are displayed in the search results and for each file a selection of IP-addresses is made available to the public.

The image below shows a selection of peers who shared a pirated copy of the movie “Transcendence,” this week’s most downloaded film.

Perhaps even more worrying to some, the site also gives an overview of all recorded downloads per IP-address. While the database is not exhaustive there is plenty of dirt to be found on heavy BitTorrent users who have DHT enabled in their clients.

Below is an example of the files that were shared via the IP-address of a popular VPN provider.

Since all data is collected through the DHT network people can avoid being tracked by disabling this feature in their BitTorrent clients. Unfortunately, that only gives a false sense of security as there are plenty of other monitoring firms who track people by gathering IP-addresses directly from the trackers.

The idea to index and expose IP-addresses of public BitTorrent users is not entirely new. In 2011 YouHaveDownloaded did something similar. This site generated considerable interest but was shut down a few months after its launch.

If anything, these sites should act as a wake up call to people who regularly share files via BitTorrent without countermeasures. Depending on the type of files being shared, a mention on BTindex is probably the least of their worries.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

In 2011, news site Digital Music News (DMN) published an article which contained claims from a member of a rock band that Grooveshark had illegally hosted the band’s music and refused to take it down when notified. The article attracted around 100 comments from DMN readers, one of whom claimed to be an employee of Escape Media.

The commenter, who posted under the name “Visitor”, claimed that he had regularly received “direct orders from the top” at Escape to upload music to Grooveshark’s servers. Worse still, “Visitor” claimed that the company would not fully remove infringing content, even if artists or music labels complained.

These allegations were viewed as problematic by Escape since in order for a service provider to gain immunity under the Digital Millennium Copyright Act (DMCA), it must remove copyrighted material once it becomes aware that an infringement has taken place.

So, in an effort to unmask this supposed employee of theirs, in January 2012 Escape served a subpoena on Digital Music News in order to obtain “Visitor’s” identity. After DMN refused to comply, in March 2012 Escape petitioned the Los Angeles Superior Court for enforcement. DMN was subsequently ordered to comply but promptly filed an appeal.

DMN argued that unmasking “Visitor” would not lead to the discovery of evidence admissible in UMG’s New York lawsuit against Escape (identifying information about “Visitor” had all been deleted) and that enforcement of the subpoena would infringe on the First Amendment rights of both DMN and “Visitor”.

Ultimately the court decided that since Escape had presented a prima facie case that “Visitor’s” comments were libelous, no First Amendment protection was available. DMN was ordered to comply with the subpoena and provide a copy of its server to Escape. DMN copied the servers but lodged an appeal in attempt to avoid handing them over.

This week the Court of Appeal of the State of California handed down its decision and it’s bad news for Escape.

Escape had argued that proving “Visitor’s” comments to be false would help them show that the company did not supervise direct infringement of UMG’s copyrights. The Court rejected Escape’s basis for needing access to “Visitor’s” identity stating that this “out-of-court quarrel is of no consequence to the determination of UMG’s lawsuit.”

Escape enjoyed no success on the privacy front either.

“Even if Visitor’s identifying information was reasonably calculated to lead to
admissible evidence, his or her right to privacy under the California Constitution would outweigh Escape’s need for the information,” the Court said.

“That interest begins with Visitor’s need for a venue from which to be heard without fear of interference or suppression. Visitor’s anonymity also frees him or her from fear of retaliation, an even more compelling interest if Visitor truly is an Escape employee, as represented, because exposure could endanger not only his or her privacy but also livelihood.”

The Court concluded with a summary of its opinion as to the value of “Visitor’s” comments.

“Visitor has done nothing more than provide commentary about an ongoing public dispute in a forum that could hardly be more obscure — the busy online comments section of a digital trade newspaper,” the Court wrote.

“Such commentary has become ubiquitous on the Internet and is widely perceived to carry no indicium of reliability and little weight. We will not lightly lend the subpoena power of the courts to prove, in essence, that Someone Is Wrong On The Internet.”

With that the Court of Appeal ordered the trial court to vacate its order enforcing the subpoena and thereby protecting “Visitor’s” privacy.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

A new report published by Sandvine this morning sheds light on the most recent developments. As in previous years, the trend is one of BitTorrent losing its share of peak Internet traffic in the U.S. while continuing to grow in Europe.

However, there is a far more interesting trend hidden in the report, something which the traffic management company itself appears to have missed entirely. Comparing this year’s data to that of last year reveals that encrypted Internet traffic is booming.

The change is most pronounced in Europe where the percentage of encrypted Internet traffic during peak hours quadrupled from a measly 1.47% to 6.10% in a year. Since overall Internet traffic increased as well, the increase is even greater for the absolute bandwidth that’s consumed.

In North America the percentage of encrypted Internet traffic during peak hours increased as well, from 2.29% early last year to 3.80% this year.

Keeping in mind that absolute Internet traffic increases between 20% and 40% each year the bandwidth consumed by encrypted traffic doubled in this period.

The increase in encrypted traffic is a global phenomenon. In Latin America the share of bandwidth consumed by SSL shot up from 1.80% to 10.37% in a year. Also, a similar pattern emerges on mobile networks, where encrypted traffic is also booming.

The changes in encrypted traffic can be directly linked to the surveillance revelations of Edward Snowden. As a result, the number of users of VPN services and other anonymizers increased sharply. In addition, Google and other web services turned on SSL by default.

In previous years we revealed a similar trend among BitTorrent users, who increasingly searched for options to hide their download footprints in response to anti-piracy measures. A survey among Pirate Bay users, for example, revealed that 70% utilize a VPN or proxy, or are interested in doing so in the future.

It will be interesting to see how these trends develop in the years to come. In any case, it’s clear that Internet services and their users are becoming more aware of their privacy online, which is generally a good development.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Under the Directive Internet providers and other telecom companies were required to log and store vast amounts of information, including who their subscribers communicate with, and what IP-addresses they use.

The local authorities could then use this information to fight serious crimes, but it was also been frequently used by third parties, in online piracy cases for example.

Today the Court ruled that the data collection requirements are disproportionate. In a case started by Digital Rights Ireland the Court effectively annulled the directive, and it’s now up to the individual member states to change local laws accordingly.

“The Court is of the opinion that, by adopting the Data Retention Directive, the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality,” the Court states.

“By requiring the retention of those data and by allowing the competent national authorities to access those data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data,” it adds.

The judgement has far-reaching implications for large telecom companies, but also for smaller businesses including many VPN providers. With the new ruling these companies are no longer required to log extensive amount of user data as was required under the EU Directive.

While many ISPs are waiting to see what local Governments decide, the Swedish provider Bahnhof immediately announced that it would wipe all subscriber data it stored.

“Bahnhof stops all data storage with immediate effect. In addition, we will delete the information that was already saved,” Bahnhof CEO Jon Karlung says.

There’s also resistance against the Court decision. The Dutch Minister of Justice Fred Teeven, for example, wants local ISPs to continue storing user data for law enforcement purposes.

The European Court of Justice judgement is a clear victory for privacy activists, but mostly for the public who will regain some of their online privacy. While the ruling specified that some data retention may be needed, broad and mandatory retention laws and NSA-style data dragnets are no longer the standard.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

While website IP addresses are necessarily public information, IP addresses of individual users are by their very nature a lot more sensitive. Rather than identifying a web server designed to attract traffic, IP addresses operated by regular Internet users are often considered personal information.

Of course, it’s fairly common knowledge that the IP addresses of file-sharers become publicly visible when they enter BitTorrent swarms for example, but matching those IP addresses to real-life identities is a complex process wrapped up in privacy laws designed to protect the consumer. During the past week, however, it became evident that users of a Scandinavian ISP could be traced back to their real-life identities simply by using their IP address.

Discovered by Norwegian site Dinside, this privacy disaster stems from the software installed on routers supplied by local ISP NextGenTel. By simply entering the IP address of another NextGenTel user into a standard web browser, users were presented with a webpage containing router status information. The page also revealed the telephone number of the user behind the entered IP address.

Armed with a telephone number and a directory site such as 1881.no, all it took was a few clicks to find out the name and address of the person behind not only the telephone number, but also the original IP address.

After being alerted to the issue NextGenTel took action to fix the security hole by updating the relevant software, but the episode is a shining example of how years of care over personal information can be undone in an instant.

One of Norway’s biggest privacy cases in recent times involved a BitTorrent user who allegedly leaked a hit local movie to The Pirate Bay. Law firm Simonsen had the IP address of the leaker but desperately needed to convert that into a real-life identity in order to pursue legal action. That case went all the way to the Supreme Court when the ISP behind that IP address refused to hand over its customer’s private details.

Needless to say, that lengthy process would have been endlessly easier if that customer had been a NextGenTel customer. Simonsen could’ve accessed the Internet via NextGenTel, entered the IP address into their web browser, and used the telephone number to reach their target there and then – or called round for a visit, whichever was easier.

In a comment to Dinside, NextGenTel CTO Jørn E. Hodne said his company were taking the matter seriously and were attempting to put things right by fixing software and reporting themselves to the country’s Data Inspectorate.

“We’ve started the [software] update and even reported the matter to the Inspectorate,” Hodne said. “The world we live in is very complex, but this is our responsibility.”

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Internet privacy suddenly became a mainstream topic and all the negative news has increased the demand for encrypted and secure communications.

Responding to this, several developers quickly jumped in with new tools to prevent the public from having their conversations spied on or their data breached. Pirate Bay founder Peter Sunde announced a new encrypted messaging service for example, and Kim Dotcom’s Mega has similar plans.

Today BitTorrent Inc. announced a new project that will also increase people’s security. The San Francisco-based company just launched BitTorrent Chat, a secure messenger app that allows people to communicate without storing the conversations on any central servers.

The new tool is based on BitTorrent technology and is offered free of charge to help people regain complete control over their own data.

“This year alone, more than 6 million people have been impacted by data breaches. The right to own your own conversations online: it’s not a given. It should be,” the company says.

“So over at Labs, we’re working on something that could solve for conversation security. BitTorrent Chat applies distributed technology to the idea of IM. Our goal is to ensure that your messages stay yours: private, secure, and free.”

While BitTorrent Chat doesn’t store any conversations on a third-party server, it does need a central location to get the conversation going. To speak in BitTorrent terms, people have to connect to a tracker to know where the message should be sent.

TorrentFreak asked for further details on what central servers are involved in bootstrapping the conversations and what encryption the new tool uses, but the company could not immediately provide further details on these issues.

The new messenger app is not the only ‘breach safe’ tool the company is currently working on. Earlier this year BitTorrent launched its Sync application which provides a secure alternative to centralized cloud backup solutions such as Dropbox and Google drive.

Those who want to give BitTorrent’s Chat application a try can head over to BitTorrent Labs to sign up for the private Alpha.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

The ever popular VPN is showing no signs of decline and as time goes on the interest in joining private torrent communities grows.

Last month we took a look at the large amounts of data being stored by private torrent sites on their users, alongside the question of whether that information could be better handled in future.

That article prompted an individual, ‘X’, to contact us with information on what is perhaps the private tracker scene’s dirtiest and relatively open secret.

For those unaware, ‘X’ was talking about the phenomenon whereby losing an account or misbehaving on one torrent site can affect a user’s status on another. It’s been going on for some time now but it’s definitely worth mentioning in light of current concerns over data privacy.

X asked to keep him anonymous, and for good reason. He is the former sysop, admin and coder of at least two well known private torrent sites and the founder of another. He asked us simply – what do we know about how much information is being passed between torrent sites?

“I could take a username/email address/IP address and get information about any matching users on 30+ different sites. Some of it was automatic, some of it was request ticket based,” X explained.

So what kind of information is being shared? According to X, a staggering amount.

“Once a user was banned on one of the member private trackers, every IP they ever used for the site, RSS feed/API, and announces (even transversing HTTP proxies if they didn’t properly hide their origin IP), their email address, and their username was used to build a profile of them by combining shared data between the collective sites,” he revealed.

X told us that the databases are so rich in information that it’s possible to build detailed profiles of users, some of which are associated with more than a thousand IP addresses including access dates and times, plus a hundred usernames/email addresses and details of their supposed misbehavings.

“Everything from being a dick, being/acting suspicious, cheating/trading, letting someone else use their account, to staff running off with donation money could get a user on this database,” X said.

So how does this PRISM-like system work? According to X, it’s professionally constructed.

“All of these user profiles were accessible by all member sites via API, and quite a few sites kept their own copy of the database, pulling down information updates at regular intervals, and sending profile updates/creations on matching or requested information,” he revealed.

The security implications of holding local copies of full databases are a serious concern.

“If any of these sites got raided or hacked, data about users who never even used the site would be in the hands of the invader.”

We’ve discussed the reasons why these kinds of systems are in place in previous articles. Private sites have an ‘economy‘ to preserve and need to be able to keep tabs on damaging users in order to keep their sites healthy.

Of course, this is the kind of reasoning also employed by the NSA when it tries to justify spying on everyone. Are these excuses acceptable or not? Does the end justify the means?

“The NSA leaks have shed a new light on what I regularly did at my post [X says he wrote some of the code allowing the sites to communicate], and while I can’t deny the good it did in keeping [our site] from falling to shit, the way the information is handled and the secrecy behind this are things that need to be exposed and reworked,” X concludes

It is unlikely that the participating trackers will give up their intelligence systems just like that since the information they provide is a crucial part of keeping their sites healthy. But equally, these kinds of databases could become hugely problematic should they fall into the wrong hands.

What happens next is up to the sites running the operation but coordinating change and introducing a better system could prove almost impossible.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Until recently these were the kinds of issues pondered by those with an interest in Internet security and the very paranoid. In the post Edward Snowden world, these are things that are starting to matter to everyone.

Security is a pretty big issue among file-sharers for a number of reasons. Obviously there are many who would like to keep their activities private, but it’s common for file-sharers to be tech-savvy users who are generally more aware of online privacy issues.

Public v Private

By now, those using public BitTorrent sites should be well aware that their activities are, to put it bluntly, extremely public. At any time spies of all kinds can jump into a torrent swarm and start gathering data. The most important pieces of data – times and IP addresses – can be scooped up in an instant and are often enough for trolls to start filing lawsuits.

Private torrent sites, on the other hand, offer a walled garden environment. They are often very hard to gain access to which means that generally speaking there are less spies and fewer chances of being monitored or busted – or so the anecdotes go. Truth is no one is sure how many undesirables may exist on these sites but it’s likely that very few sites will have a completely clean bill of health.

The public vs private security debate has been done to death over the years but what is not often discussed is how sites – private ones in particular – handle the data entrusted to them by their users.

When someone signs up to a site via invite they hand over both their email and IP addresses. Immediate checks are made – has this email or IP address been used on this site before? If so, in many cases the chances of getting account are already reduced to near zero. If there’s no match, the user making the application is in – congratulations.

This is where the fun starts and something less entertaining kicks in behind the scenes. You can buy a zero-logging VPN incredibly simply these days but the same cannot be said about private torrent sites. At every opportunity they log just about everything they can.

Private site logging

Obviously, a certain level logging is required for people to merely have an account. As a matter of course sites log their sign up date along with users’ email addresses, passwords and everything said in their forums. No surprises so far really.

However, sites also log every single torrent downloaded and every IP address used to do so. They log how much data was downloaded and how much was uploaded. Not only that, sites know which other users the downloads came from and to which users the uploads were sent and in what quantity.

Once this information is logged (often against hundreds of torrents per user), sites know all there is to know about their users, real-life identities aside. And the worrying thing is that in many cases the information is never deleted, even when users have left the site. So why is that the case?

The answer is simple – it’s all about keeping the site and its file-sharing ecosystem functioning in an optimal fashion.

Sites rely on users playing fair, such as sharing content in a way determined by the sites rules. When this breaks down so does the site, so site logs are used to weed out the bad players. These include those who damage the ecosystem by not doing their part or – heaven forbid – those evil users who try to cheat the ratio system.

Once these users are found (which is only possible by keeping detailed logs on the activities of all users) they are kicked out. However, their accounts are not usually deleted because they carry useful information which will be used to ensure that the same user doesn’t try to get back on the site in future. To combat these users many sites also ban the use of VPNs, which means that not even good users can enjoy the security they offer.

Logs can be used to keep the enemy out

Site logs are also used to hunt down the private tracker’s worst enemies – anti-piracy companies and those users who make a business out of buying and selling site invites. These two groups can be closely related, since when an invite seller offers his product in public, it’s possible that spies can pick them up for a few dollars and gain access to an otherwise private site in a matter of minutes.

So, as we can see, site logs are there to protect the health of the tracker. However, it would be an absolute nightmate if they fell into the wrong hands. While that doesn’t happen often, it does happen.

Just this week the UFC announced that it had targeted a site called BestFreeUFC and as a result has obtained the site’s database which includes email addresses, IP addresses, user names and chatlogs of individuals who have illegally accessed UFC events. UFC owners Zuffa say they will now go after the infringers.

The future – encryption?

So what can be done to increase site security? TorrentFreak spoke with a couple of admins who informed us that while they would prefer not to carry logs, they are essential for maintaining a healthy tracker and keeping undesirables out. Passwords on Gazelle trackers are encrypted, which is welcome, but currently no other data is encrypted as standard.

One admin told us he would like to add full encryption but from a technical perspective it would seriously complicate matters. Furthermore, much more grunt in both the software and hardware departments would be required, along with a fresh view of the entire situation.

So while email providers start adding encryption as standard and companies like Dotcom’s Mega have security built in from the ground up, the question now is whether private torrent sites will maintain their positions or continue as normal.

This might just be another case of citizens having to sacrifice some of their privacy in order to obtain a valuable service, or perhaps in the overall scheme of things, security is tight enough already…..

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

While it may not come as a complete surprise that nearly all communication on the Internet is monitored and stored, the revelations have brought talks about encrypted communication to the mainstream.

One new startup that hopes to lead the way in the next generation of encrypted communication tools comes from Pirate Bay founder Peter Sunde. The former Pirate Bay spokesman is no newcomer when it comes to encrypting traffic as he is also connected to the privacy-focused VPN service iPredator. However, with his latest project he hopes to take things to the next level.

Sunde and two friends are currently working hard on Heml.is (“secret” in Swedish), a spy-proof messaging App for both iOS and Android. Aside from its pretty looks, all messages will be encrypted so no one except the sender and recipient will be able to read their contents.

TorrentFreak caught up with Sunde who told us that a secure and private messaging system is needed for people to talk freely.

“People act differently if they think someone is listening in to their conversation. That’s what Stasi taught us for instance. It’s one of many reasons why privacy is so vital,” Sunde says.

While encrypted messaging is not a new phenomenon, Heml.is hopes to beat the competition by building apps that look pretty, but perhaps more importantly are completely open about the people running them.

“The big difference with heml.is compared to other solutions is that we’re not just focusing on tech. So many people talk about open source, floss and so on, but that’s only a small part. There are more important questions,” Sunde tells us.

“Who runs the infrastructure? How do you know the intentions of those people? Which jurisdiction has which rules? “We know these things just as well as the technology. Today’s internet is more and more politicized so it needs to be dealt with that way as well.”

Helm.is is currently working on messenger apps for the iOS and Android platforms and is raising money to complete the development. In the future the startup is looking to expand to other platforms as well as other forms of communication.

“In today’s day and age we can’t do without encryption. We need to have it for all sorts of communication, something we from The Pirate Bay have said for almost a decade now,” Sunde tells us.

“But it’s not just encryption, it’s everything surrounding it. The cloud services are the big problem. Doesn’t matter if you communicate encrypted, if the end result is stored with a master-key or otherwise accessible by an unwanted party,” he adds.

Sunde is best known for his role as Pirate Bay founder, and notes that aside from messaging Heml.is may also add file-sharing capabilities in the future.

“We’re of course looking at possibilities of doing any type of communication private,” Sunde says.

People who are interested can help out by funding the project in return for unlock codes. No release date has yet been promised – Sunde says that they’re not going to release anything until they’re completely happy with it.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

The revelations turned online privacy into a worldwide mainstream discussion. Privacy activists shouted “we told you so,” Orwell quotes were rife, Kim Dotcom warmed up the public for his PRISM-proof email serviceand these was even some discussion over the stolen PRISM logo

Following the leaks the NSA and the US Government have been heavily criticized for their disregard of people’s privacy, and perhaps not totally unexpectedly this weekend the first legal action was filed.

TorrentFreak just obtained a copy of a complaint submitted at a federal court in Columbia, targeting President Obama, the NSA, Eric Holder and Verizon who all played a role in the mass surveillance scheme.

The class action lawsuit was filed by Larry Klayman, a former US prosecutor under the Reagan administration, together with the parents of the killed Navy SEAL Team VI member Michael Strange.

The plaintiffs accuse the PRISM participants of violating their constitutional rights, reasonable expectation of privacy, free speech and association, right to be free of unreasonable searches and seizures, among other illegal and criminal acts. Both Klayman and the Navy Seal parents demand compensation for the damage they suffered.

“This case challenges the legality of Defendants’ participation and conduct in a secret and illegal government scheme to intercept and analyze vast quantities of domestic telephonic communications,” the complaint reads.

While there are plenty of angles to pick, the class action centers around the classified order from the secretive Foreign Intelligence Surveillance Court ordering Verizon to hand over all call details and metadata between the United States and abroad, without any oversight.

“This would give the NSA over one hundred millions phone records on a daily basis. The information would also include a list of all the people that Verizon customers call and who called them; how long they spoke; and perhaps, where they were on a given day.”

“Further, there is nothing in the order requiring the government to destroy the records after a certain amount of time nor is there any provisions limiting who can see and hear the data,” the complaint states.

The complaint goes on to state that those responsible for the PRISM scandal have done very little to explain what it entails. Instead, there are now calls to go after the whistleblower, Edward Snowden, to stop further leaks.

“To date, Defendants have not issued substantive and meaningful explanations to the American people describing what has occurred. To the contrary, criminal charges are reportedly being pursued by Defendants Obama, Holder, the DOJ, and the NSA against the leakers of this plot against American citizens in a further effort suppress, obstruct justice, and to keep Defendants’ illegal actions as secret as possible.”

Former US prosecutor Larry Klayman is a known critic of the Obama administration and believes that his private communications were tapped under the PRISM program. Charles and Mary Ann Strange, the parents of the killed Navy Seal Team VI member Michael Strange, allege the same as they have also challenged the Obama administration.

“[...] particularly since these Plaintiffs have been vocal about their criticism of President Obama as commander-in-chief, his administration, and the U.S. military regarding the circumstances surrounding the shoot down of their son’s helicopter in Afghanistan, which resulted in the death of their son and other Navy Seal Team VI members and special operation forces.”

The complaint demands relief for violations of the defendants’ rights under the First, Fourth, and Fifth Amendments to the U.S. Constitution. In addition it lists violations of privacy, including intrusion upon seclusion, freedom of expression and association, due process, and other illegal acts.

Thus far, authorities and the technology companies involved in the surveillance scandal have refuted most accusations, claiming that they are operating within the boundaries of the law. Time will tell whether the present lawsuit will arrive at another conclusion.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.