How Hollywood Caught the UK's Most Prolific Movie Pirates | Hacker News Reader

How Hollywood Caught the UK's Most Prolific Movie Pirates

torrentfreak.com

67 pointsdsr1244 comments

What is bothering me is that supposedly a private organisation (FACT) was able to approach another private organisation (Equifax) with a name and acquire further details including a home address, without warrant or personal authorisation.

Can somebody explain to me how this is not a breech of the Personal Data clauses of the Data Protection Act 1998[1]?

[1] https://en.wikipedia.org/wiki/Data_Protection_Act_1998

From wikipedia above >> Section 29 – Crime and taxation. Data processed for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of taxes are exempt from the first data protection principle.

Note that the exception does not state that a warrant is needed for the collection or sharing in such circumstances.

Somehow I suspect if I wanted to do an investigation on whether FACT were breaking any laws, Equifax would deny me information.

In many ways we have a society where it is one rule for the rich and another for the ordinary person. A good recent example of this is Facebook, which is happy to let Donald Trump say things they class as hate speech on their platform, but won't let their ordinary users do so.

i am wondering what kind of evidence other than this information they had against them. Because if it is that easy just to link a username to a person and convict based on that it seems way too easy to just make an account linking to someone you hate, throw in a few random references to their family members and/or the city they live in and in a couple months they will be arrested

There are two main ways to access names and addresses in the UK, the electoral register, and the open register. The electoral register is the one that has more limited access and uses [0] while the open register is readily available for many other purposes such as direct marketing.

You can opt-out of the open register, so it would be interesting to know if in this case the person in question had opted out, or not.

Edit: a quick search on the open register for Wolverhampton reveals Sahil's full address from the 2009 and 2011 electoral rolls. Which means you could have used 192.com [1] or whitepages.com [2] to find him and thus very unlikely he had opted out, as those sites use open (edited) register data.

[0]: https://ico.org.uk/for-the-public/electoral-register/

[1]: http://www.192.com/

[2]: http://www.whitepages.co.uk/electoral-roll-search-and-electo...

DISCLAIMER: I work for one of the major credit bureaus but views are my own, and my understanding of the regulations around access to this kind of data is very shallow.

The opt-out nature of the open register is a disgrace, IMHO.

Can't argue with that, I wonder how many people would tick the box if it was opt-in...

An impressive amount of OPSEC fail. This is why you shouldn't mix real names with activity that gets you noticed!

It's actually surprisingly hard to get OPSEC right, because most of the time you either don't think what you're doing warrants a huge amount of resources spent prosecuting you, or you don't realise how big it is until it's too late.

One of the biggest links from the Silkroad owner's identity outside of tor was the fact that he promoted his own site in the early days, using an alias he had used to ask questions on stackoverflow. He probably didn't realise how important good OPSEC was until much later in the game.

I recently had the chance to help the FBI in an effort to catch a child abuser in collaboration with an NGO. It was very interesting to see how "techies" can piece together a scary level of detail about someone's identity using everyday things like the clothes they wear (if they bought them online) or how their house is decorated. Details of how were withheld from us, but the suspect got caught.

This is also why you should never select a unique nickname. If you are 'DerEliteHacker83723' then it is very easy to find all your stuff with a simple search, but if your nick is 'gwbush' then all your posts will drown in the sea of unrelated search results.

Indeed. Never ever contaminate. If you do, it's a matter of when - not if - the link will be made. Always rotate your identities as you would your keys and credentials.

"when - not if" narratives are often pushed by enforcement groups as a scare tactic. The reality is that so many people are engaged in these activities that, even without any opsec, most will live out their careers unpunished.

The flip side to this problem is that anyone with any notion of security is practically immune. With so many easy targets out there, the hard targets go untouched year after year.

Funnily enough, that's how most criminals get caught. Boasting about it down the pub!

I was once given some wise advice. If you've ever knowingly done something wrong, never tell anyone else, and never admit to it. Your mouth is your worst enemy.

Agreed. It's true that there are probably larger, slower fish than you - if you are a potential target. However, pursuers do not stop with the largest and slowest. They will persist and they do not tire. You will make small mistakes and leave partial identifying marks. It's inevitable - even an expert can't be 100 percent every minute of every operation. If you have their attention and you remain active with a single identity for too long the small mistakes will add up and they will find it and thus they will find you. It's not so much a scare tactic as a gamble - one the house usually wins. The larger one identity becomes the larger of a target it becomes. Make it appear as though you are a thousand bit players and not one large one. Change the equation, change the fingerprint - do whatever you can to protect the identity you can't change because you don't get a second chance and they get all the chances they need.

TL;DR - you can never be too paranoid, so long as the overhead doesn't impact your operations. if it does, you need to take a deep look into your risk appetites.

The funniest of all is that most of the identity leaks happened thanks to NFO files, which are useless except for boasting (the name of the group being usually on filenames already).

Some of these people are serving jail time because their nicks were in a useless text file next to the pirated movies presenting them as proud members of a group (and hopefully with some ascii art).

This is not a mistake, it's pure stupidity...

For those wondering, the sentences were 4.5 years, 4.2 years, 3.5 years, and 3.5 years. I'm not sure what the conversion rate between sentence and typical time served is in the UK, though.

Roughly, for people sentenced to over two years: you serve half the time in jail, you serve the rest "on licence" in the community. This means you can be taken back to jail to serve the rest of your sentence if you break any conditions.

http://www.offendersfamilieshelpline.org/index.php/sentence/

http://www.prisonreformtrust.org.uk/Portals/0/Documents/PIB%...

Is it just me or does that seem like an awfully long for file-sharing? Were these guys doing more than just passing files around that would justify that amount of jail time?

As I understand it just file sharing isn't criminal - no criminal conviction and no possibility of fines or jail time. (Although the rights owners can sue for loss of earnings.)

To tip it into criminal law you need to either sell the files, or to distribute enough to affect the trade of the rights owners.

https://en.wikipedia.org/wiki/Copyright,_Designs_and_Patents...

> Copyright infringement that may be criminal offences under the Copyright, Designs and Patents Act 1988 are the:

>Making copies for the purpose of selling or hiring them to others[11]

> Importing infringing copies (except for personal use)[12]

> Offering for sale or hire, publicly displaying or otherwise distributing infringing copies in the course of a business[13]

> Distributing a large enough number of copies to have a noticeable effect on the business of the copyright owner[14]

> Making or possessing equipment for the purposes of making infringing copies in the course of a business[15]

> Publicly performing a work in knowledge that the performance is unauthorised[16]

> Communicating copies or infringing the right to "make available" copies to the public (either in the course of a business, or to an extent prejudicial to the copyright owner)[17]

> Manufacturing commercially, importing for non-personal use, possessing in the course of a business, or distributing to an extent that has a noticeable effect on the business of the copyright holder, a device primarily designed for circumventing a technological copyright protection measure.[18]

I agree that these people should not be in prison, and certainly not for that long. Prison should be reserved for violent criminals.

Supposedly stealing money from (already) rich people. Which is the worst offense and a big no-no. /s

Just out of curiosity what's the motivation for these pirates to take these risks to share movies? Are they profiting from it financially?

No, it's community service-- just with people that are willing to go a bit further than the archive. There's also an amount of pride associated with being well known for quick releases like ettv or rartv -- or with having the smallest encoding like yify or nezu or something.

Game of Thrones is a good example. Everyone loves GOT, right? Shit some people even read the books. But you can only watch GoT if you have an HBO subscription right? Up until this year I think (?) that meant you had to be a US resident, with a physical cable subscription, and HBO service. What about people in fucking Thailand? Should they not get to watch GoT even though the whole internet is posting memes and whatever all over the place?

Or what about Django Unchained, lots of people in China went to see that film in theatres in China... minus about half an hour of edited footage. These Tarantino fans cannot legally obtain the entire version of the newest movie from their favorite director. Does that seem fair? Pirates to the rescue.

Most groups do accept bitcoin donations, but I have no clue how much that actually nets.

Honestly, it's just like a library, no clue why people get so worked up about free books, movies, music, etc. The only issue I really see is prereleases -- like cams and especially dvd screeners of films still in theatres, those can do some serious profit damages.

I fully plan on downloading this new star wars shit when it comes out. I also fully plan on going to see it in theatres because _that_ is what a movie is -- I spend 30 bucks on new movies wvery month. I download Ozzy music. I also paid fucking 150 pounds to see him in concert.

The war on pirates is just a pointless exercise by do-gooders with superiority complexes that for some reason think that copyright law as it stands is reasonable and are somehow deluded into thinking that the revenue stream of entertainment is working in a reasonable fashion. In reality that 10$ you spend on a DVD is just 10$ going into the hands of a corporation that does not actually produce anything but just runs around frantically trying to justify its own existence -- usually by harassing fans like this.

  > ... the actions taken by these men to hide their
  > identities aren’t shining examples of the art.

I look forward to Torrent Freak's follow-up article, detailing the shining examples of pirates we all should aspire to become.

You won't hear about them. I note that these guys were all P2P pirates - direct to torrent. The real pirates are still trading over FTP sites, which then filter down to UseNet, private forums and are then "leaked" to torrents.

I used to run a FTP server back in the day, I don't see how we the operators or the scene uploaders had any better OPSEC than these guys, we were just too obscure for anyone to care about.

These guys get caught because their releases reach millions of users, while FTP scene servers that have two-digit user numbers are not exactly killing the industry.

Obscurity is a form of OPSEC, just not a very good one.

Torrent often beats usenet in freshness

The real pirates are all retired.

Can you elaborate?

If you are taking the scene release groups as the real pirates then they are all retired. The scene is pretty much dead lately.

Communicate within voluntary relationships, get forced into a cage for years. Sounds like justice to me!

That's a pretty absurd framing of the situation.

I find it accurate enough. The very nature of data is absurd, when even far more awful stuff than merely a pirated movie can be reduced to a single (albeit large) number. It is one area where I feel our morality has not caught up with our technology.

For example, we think of trading stolen credit card numbers as wrong, but only because we have bought the narrative of identity theft, which was constructed to pass the burden onto the populace instead of the people handing out goods/services/money to verify identity. If you disregard the concept of identity theft, and think that instead it should be considered just theft, not from the one who possesses the identity used, but from the entity that handed out goods/services/money, then we need to reevaluate the ethics/morality of trading credit card numbers.

Which is of course what the credit card company tells the SOL merchant while yanking back the damages from their own willful negligence.

Consumer facing though, they'd like to define it as "identity theft" because "identity" is a bedrock abstraction their system is built on. They would like an "identity" to be something prescriptive and airtight (rather than imperfectly descriptive) because it would make their job/business that much easier.

Why do you think it's absurd (genuine question)?

https://news.ycombinator.com/item?id=10809290

Perhaps if you've drank the imaginary property kool aid. How does what they actually did differ from what I said? I see nothing about them stealing the original copies or forcing people to download from them.

"Communicate within voluntary relationships" could be used to describe distributing stolen credit card numbers, hacked medical records, passing child pornography around, etc.

Clearly, they're not in trouble for sending emails. The emails were simply the evidence of the crime they got caught carrying out.

The downloads themselves are the communications I was referring to. The existence of encryption implies freedom of speech, especially between two private parties, is a fundamental right. Child pornography sure makes for a nice disgusting bogeyman, but at least it's rare and isolated. Unlike totalitarian policing of private interactions.

How do you feel about people buying/selling stolen credit card numbers?

Is it possible for a datum to be any more intrinsically worthless than an account number? Or a system to be more broken than to authenticate by 21 digits printed right on the card? Credit card companies have had two decades to switch to an appropriate system for scalable online transactions, but why bother if they can simply screw over merchants while guilting users into thinking they're responsible for "their" number?

And despite all this the subject has become a routine talking point for censorship proponents, nicely demonstrating a warped framework that prioritizes centralized whims over individual rights.

That its largely a symptom of credit card companies not giving a darn about security or their customers.

I get more upset by the companies getting hacked once their negligent practices come to light.

Shift liability to the credit card companies and you can watch that problem take care of itself.

If the number is linked to me, i.e. if they're selling "anon has cc X", then that should fall under existing breach of privacy laws.

If it's just the number, i.e. "A cc with number X exists", I'm ok with that.

If they use the number to make purchases, that's a criminal offence separate from knowledge of the number per se.

Think of it like this: seeing a person get murdered isn't a crime. Facilitating murder in any way is.

Reply on news.ycombinator.com