Reddit beats film industry again, won't have to reveal pirates' IP addresses | Hacker News Reader

Reddit beats film industry again, won't have to reveal pirates' IP addresses

arstechnica.com

259 pointscoloneltcb97 comments

> Voltage Holdings and Screen Media Ventures cited Reddit posts in which users say that Frontier didn't terminate their Internet service despite sending many copyright infringement notices about torrent downloads. One of the users wrote, "I got a total of 44 emails from frontier about downloading torrents and that it could terminate service. They haven't yet. And I kinda feel like if they didn't do it after 44 emails. That they won't… ."

Don't they just want to file a lawsuit against Frontier? What is Reddit's involvement other than their website being used for this communication?

My understanding is that the users in question were talking about piracy or committing piracy on reddit and the movie companies want to get the IPs of those users from reddit in order to prove that Frontier isnt terminating people committing piracy.

Alternatively, depending on how large the list of users they requested IPs for from reddit is, it could be a fishing expedition to see if any of them happen to belong to frontier

It would be interesting to know if an admission to pirating content on Reddit is actually admissible. I would think it falls under free speech.

Eg: someone makes a parody of an old Monty Python song and states, “I’m a pirate and that’s ok.”

Should this count in an age where the vast majority of legal notices in this genre are robo-lawyers? Should my internet connection be severed because a guest was bored and posted to Reddit while at my house?

At some point in my life I committed a crime.

Here's to hoping that's not enough to have me subpoenaed.

See you in court

I think I get your point but being free speech and being an admission of a crime are not mutually exclusive.

IANAL, but I think free speech is about being jailed for what you say. This is more about admitting to an action that allegedly performed. The speech isn't the problem, it's the action the speech is talking about.

I think they'd have a hard time moving forward on that alone. They need some kind of proof, which is what I think they were trying to get. All they can prove is that the person said they got 44 emails, the person could be lying. There is no law against lying on an internet message board.

>I would think it falls under free speech.

Yes, admitting to committing a crime is not in and of itself illegal. It does, however, make it a lot more likely you'll be tried and convicted for the crime you admitted to committing.

Just because the words came out of my mouth or from my finger tips typed into this little text area does not actually mean I did the thing I'm "admitting". I could be saying it for the clout. I could have said it but forgot the /s. I could be an actor performing the dialog. Where's the witness I actually typed it? Even if there is video, it's all fake news from an AI deep fake. Believe none of what your read or hear, and only half of what you see. Or some such.

I'm not sure what your point is. Nobody (in the us) is shipping people straight to prison on the basis of public admissions of guilt. You still shouldn't publicly admit to a crime.

Just pointing out how ridiculous some post on a forum being used as evidence sounds.

The most ridiculous part was where you suggested that witness testimony was authoritative.

For piracy yea, but what about something more extreme like murder?

Depends on the murder. We’ve seen gang killings hyped and liked on socials, and cops not doing a lot with it. We’ve seen social live streaming of organized looting and not much being done with it. We’ve seen cops on video committing heinous acts and getting away with it. So why do we feel making shitposts on socials is going to do much?

Not very well. Of course it's evidence. You can't convict someone based on them walking into a police station and confessing to murder, either, but you can certainly arrest them or call them as a witness in a trial relating to that murder.

yes, but now it makes it easier to go look for the evidence on you specifically for the crime you claimed to commit.

you know, instead of fishing in the large.

> It would be interesting to know if an admission to pirating content on Reddit is actually admissible.

The problem here is tying the account to a real person. Technically anyone could be using that account, his daughter, brother, wife, etc., just like anyone could be behind the wheel of your car if it's used to commit a crime.

> Technically anyone could be using that account

Not just the account but the internet service as well. Even if they get the IP addresses for the reddit posts, and they're Frontier IPs, it's still possible that the person who wrote the post submitted it/logged in/created their account over a loved one's home network.

Just create an open wifi network and throttle it down to 1kbpm, plausible deniability!

This is correct, the Reddit poster(s) in question were discussing how lax Frontier was about Copyright strikes. The movie company presumably wanted to have that person testify about said lax policy in court.

I suspect the conversations went something like this:

Film industry lawyer: Tell us everyone who pirated our movies.

Frontier lawyer: We've told you everyone we know of.

Film industry lawyer: What about those people on reddit bragging about getting away with it?

Frontier lawyer: We don't have any way of knowing if those are actual customers, let alone if they're telling the truth. If you have a specific IP you want us to look into, we'd be happy to help.

(later)

Film industry lawyer: Give us the IPs of these users who made comments bragging about getting away with pirating.

Reddit lawyer: No.

Film industry lawyer: Okay, see you in court.

I'm actually kind of surprised Reddit didn't just cooperate? As a company which frankly has been acting with particular contempt for users of late, how does Reddit profit from fighting this?

People like their anonymity on Reddit. Every action reddit takes to make it less anonymous looks really bad. That kind of thing scares people and reddit already has some PR problems.

If word spread that Reddit would name people writing specific comments about various "controversial" topics i think millions would flee?

The entire spirit of Reddit is because of anonymity, from askreddit, to intimate questions, to political talk. Also there's lots of lying, fantasy, larping and fiction.

On the flip side, what's in it for them if they cooperate? There's no profit involved with procuring information for another for-profit entity that they have no business relationship with, and then likely having to show up for some other court battle to testify about the accuracy of the data.

> On the flip side, what's in it for them if they cooperate?

My thinking was, cooperating would mean they don't have to go to court, which costs money...

> and then likely having to show up for some other court battle to testify about the accuracy of the data.

...I suppose that could potentially cancel out the savings. However, I would expect testifying to cost much less money than being sued!

If you get sued and it turns out to be bullshit, there are potentially ways to recoup your legal costs.

Or if you do it once, then the film industry expects and requests for you to do it all the time, maybe? This is me just spit balling. If pulling this data costs m, then its m * number of request indefinitely. m is lower than the cost of a lawsuit over a sufficient number of requests. Where as, Reddit eats a lot of cost up front to try to prevent the film industry from racking up costs constantly requesting this information. And it perhaps bleed outside of the film industry. If they capitulate to film, then music might be next, followed by game studios, followed by software companies.

Not to mention the fact that in recent memory, they've already had to contend with the threat of a mass exodus of users due to unhappiness with how the site was run. Whether or not it ended up making any sort of impact in the long run, I have to imagine that their management has no desire to risk that sort of controversy again.

It'd probably reveal how many of their users are actually bots, which would hurt their upcoming IPO valuation.

I think that you are unfairly extrapolating from a couple of high-profile decisions that upset, in particular, nerds.

I think it was a bigger deal than that, but regardless: absent evidence to the contrary, my default assumption is that a for-profit company will prioritize profit at the expense of everything else. Recent events by Reddit merely deepen my conviction.

Goodwill, for an easy "fight" for a well-funded org with legal people "sitting around" on retainer.

Which they can subsequently burn on "more important" or more profitable user betrayals.

They are planning an IPO ... so this is good publicity for cheap and helps counter the bad PR they've been receiving from all their actions.

Cooperate how?

Do you think they are going to install LLM based surveillance and then hand check the comments in case the LLM is inaccurate?

> What is Reddit's involvement other than their website being used for this communication?

I think that's it, which is why reddit is referred to as non-party in the motion.

> Firms wanted seven years' worth of IP address logs on users who discussed piracy.

Does that mean reddit stores ip addresses for 7 years? That seems excessive.

I think it's basically for the entire account history.

You can verify this using the data request feature.

What the lawyers wanted may be very different from what reddit actually keeps.

Right,I bet reddit hold data for more than 7 years

I suppose it's possible the poster's IP is stored in the post metadata itself, along with the date, username, and so forth. Don't know if that's how Reddit works but in that case it'll be retained forever.

As for the reason for 7 years worth of data, I think that's because the firm wants to go back and search for infringing acitivity on all those IP addresses due to dynamic IP updates and so forth. If the user is still active on Reddit the more recent IP addresses probably are enough to identify him if a warrant is served to the ISP. The ISPs I know only retain a link from a dynamic IP to a subscriber for one to two years max.

Yeah that's why it's good to start a new reddit account every year and delete the old one. As well as VPN, regularly changing mac address on your router etc.

Or if you're like me, Reddit will helpfully shadowban everything you ever wrote on your decade-plus account, while simultaneously claiming you can't use the appeals page because the account is still in good standing.

As a bonus, anything anybody ever wrote in response to me is gone too.

The mac address is layer 2 and no one other than your ISP knows it. Changing it does nothing for your privacy since your ISP knows it anyway.

a lot of cable companies will have you keep ip addresses for a very long time. The only way I've found to get a new one quickly (without taking my cable modem offline for many hours) is to swap the mac of the router in ddwrt (router firmware). That works "nearly instantly" as long as you reset your router and cable modem.

Fair enough. If I change the mac address of my router the ISP locks me out for a substantial amount of time, deffinately not an option.

I wonder how many years HN stores IP information?

e-mail dang and let us know how it goes.

A recurring revenue opportunity for Reddit would be to forget about the old defender of online freedom image, and sell data. :)

"How much is it worth to your case, to know who the commenters on this thread are?"

"What would you pay to filter hiring candidates for ideology, troublemaker tendencies, or bedroom kinks that bother your conservative Chairman?"

"Your own actuaries can tell you how much money this individual vice data will save your insurance company, so let's split it."

"Making your astroturfing more effective, and getting full credit in your org for shifting perceptions, would be easier if you could crunch individual voting behavior."

"There's only so much censoring that bribed mods can do on the sub that keeps dumping on your brand. Seems like the private messages of your most influential critics would be useful to you. Oh, ha, I just pulled up the alts for one of them on my screen, and looks like they're secretly also an OnlyFans model."

"Would your government or department like to subscribe to the Access Plan or the Fusion Plan?"

Obvious idea: https://thenextweb.com/news/reddit-knows-your-dark-secrets

I'd love to see them try this, and then to watch the international backlash, not to mention holy GDPR fire raining down on their heads.

I'd love to see other companies crushed for behavior like the above hypotheticals. To push the public and lawmakers to finally decide that corporate surveillance is evil.

(Reddit still has positive karma balance, especially from earlier days, IMHO. There are many, many companies much more deserving of being made an example of.)

GDPR doesn't apply if they're really frontier customers. As they're not in the EU.

Oh yes one my favourite ~~TED~~ Onion talk business case studies:

"The Power Of Selling Out: Your Customers As Political Capital - Onion Talks - Ep. 9" - https://www.youtube.com/watch?v=w8c_m6U1f9o

For when you don't want to risk a Long Firm scam.

This lawsuit is a big ad for Frontier. I'm going to see what services they offer.

It makes me miss the pre-acquisition-by-akamai days at Linode, particularly in the 2010s it was quite easy to simply respond with "thanks for letting me know, the user in question has been banned" and go right back to torrenting

lol, that's the kind of behavior that does deserve legal consequences IMO, and I'm very pro piracy.

username checks ou-oops. sorry, forgot this isn't reddit xD

Btw doesn't increasing adoption of CGNAT [1] render useless these types of attempts to identify people based on IP address? A CGNAT IP address identifies multiple households.

[1] https://en.wikipedia.org/wiki/Carrier-grade_NAT

Wouldn't ISPs keep logs of which IP:Port maps to which internal IP:Port at any given time?

If not for law enforcement, at least so they can track you better and sell the data.

Yeah that's true. You need the data from both the ISP and reddit, and correlate using timestamps from both sides. That's true of VPNs, too. If multiple people with the same external IP were browsing reddit around the same time, the argument in court would likely become about the accuracy of timestamps.

Wouldn't that just consume absurd amounts of storage? Almost every device in my house constantly does update checks and many other connections, keeping track of every connection sounds extreme

3 IP/port combos (internal address, NAT gateway, destination) and a timestamp is ~110 bytes. So for, say, 1 million distinct flows started per customer per day, that's 110Mb.

So no, storage sounds relatively reasonable to me so long as the retention period isn't too long.

Well, they want 7 years of logs. 110 * 365.25 * 7 * users = quite a bit

This excerpt would be my response to "IP addresses should not be protected by privacy laws because an IP address doesn't identify a person".

> "While the Court is unaware of any cases in the Ninth Circuit in which a court has declined to apply a First Amendment unmasking standard for IP addresses, other courts have recognized that IP addresses are essential to unmasking because an 'IP address cannot be made up in the same way that a poster may provide a false name and address,'" Hixson wrote. "For this reason, the Court finds no reason to believe provision of an IP address is not unmasking subject to First Amendment scrutiny."

As an aside can your ISP track torrents if you still use DNS over https or VPN services? How does the tracking work and how can you mask better?

*alleged pirates

right?

Reddit thread I’m guessing this is in reference to https://www.reddit.com/r/Piracy/comments/14soiil/44_dmca_com...

Once again, IP addr is not a person. If you want to reveal who's who, you need to have a search warrant.

This isn’t about identifying a particular user, it’s about showing that Frontier does nothing to quell piracy by its users and thus provides an incentive to pirates to use their network.

Wow i didnt realize frontier is so based

> IP addr is not a person

And most IPV4 addresses are vague and only give a coarse location of where you are, and they're typically shared among many others so an IP is not a guaranteed signal that it was 'you' who pirated stuff.

> And most IPV4 addresses are vague and only give a coarse location of where you are

That's not true, you can request/compel Frontier to tell you what specific customer that IP was assigned to at a given time.

> and they're typically shared among many others so an IP is not a guaranteed signal that it was 'you' who pirated stuff.

Most residential ISPs in the states have 1 ipv4 (and possibly ipv6) assigned per customer and don't CGNAT, from my brief research Frontier doesn't seem to use CGNAT at least for residential internet.

The FBI contacted me over a shitpost on Reddit using this exact process. Hilarious, but also very concerning.

Was there plausibly a threat in it?

If it took the visit to realize that you're not very anonymous on the internet, you owe them for the lesson.

No, I know the line and have always been careful not to cross it. On the contrary, I resent them for the Gestapo tactics in retaliation for legal speech. I'm aware of my relative lack of anonymity online. You don't know who I am, I'm absolutely positive the feds do.

I’m not trying to be creepy or anything, but I clicked on your user name, and your profile has what looks like a real name on it.

Yes, it seems like that's my real name, doesn't it?

> to tell you what specific customer that IP was assigned to at a given time

Provided they keep such logs (which they probably shouldn't, unless required by law).

For security purposes you should of course assume they do indefinitely. In practice I'm pretty sure every US ISP does, at least on the timescale of 30d+. I don't think the US officially has a retention requirement but I think Canada does.

Comcast is 180 days - https://www.xfinity.com/-/media/4231839e374c4f618b2d34004d50...

I could not find a specific number for Frontier - https://content.frontier.com/-/jssmedia/documents/corporate/...

This past week I've gotten two people banned from reddit (full site ban). I was curious if it was possible so I picked some comments that I didn't think deserved a ban. The comments were more jokes than anything. Nothing serious.

Maybe Frontier should hire me.

> The comments were more jokes than anything. Nothing serious.

Yeah if you're not spreading doom, gloom and negativity reddit doesn't want you, they have a tone and they're policing it.

Really is the most negative and grim place on the entire internet.

I assume the pirates are using Tor or a proxy anyway though?

It doesn’t seem like the pirates who were described in the article were behind any kind of proxy, which is why the ISP Frontier repeatedly wrote them to desist. They were pirating on the clearnet without any obfuscation. Pretty dumb and easily the lowest hanging fruit for copyright enforcement.

Using Tor for streaming or large downloads probably won’t result in great quality or quick speeds. Using Tor for browsing and seeding on private torrent trackers is also typically banned for security reasons.

Well they don’t need Reddit to see who is seeding. But posting to Reddit can easily be done through Tor or proxies.

I wonder if they'll still do this once Reddit IPOs

Only if the film industry can figure out how to tank Reddit's stock price when it doesn't. It's a misalignment of incentives. Unless Reddit is exclusively associated with piracy and bad actors, most advertisers will probably ignore the bad press* and keep giving them money.

* I'm not even sure it'd be bad press. Internet users aren't overly fond of film companies and we're talking about a meme factory against the people who said "You wouldn't download a car."

What are they gonna do, put out ads "Reddit has pirates on it!", that will only make it more popular.

There are so many more disturbing things on Reddit than piracy

If those don’t deter advertisers I can’t imagine piracy would.

Once they're public, everything is going to change.

At that point it becomes "building value for the shareholder" and "minimizing risk for the shareholder".

Except in this case, users are the product, and if you ruin the experience for the user then you've ruined your own product, thus defeating the shareholder.

The only thing Reddit offers is a user community on a mega-forum.

> At that point it becomes "building value for the shareholder" and "minimizing risk for the shareholder".

Generally people refer to this as Enshittification

> if you ruin the experience for the user then you've ruined your own product, thus defeating the shareholder.

Enshittification is literally the opposite of this.

> At that point it becomes "building value for the shareholder" and "minimizing risk for the shareholder".

Reddit has been on this path for years. Almost every recent change, when viewed through this lens, makes much more sense.

Is this the first major public forum to go public?

Maybe if you define "forum" in a way which excludes social media sites like Facebook, but that feels like an artificial distinction.

It really does, there are facebook groups that have 80% of the functionality of reddit on specific topics, much like reddit, with discussions like reddit, and sharing media, just like reddit.

I'm firmly of the belief that all users should wipe their post/comment history & delete their accounts before this happens. User-content is what provides reddit their value, but once they go public it's (almost) guaranteed to become steadily worse & less useful as shareholders squeeze the life out of it.

Good. Piracy is the result of poor delivery or poor pricing models.

It's very aggravating when lawyers are just thrown at a problem because corporations are too lazy to do the work.

Reply on news.ycombinator.com