Piracy

Napster and Sonos Sued For Millions In Unpaid Music Royalties (torrentfreak.com) 10

An anonymous reader quotes a report from TorrentFreak: Napster, the brand synonymous with the music piracy boom of the early 2000s, has a new copyright challenge. Together with audio giant Sonos, Napster faces a lawsuit demanding over $3.4 million in alleged unpaid copyright royalties. Filed by collective rights management organization SoundExchange, the complaint (PDF) centers on missed payments related to the "Sonos Radio" service, which until 2023 was powered by Napster's music catalog. [...]

Sonos Radio launched in April 2020 with Napster as the authorized agent, submitting the required royalty reports and royalties to SoundExchange. While all went well initially, payments stopped around May 2022. At the time, Napster had been acquired by venture capital firms Hivemind and Algorand, with a focus on "web3" technologies, including cryptocurrencies and blockchain. According to the complaint, the takeover resulted in a "complete breakdown of reporting and payment for the Sonos Radio service." The alleged payment problems eventually came to light during an audit initiated by SoundExchange in 2023, which concluded that Sonos and Napster owed millions in unpaid royalties.

Sonos and Napster are no longer partners in the radio service, as the audio equipment manufacturer switched to Deezer around April 2023. That appears to have solved the royalty issues, but SoundExchange still believes it is owed more than $3 million. "In total, Sonos, and its agent Napster, have failed to pay at least $3,423,844.41 comprising royalties owed for the period October 2022 to April 2023, interest, late fees, and auditor fee-shifting costs, and subtracting Sonos and Napster's payments made to date. "Late fees and interest continue to grow," SoundExchange adds, while requesting compensation in full. The complaint lists one count of "underpayment" of statutory royalties, and one count of "non-payment" of royalties, as determined by the audit. For both Copyright Act violations, SoundExchange requests damages of at least $3.4 million.

AI

Disney, NBCU Sue AI Image Generator Midjourney Over Copyright Infringement 88

Disney and NBCUniversal have filed a copyright infringement lawsuit against AI image generator firm Midjourney in U.S. District Court in Los Angeles, marking the first time major Hollywood studios have taken legal action against a generative AI company.

The entertainment giants accuse Midjourney, founded in 2021, of training its software on "countless" copyrighted works without permission and enabling users to create images that "blatantly incorporate and copy" famous characters including Darth Vader, the Minions, Frozen's Elsa, Shrek, and Homer Simpson.

The companies claim they attempted to resolve the matter privately, but Midjourney "continued to release new versions" with "even higher quality infringing images" according to the complaint. Disney's general counsel used the word "piracy," to describe Midjourney's practice, while NBCUniversal's general counsel characterized it as "blatant infringement."
Piracy

Pirate Site Visits Dip To 216 Billion a Year, But Manga Piracy Is Booming (torrentfreak.com) 54

An anonymous reader quotes a report from TorrentFreak: Fresh data released by piracy tracking outfit MUSO shows that pirate sites remain popular. In a report released today, MUSO reveals that there were 216 billion pirate site visits globally in 2024, a slight decrease compared to the 229 billion visits recorded a year earlier. TV piracy remains by far the most popular category, representing over 44.6% of all website visits. This is followed by the publishing category with 30.7%, with film, software and music all at a respectable distance. Pirate site visitors originate from all over the world, but one country stands tall above all the rest: America. The United States remains the top driver of pirate site traffic accounting for more than 12% of all traffic globally, good for 26.7 billion visits in 2024. India has been steadily climbing the ranks for years and currently sits in second place with 17.6 billion annual visits, with Russia, Indonesia, and Vietnam completing the top five. As a country with one of the largest populations worldwide, it's not a complete surprise that the U.S. tops the list. If we counted visits per internet user, Canada and Ukraine would top the list.

While pirate site visits dipped by more than 5% in 2024, one category saw substantial growth. Visits to publishing-related pirate sites increased 4.3% from 63.6 to 66.4 billion. The increase is largely driven by the popularity of manga, which accounts for more than 70% of all publishing piracy. Traditional book piracy, meanwhile, is stuck at 5%. The publishing piracy boom is relatively new. Over the past five years, the category grew by more than 100% while the overall number of global pirate site visits remained relatively flat. Looking at the global demand, we see that the U.S. also leads the charge here, followed by Indonesia and Russia. Notably, Japan, the home of manga, ranks fifth in the publishing category. This stands out because Japan is not listed in the global top 15 in terms of total pirate site visits.

In the other content categories, MUSO's data shows a dip in pirate site visits. The changes are relatively modest for TV (-6.8%) and software (-2.1%) but the same isn't true for the music and film categories. In 2024, there were 18% fewer visits for pirated movies compared to a year earlier. MUSO notes that this is due to a "lighter blockbuster calendar" which reduced piracy peaks. "The drop in demand is as much about what wasn't released as it is about access," the report explains. The music category saw a 19% decline in piracy visits year over year, with a more uplifting explanation for rightsholders. According to MUSO, the drop can be partly attributed to "secure app ecosystems" and the "wide adoption of licensed platforms like Spotify and Apple Music."

Youtube

YouTube Pulls Tech Creator's Self-Hosting Tutorial as 'Harmful Content' (jeffgeerling.com) 77

YouTube pulled a popular tutorial video from tech creator Jeff Geerling this week, claiming his guide to installing LibreELEC on a Raspberry Pi 5 violated policies against "harmful content." The video, which showed viewers how to set up their own home media servers, had been live for over a year and racked up more than 500,000 views. YouTube's automated systems flagged the content for allegedly teaching people "how to get unauthorized or free access to audio or audiovisual content."

Geerling says his tutorial covered only legal self-hosting of media people already own -- no piracy tools or copyright workarounds. He said he goes out of his way to avoid mentioning popular piracy software in his videos. It's the second time YouTube has pulled a self-hosting content video from Geerling. Last October, YouTube removed his Jellyfin tutorial, though that decision was quickly reversed after appeal. This time, his appeal was denied.
The Internet

ISP Settles With Record Labels That Demanded Mass Termination of Internet Users (arstechnica.com) 24

An anonymous reader shares a report: Internet service provider Frontier Communications agreed to settle a lawsuit filed by major record labels that demanded mass disconnections of broadband users accused of piracy. Universal, Sony, and Warner sued Frontier in 2021. In a notice of settlement filed last week in US District Court for the Southern District of New York, the parties agreed to dismiss the case with prejudice, with each side to pay its own fees and costs.

The record labels and Frontier simultaneously announced a settlement of similar claims in a Bankruptcy Court case in the same district. Frontier also settled with movie companies in April of this year, just before a trial was scheduled to begin. (Frontier exited bankruptcy in 2021.) [...] Regardless of what is in the agreement, the question of whether ISPs should have to crack down more harshly on users accused of piracy could be decided by the US Supreme Court.

Piracy

Football and Other Premium TV Being Pirated At 'Industrial Scale' (bbc.com) 132

An anonymous reader quotes a report from the BBC: A lack of action by big tech firms is enabling the "industrial scale theft" of premium video services, especially live sport, a new report says. The research by Enders Analysis accuses Amazon, Google, Meta and Microsoft of "ambivalence and inertia" over a problem it says costs broadcasters revenue and puts users at an increased risk of cyber-crime. Gareth Sutcliffe and Ollie Meir, who authored the research, described the Amazon Fire Stick -- which they argue is the device many people use to access illegal streams -- as "a piracy enabler." [...] The device plugs into TVs and gives the viewer thousands of options to watch programs from legitimate services including the BBC iPlayer and Netflix. They are also being used to access illegal streams, particularly of live sport.

In November last year, a Liverpool man who sold Fire Stick devices he reconfigured to allow people to illegally stream Premier League football matches was jailed. After uploading the unauthorized services on the Amazon product, he advertised them on Facebook. Another man from Liverpool was given a two-year suspended sentence last year after modifying fire sticks and selling them on Facebook and WhatsApp. According to data for the first quarter of this year, provided to Enders by Sky, 59% of people in UK who said they had watched pirated material in the last year while using a physical device said they had used a Amazon fire product. The Enders report says the fire stick enables "billions of dollars in piracy" overall. [...]

The researchers also pointed to the role played by the "continued depreciation" of Digital Rights Management (DRM) systems, particularly those from Google and Microsoft. This technology enables high quality streaming of premium content to devices. Two of the big players are Microsoft's PlayReady and Google's Widevine. The authors argue the architecture of the DRM is largely unchanged, and due to a lack of maintenance by the big tech companies, PlayReady and Widevine "are now compromised across various security levels." Mr Sutcliffe and Mr Meir said this has had "a seismic impact across the industry, and ultimately given piracy the upper hand by enabling theft of the highest quality content." They added: "Over twenty years since launch, the DRM solutions provided by Google and Microsoft are in steep decline. A complete overhaul of the technology architecture, licensing, and support model is needed. Lack of engagement with content owners indicates this a low priority."

Movies

Man Who Stole 1,000 DVDs From Employer Strikes Plea Deal Over Movie Leaks (arstechnica.com) 61

An anonymous reader quotes a report from Ars Technica: An accused movie pirate who stole more than 1,000 Blu-ray discs and DVDs while working for a DVD manufacturing company struck a plea deal (PDF) this week to lower his sentence after the FBI claimed the man's piracy cost movie studios millions. Steven Hale no longer works for the DVD company. He was arrested in March, accused of "bypassing encryption that prevents unauthorized copying" and ripping pre-release copies of movies he could only access because his former employer was used by major movie studios. As alleged by the feds, his game was beating studios to releases to achieve the greatest possible financial gains from online leaks.

Among the popular movies that Hale is believed to have leaked between 2021 and 2022 was Spider-Man: No Way Home, which the FBI alleged was copied "tens of millions of times" at an estimated loss of "tens of millions of dollars" for just one studio on one movie. Other movies Hale ripped included animated hits like Encanto and Sing 2, as well as anticipated sequels like The Matrix: Resurrections and Venom: Let There Be Carnage. The cops first caught wind of Hale's scheme in March 2022. They seized about 1,160 Blu-rays and DVDs in what TorrentFreak noted were the days just "after the Spider-Man movie leaked online." It's unclear why it took close to three years before Hale's arrest, but TorrentFreak suggested that Hale's case is perhaps part of a bigger investigation into the Spider-Man leaks.
A plea deal for Hale significantly reduced the estimated damages from his piracy case to under $40,000 and led to the dismissal of two charges, though he still faces up to five years in prison and a $250,000 fine for one remaining copyright infringement charge. His final sentence and restitution amount will be decided at a court hearing in Tennessee at the end of August.
Piracy

Cloudflare CEO: Football Piracy Blocks Will Claim Lives (torrentfreak.com) 48

Cloudflare CEO Matthew Prince warned that LaLiga's ISP blocking campaign -- intended to stop football piracy -- has caused widespread collateral damage by blocking millions of unrelated websites, including emergency services, in Spain. He called the strategy "bonkers" and expressed fear that lives could be lost due to the overblocking. TorrentFreak reports: Posting to X last week, Prince asked if anyone wanted any general feedback, declaring that he felt "in an especially truthful mood." The first response contained direct questions about the LaLiga controversy, the blame for which LaLiga places squarely on the shoulders of Cloudflare. For the first time since Cloudflare legal action failed to end LaLiga's blocking campaign, Prince weighed in with his assessment of the current situation and where he believes it's inevitably heading.

"A huge percentage of the Internet sits behind us, including small businesses and emergency resources in Spain," Prince explained. "The strategy of blocking broadly through ISPs based on IPs is bonkers because so much content, including emergency services content, can be behind any IP. The collateral damage is vast and is hurting Spanish citizens from accessing critical resources," he added. [...]

Despite LaLiga's unshakable claims to the contrary, Prince believes that it's not a case of 'if' disaster strikes, it's 'when.' "It's only a matter of time before a Spanish citizen can't access a life-saving emergency resource because the rights holder in a football match refuses to send a limited request to block one resource versus a broad request to block a whole swath of the Internet," Prince warned. "When that unfortunately and inevitably happens and harms lives, I'm confident policy makers and courts in Spain and elsewhere will make the right policy decision. Until then, it'll be up to users to make politicians clear on the risk. I pray no one dies."

The suggestion that LaLiga's demands were too broad, doesn't mean that Cloudflare is refusing to help, Prince suggested. On the contrary, there's a process available, LaLiga just needs to use it. "We've always been happy and willing to work with rights holders in conjunction with judicial bodies to protect their content. We have a clear process that works around the world to do that," Prince explained.

Nintendo

Nintendo Can Render Your Switch 2 'Permanently Unusable' If You Break Their Rules (betanews.com) 139

Slashdot reader BrianFagioli writes: The new Nintendo Switch 2 is almost here. Next month, eager fans will finally be able to get their hands on the highly anticipated follow-up to the wildly popular hybrid console. But before you line up (or frantically refresh your browser for a preorder), you might want to read the fine print, because Nintendo might be able to kill your console.

Yes, really. That's not just speculation, folks. According to its newly updated user agreement, Nintendo has granted itself the right to make your Switch 2 "permanently unusable" if you break certain rules. Yes, the company might literally brick your device. Buried in the legalese is a clause that says if you try to bypass system protections, modify software, or mess with the console in a way that's not approved, Nintendo can take action. And that action could include completely disabling your system.

The exact wording makes it crystal clear: Nintendo may "render the Nintendo Account Services and/or the applicable Nintendo device permanently unusable in whole or in part...." [T]o be fair, this is probably targeted at people who reverse engineer the system or install unauthorized software — think piracy, modding, cheating, and the like. But the broad and vague nature of the language leaves a lot of room for interpretation. Who decides what qualifies as "unauthorized use"? Nintendo does.

Nintendo's verbiage says users must agree "without limitation" not to...
  • Publish, copy, modify, reverse engineer, lease, rent, decompile, disassemble, distribute, offer for sale, or create derivative works
  • Obtain, install or use any unauthorized copies of Nintendo Account Services
  • Exploit the Nintendo Account Services in any manner other than to use them in accordance with the applicable documentation and intended use [unless "otherwise expressly permitted by applicable law."]
  • Bypass, modify, decrypt, defeat, tamper with, or otherwise circumvent any of the functions or protections... including through the use of any hardware or software that would cause the Nintendo Account Services to operate other than in accordance with its documentation and intended use

"...if you fail to comply with the foregoing restrictions Nintendo may render the Nintendo Account Services and/or the applicable Nintendo device permanently unusable in whole or in part."


IT

The 'You Wouldn't Steal a Car' Campaign Used a Pirated Font (torrentfreak.com) 54

The iconic "You Wouldn't Steal a Car" anti-piracy campaign, which dramatically equated digital piracy with physical theft, appears to have used a pirated font in its own materials. New evidence indicates the campaign utilized "XBAND Rough," a free clone of the commercial "FF Confidential" font, which requires a license.

TorrentFreak independently confirmed campaign materials from 2005 embedded the XBAND Rough font rather than the original created by Just Van Rossum in 1992. Researchers discovered the font in PDF files hosted on the campaign's official website. Van Rossum, FF Confidential's creator, called the revelation "hilarious" when informed by TorrentFreak. "I knew my font was used for the campaign and that a pirated clone named XBand-Rough existed. I did not know that the campaign used XBand-Rough," he said.
Censorship

Vercel Slams LaLiga Piracy Blocks As 'Unaccountable Internet Censorship' 20

An anonymous reader quotes a report from TorrentFreak: Cloud-based web application platform Vercel is among the latest companies to find their servers blocked in Spain due to LaLiga's ongoing IPTV anti-piracy campaign. In a statement, Vercel's CEO and the company's principal engineer slam "indiscriminate" blocking as an "unaccountable form of internet censorship" that has prevented legitimate customers from conducting their daily business. [...] US-based Vercel describes itself as a "complete platform for the web." Through the provision of cloud infrastructure and developer tools, users can deploy code from their computers and have it up and running in just seconds. Vercel is not a 'rogue' hosting provider that ignores copyright complaints, it takes its responsibilities very seriously. Yet it became evident last week that blocking instructions executed by Telefonica-owned telecoms company Movistar were once again blocking innocent users, this time customers of Vercel.

As the thread on X continued, Vercel CEO Guillermo Rauch was asked whether Vercel had "received any requests to remove illegal content before the blocking occurs?" Vercel Principal Engineer Matheus Fernandes answered quickly. Additional users were soon airing their grievances; ChatGPT blocked regularly on Sundays, a whole day "ruined" due to unwarranted blocking of AI code editor Cursor, blocking at Cloudflare, GitHub, BunnyCDN, the list goes on. In a joint statement last week, Vercel CEO Guillermo Rauch and Principal Engineer Matheus Fernandes cited the LaLiga/Telefonica court order and reported that ISPs are "blocking entire IP ranges, not specific domains or content." Among them, the IP addresses 66.33.60.129 and 76.76.21.142, "used by businesses like Spanish startup Tinybird, Hello Magazine, and others operating on Vercel, despite no affiliations with piracy in any form."
While clearly unhappy with how the company has been treated, Vercel says it's now working with LaLiga.

"We remain committed to providing fast, secure infrastructure for modern web applications. Likewise, we expect enforcement efforts to do the same: targeted, transparent, and technically sound. We are in contact with La Liga and are collaborating to remove illegal content in accordance with the court order. We're exploring mitigation strategies to restore access for Spanish users and continue to advocate for an open and permissionless web," Vercel concludes.
Piracy

Massive Expansion of Italy's Piracy Shield Underway (techdirt.com) 21

An anonymous reader quotes a report from Techdirt: Walled Culture has been following closely Italy's poorly designed Piracy Shield system. Back in December we reported how copyright companies used their access to the Piracy Shield system to order Italian Internet service providers (ISPs) to block access to all of Google Drive for the entire country, and how malicious actors could similarly use that unchecked power to shut down critical national infrastructure. Since then, the Computer & Communications Industry Association (CCIA), an international, not-for-profit association representing computer, communications, and Internet industry firms, has added its voice to the chorus of disapproval. In a letter (PDF) to the European Commission, it warned about the dangers of the Piracy Shield system to the EU economy [...]. It also raised an important new issue: the fact that Italy brought in this extreme legislation without notifying the European Commission under the so-called "TRIS" procedure, which allows others to comment on possible problems [...].

As well as Italy's failure to notify the Commission about its new legislation in advance, the CCIA believes that: this anti-piracy mechanism is in breach of several other EU laws. That includes the Open Internet Regulation which prohibits ISPs to block or slow internet traffic unless required by a legal order. The block subsequent to the Piracy Shield also contradicts the Digital Services Act (DSA) in several aspects, notably Article 9 requiring certain elements to be included in the orders to act against illegal content. More broadly, the Piracy Shield is not aligned with the Charter of Fundamental Rights nor the Treaty on the Functioning of the EU -- as it hinders freedom of expression, freedom to provide internet services, the principle of proportionality, and the right to an effective remedy and a fair trial.

Far from taking these criticisms to heart, or acknowledging that Piracy Shield has failed to convert people to paying subscribers, the Italian government has decided to double down, and to make Piracy Shield even worse. Massimiliano Capitanio, Commissioner at AGCOM, the Italian Authority for Communications Guarantees, explained on LinkedIn how Piracy Shield was being extended in far-reaching ways (translation by Google Translate, original in Italian). [...] That is, Piracy Shield will apply to live content far beyond sports events, its original justification, and to streaming services. Even DNS and VPN providers will be required to block sites, a serious technical interference in the way the Internet operates, and a threat to people's privacy. Search engines, too, will be forced to de-index material. The only minor concession to ISPs is to unblock domain names and IP addresses that are no longer allegedly being used to disseminate unauthorized material. There are, of course, no concessions to ordinary Internet users affected by Piracy Shield blunders.
In the future, Italy's Piracy Shield will add:
- 30-minute blackout orders not only for pirate sports events, but also for other live content;
- the extension of blackout orders to VPNs and public DNS providers;
- the obligation for search engines to de-index pirate sites;
- the procedures for unblocking domain names and IP addresses obscured by Piracy Shield that are no longer used to spread pirate content;
- the new procedure to combat piracy on the #linear and "on demand" television, for example to protect the #film and #serietv.
DRM

How a Nephew's CD Burner Inspired Early Valve To Embrace DRM (arstechnica.com) 37

Valve's early anti-piracy efforts, which eventually led to the Steam platform, were sparked by co-founder Monica Harrington's nephew using her money to buy a CD burner for copying games, she revealed at last week's Game Developers Conference. Harrington said her nephew's "lovely thank you note" about sharing games with friends represented a "generational shift" in piracy attitudes that could "put our entire business model at risk."

Half-Life subsequently launched with CD key verification in 1998. When players complained about authentication failures, co-founder Mike Harrington discovered "none of them had actually bought the game," confirming the system worked. Although easily bypassed, this early protection influenced Steam's more robust DRM implemented with Half-Life 2 in 2004, which became the industry standard for PC game distribution.
Piracy

Italy Demands Google Poison Its Public DNS Under Strict Piracy Shield Law (arstechnica.com) 94

"Italy is using its Piracy Shield law to go after Google," reports Ars Technica, "with a court ordering the Internet giant to immediately begin poisoning its public DNS servers" to prevent people from reaching pirate streams of football games.

"Italy's communication regulator praises the ruling and hopes to continue sticking it to international tech firms." Spotted by TorrentFreak, AGCOM Commissioner Massimiliano Capitanio took to LinkedIn to celebrate the ruling, as well as the existence of the Italian Piracy Shield. "The Judge confirmed the value of AGCOM's investigations, once again giving legitimacy to a system for the protection of copyright that is unique in the world," said Capitanio. Capitanio went on to complain that Google has routinely ignored AGCOM's listing of pirate sites, which are supposed to be blocked in 30 minutes or less under the law. He noted the violation was so clear-cut that the order was issued without giving Google a chance to respond, known as inaudita altera parte in Italian courts.
Piracy

Feds Arrest Man For Sharing DVD Rip of Spider-Man Movie With Millions Online (arstechnica.com) 30

An anonymous reader quotes a report from Ars Technica: A 37-year-old Tennessee man was arrested Thursday, accused of stealing Blu-rays and DVDs from a manufacturing and distribution company used by major movie studios and sharing them online before the movies' scheduled release dates. According to a US Department of Justice press release, Steven Hale worked at the DVD company and allegedly stole "numerous 'pre-release' DVDs and Blu-rays" between February 2021 and March 2022. He then allegedly "ripped" the movies, "bypassing encryption that prevents unauthorized copying" and shared copies widely online. He also supposedly sold the actual stolen discs on e-commerce sites, the DOJ alleged.

Hale has been charged with "two counts of criminal copyright infringement and one count of interstate transportation of stolen goods," the DOJ said. He faces a maximum sentence of five years for the former, and 10 years for the latter. Among blockbuster movies that Hale is accused of stealing are Dune, F9: The Fast Saga, Venom: Let There Be Carnage, Godzilla v. Kong, and, perhaps most notably, Spider-Man: No Way Home. The DOJ claimed that "copies of Spider-Man: No Way Home were downloaded tens of millions of times, with an estimated loss to the copyright owner of tens of millions of dollars."

Nintendo

Nintendo Says Latest Legal Win Against Piracy 'Significant' For 'Entire Games Industry' (eurogamer.net) 25

Nintendo has trumpeted its latest legal success in the company's ongoing fight against pirated games as "significant" not only for itself, "but for the entire games industry." From a report: The Mario maker today confirmed it had won a final victory over French file-sharing company Dstorage, which operates the website 1fichier.com, following years of legal wrangling and repeated appeals. Nintendo's victory means European file-sharing companies must now remove illegal copies of games when asked to do so, or be held accountable and cough up potentially sizable fines as punishment.

In 2021, the Judicial Court of Paris ordered Dstorage pay Nintendo $1 million in damages after it was found to be hosting pirate games. Dstorage launched an appeal, which then failed in 2023, and was ordered to pay Nintendo further costs. But the case didn't end there. Dstorage finally took the matter to the highest French judiciary court, where it argued that a specific court order was required before it needed to remove content from its hosting services. This bid has also now failed, ending the long-running matter for good.

Piracy

Malicious PyPI Package Exploited Deezer's API, Orchestrates a Distributed Piracy Operation (socket.dev) 24

A malicious PyPi package effectively turned its users' systems "into an illicit network for facilitating bulk music downloads," writes The Hacker News.

Though the package has been removed from PyPI, researchers at security platform Socket.dev say it enabled "coordinated, unauthorized music downloads from Deezer — a popular streaming service founded in France in 2007." Although automslc, which has been downloaded over 100,000 times, purports to offer music automation and metadata retrieval, it covertly bypasses Deezer's access restrictions... The package is designed to log into Deezer, harvest track metadata, request full-length streaming URLs, and download complete audio files in clear violation of Deezer's API terms... [I]t orchestrates a distributed piracy operation by leveraging both user-supplied and hardcoded Deezer credentials to create sessions with Deezer's API. This approach enables full access to track metadata and the decryption tokens required to generate full-length track URLs.

Additionally, the package routinely communicates with a remote server... to update download statuses and submit metadata, thereby centralizing control and allowing the threat actor to monitor and coordinate the distributed downloading operation. In doing so, automslc exposes critical track details — including Deezer IDs, International Standard Recording Codes, track titles, and internal tokens like MD5_ORIGIN (a hash used in generating decryption URLs) — which, when collected en masse, can be used to reassemble full track URLs and facilitate unauthorized downloads...

Even if a user pays for access to the service, the content is licensed, not owned. The automslc package circumvents licensing restrictions by enabling downloads and potential redistribution, which is outside the bounds of fair use...

"The malicious package was initially published in 2019, and its popularity (over 100,000 downloads) indicates wide distribution..."
Encryption

VPN Providers Consider Exiting France Over 'Dangerous' Blocking Demands (torrentfreak.com) 44

An anonymous reader quotes a report from TorrentFreak: In France, rightsholders have taken legal action to compel large VPN providers to support their pirate site blocking program. The aim is to reinforce existing blocking measures, but VPN providers see this as a dangerous move, leading to potential security issues and overblocking. As a result, some are considering leaving France altogether if push comes to shove. [...] Earlier this month, sports rightsholders Canal+ and LFP requested blocking injunctions that would require popular VPNs to start blocking pirate sites and services. The full requests are not public, but the details available show that Cyberghost, ExpressVPN, NordVPN, ProtonVPN, and Surfshark are listed as respondents. [...]

The blocking request has yet to be approved and several of the targeted VPN providers have reserved detailed commentary, for now. That said, the VPN Trust Initiative (VTI), which includes ExpressVPN, NordVPN and Surfshark as members, has been vocal in its opposition. VTI is part of the i2Coalition and while it doesn't speak directly for any of the members, the coalition's Executive Director Christian Dawson has been in regular discussions with VPN providers. From this, it became clear that VPN providers face difficult decisions. If VPN providers are ordered to block pirate sites, some are considering whether to follow in the footsteps of Cisco, which discontinued its OpenDNS service in the country, to avoid meddling with its DNS resolver.

Speaking with TorrentFreak, VTI's Dawson says that VPNs have previously left markets like India and Pakistan in response to restrictive requirements. This typically happens when privacy or security principles are at risk, or if the technical implementation of blocking measures is infeasible. VTI does not rule out that some members may choose to exit France for similar reasons, if required to comply with blocking measures. "We've seen this before in markets like India and Pakistan, where regulatory requirements forced some VPN services to withdraw rather than compromise on encryption standards or log-keeping policies," Dawson says. "France's potential move to force VPN providers to block content could put companies in a similar position -- where they either comply with measures that contradict their purpose or leave the market altogether."
"This case in France is part of a broader global trend of regulatory overreach, where governments attempt to control encrypted services under the guise of content regulation. We've already seen how China, Russia, Myanmar, and Iran have imposed VPN restrictions as part of broader censorship efforts."

"The best path forward is for policymakers to focus on targeted enforcement measures that don't undermine Internet security or create a precedent for global Internet fragmentation," concludes Dawson. "As seen in other cases, blanket blocking measures do not effectively combat piracy but instead create far-reaching consequences that disrupt the open Internet."
Piracy

Meta Claims Torrenting Pirated Books Isn't Illegal Without Proof of Seeding (arstechnica.com) 192

An anonymous reader quotes a report from Ars Technica: Just because Meta admitted to torrenting a dataset of pirated books for AI training purposes, that doesn't necessarily mean that Meta seeded the file after downloading it, the social media company claimed in a court filing (PDF) this week. Evidence instead shows that Meta "took precautions not to 'seed' any downloaded files," Meta's filing said. Seeding refers to sharing a torrented file after the download completes, and because there's allegedly no proof of such "seeding," Meta insisted that authors cannot prove Meta shared the pirated books with anyone during the torrenting process.

[...] Meta ... is hoping to convince the court that torrenting is not in and of itself illegal, but is, rather, a "widely-used protocol to download large files." According to Meta, the decision to download the pirated books dataset from pirate libraries like LibGen and Z-Library was simply a move to access "data from a 'well-known online repository' that was publicly available via torrents." To defend its torrenting, Meta has basically scrubbed the word "pirate" from the characterization of its activity. The company alleges that authors can't claim that Meta gained unauthorized access to their data under CDAFA. Instead, all they can claim is that "Meta allegedly accessed and downloaded datasets that Plaintiffs did not create, containing the text of published books that anyone can read in a public library, from public websites Plaintiffs do not operate or own."

While Meta may claim there's no evidence of seeding, there is some testimony that might be compelling to the court. Previously, a Meta executive in charge of project management, Michael Clark, had testified (PDF) that Meta allegedly modified torrenting settings "so that the smallest amount of seeding possible could occur," which seems to support authors' claims that some seeding occurred. And an internal message (PDF) from Meta researcher Frank Zhang appeared to show that Meta allegedly tried to conceal the seeding by not using Facebook servers while downloading the dataset to "avoid" the "risk" of anyone "tracing back the seeder/downloader" from Facebook servers. Once this information came to light, authors asked the court for a chance to depose Meta executives again, alleging that new facts "contradict prior deposition testimony."
"Meta has been 'silent so far on claims about sharing data while 'leeching' (downloading) but told the court it plans to fight the seeding claims at summary judgement," notes Ars.
Piracy

ISP Must Unmask 100 Alleged BitTorrent Pirates In RIAA Lawsuit (torrentfreak.com) 31

An anonymous reader quotes a report from TorrentFreak: Altice, parent company of Internet provider Optimum, must disclose the personal details of a hundred alleged music pirates. The request comes from a group of prominent record labels and is part of an ongoing copyright infringement liability lawsuit (PDF). Altice, meanwhile, will receive anti-piracy information, including that related to a letter the RIAA previously sent to BitTorrent Inc., the owner of popular torrent client uTorrent. [...] Details are scarce, but the group will likely consist of subscribers who were repeatedly warned over alleged piracy activity. The music labels could use this information to gather further evidence to support their allegations. For example, subscriber testimony could help to strengthen the argument that the ISP failed to take effective measures against repeat infringers.

There's nothing to suggest that these people will be approached with any claims directly. The names, emails, and addresses of the subscribers are marked as "highly confidential" and can only be viewed by attorneys acting for the music companies. The subscribers will be informed about the forthcoming disclosure of their personal details and any objections will be heard by the court. [...] Subscriber details are just a fraction of the information requested by the parties during discovery. Altice, for example, will also gain access to some non-privileged documents and communications between the music companies and their anti-piracy partners, including the RIAA, OpSec, and Audible Magic.

This includes information regarding a letter (PDF) the RIAA sent to the company behind the uTorrent and BitTorrent clients in 2015. [...] The nature of information sought by Altice isn't clear. The company previously said that if music labels are concerned about piracy, they are free to go after developers of 'piracy' software. While neutral torrent clients don't fall into that category, the ISP will be interested in any related legal considerations that took place behind the scenes.

Slashdot Top Deals