Piracy Shield, I’ll explain all the anomalies. The professor speaks. Zanero

10 March 20242 months ago babelfish

Piracy Shield platform? “We are the only Western country where private entities – without anyone's review of any kind – insert an address on a platform and have it blocked at a national level. This doesn't happen even in China." Startmag conversation with Stefano Zanero, full professor of computer security at the Polytechnic of Milan.

Legal sites also end up within Piracy Shield's range, which have nothing to do with the famous "piece".

The national platform that aims to automatically obscure sites that illegally transmit streaming content donated by the Serie A football league to Agcom to combat the illegal dissemination of sports content has been active for just over a month and is already causing controversy and problems.

On the weekend of 24/25 February the anti-piracy shield intercepted an IP address and the Italian ISPs (Internet Service Providers) promptly carried out the blocking within the expected 30 minutes.

But the IP address in question added to the Piraty Shield platform was from Cloudflare (one of the largest cloud and CDN operators or Content Delivery Network, a network of computers dedicated to the transmission of streaming flows). So from that report, dozens of legal websites were blocked, going offline after the report, victims of the so-called "friendly fire" of the anti-piracy shield.

A fact that did not surprise experts, who had long complained about the dangers hidden by this system.

Start Magazine spoke about risks and consequences of the activity of such a platform with Stefano Zanero, full professor of computer security at the Polytechnic of Milan.

First of all, let's start from the beginning, professor, can you explain how the Piracy Shield platform works?

It is a platform that allows some companies that own the rights to broadcast football matches on TV to carry out a blocking operation for those who illicitly rebroadcast the matches on the Internet. This blocking occurs through the insertion by the rights holder of the IP addresses (i.e. the numerical addresses that identify the computer on the Internet) and/or their domain names. Once this data has been entered on the platform, providers, as a result of the legislation, have a maximum time of 30 minutes to block it, without being able to make any decisions. If the address has been entered on that platform it must be blocked. This has a series of negative implications that we have seen in recent weeks and which will only get worse.

Therefore, Piracy Shield should only obscure illegal streaming sites, yet from the first reports, addresses of legal services were also involved. How come?

This is what industry experts had been saying and singing in praise of for at least a decade. It's not like this idea of blocking IP addresses hadn't already come up. There has always been this tension between those who deal with technology and those who deal with policy: because the latter require certain things to be done that would solve a problem and those who deal with technology also have the moral duty to say that certain things they won't work.

For those who have a superficial knowledge of the subject, on the Internet an IP address corresponds to a computer. Intuitively it says “I block an address and block the bad server that is doing illegal streaming”. In reality, in the Internet today, an IP address can correspond to hundreds of thousands of servers, of a completely different type because there are a series of architectures (for example all those of cloud service providers) as well as all those of CDN systems, i.e. Content Delivery Network, like that of Cloudflare , which almost all high-performance systems use, or Akamai, which are the two big competitors in the sector. These systems use certain addresses that are shared by a large number of their customers.

So it was clear that by blocking IP addresses, hundreds of thousands of sites were involved at a time, one of which was responsible for the illicit dissemination of videos, and all the others were innocent. This thing is inevitable. There is no way to avoid it: when you decide to block IP addresses this will always happen. We already knew it. We've been saying it for fifteen years. We repeated it in court when the blockades on the systems began, I wrote it myself in the expert report relating to the blockages at the time of the blockade of The Pirate Bay, we are talking about a geological era ago. Simpler eras perhaps. We wrote it and told it to the parliamentary commissions, to the ministers, the same was done and the result is this and can only be this.

Yet for Agcom representatives the cases of overblocking were branded, at least initially, as fake news…

This is something that as a public employee, a servant of the State, shocks me.

The fact that people who work for an independent state authority say something that is not true, in full view of everyone, is absolutely unacceptable. Furthermore, something that is not only not true, but something that we know will happen again and will continue to happen. There are no other possibilities. It's not that I'm saying this, but anyone who's ever dealt with the Internet, just ask anyone. All the service providers also said this – that being the object of supervision by Agcom, if Agcom decides to do something it is not like they can do it differently – in any case they made their observations. They have all been ignored because evidently this provision is of capital importance from Agcom's point of view and the fact that reality works differently is not acceptable.

So how can we intervene or rather, how can we straighten things out?

Just turn it off. It's the only way to straighten things out: stop blocking IP addresses. I understand the problem, I understand it very well, but when faced with a problem you cannot intervene with a block which by its nature always involves websites. Blocking IP addresses cannot be done. In addition, there would be a second negligible detail: we are the only Western country where private entities – without anyone's review of any kind – insert an address on a platform and have it blocked at a national level. This doesn't happen in China either. At least the Chinese Communist Party decides to block it, look what I have to say at the dawn of 2024.

Professor, in your opinion, in the name of transparency, should Agcom automatically publish the list of access inhibition measures implemented through Privacy Shield?

In a democratic country it would seem normal to me that at least someone would know why a certain site has been blocked. It seems basic to me. I understand the problem: if they publish the list of blocked sites, they are also making available the address book of where to go to watch these matches. If this blockade – which is already technically exaggerated – at least worked, the problem wouldn't exist. What problem would we have publishing the list of resources that are inaccessible anyway?

The reality of things is that a VPN placed on a foreign server is enough and anyone who wanted to access these contents can access it anyway. So if we give him the list, we are giving him the list of TV programs to choose from. I understand the problem, but on the one hand it is unacceptable that there are blocks – of which no information is even given as to why a given address has been blocked – and on the other, if we cannot publish it because this creates the TV schedule of all the illicit transmissions, then perhaps the blocking system is of no use either.

Finally, a slightly more “philosophical” question: the Piracy Shield case is proof that, even with a strictly limited mandate (i.e. illegal streaming of sporting events), the consequences of attempts to control the digital arena remain unpredictable ?

Meanwhile in this case they were very predictable. The point is: on the one hand this type of system has the tendency to be applied to other things too. Usually when we make this observation we are accused of being suspicious, giving in to the slippery slope paradox, whereby you always fear that one thing could lead to another, then to another and another. In this case I cannot be accused of this because Agcom's declarations shortly after the platform came into operation were that since it works so well we can extend it to other things. For starters: these things always extend.

The second problem, of a philosophical nature but also extremely practical, is that of inserting mechanisms that not only allow blocking to be carried out, but which carry them out without any review by the judiciary, without any possibility of review because whoever is blocked does not even have the elements to know you were blocked, then to complain about it. I don't even know how all this is conceivable within the democratic state. This thing is completely beyond my expertise, because I am a technician, I am not a jurist, but I have seen jurist friends complain about it so I understand that I am not the only one who has the perception that something is wrong.

Since you were asking me about the consequences from a philosophical point of view, there is also a consequence of changing what we consider acceptable. Something that if we put it in simple words sounds like this: a private company can decide without any form of review to block access to a random site without anyone being able to say anything. This thing, put like this, is unacceptable. If we start making it acceptable then it will be acceptable for this to happen in other fields too. It is also a question of a philosophical nature: there are red lines that are there and it is right to defend them precisely when it seems obvious why we need to cross them.

It is true that here we are talking about defending an economic right of these television broadcasts, however, in a democratic nation, the rights must be balanced among themselves. The economic right to earn comes long after other rights: the right to express oneself, the right to communicate and receive information. These are all rights that come first. So for this reason the discussion must be structured within a court, a process where rights are balanced. It is not clear why this specific right of an economic nature should be so pre-eminent compared to everything else as to create this system which skips a whole series of guarantees which objectively in a democratic nation we will have taken for granted.

This is a machine translation from Italian language of a post published on Start Magazine at the URL https://www.startmag.it/innovazione/piracy-shield-vi-spiego-tutte-le-anomalie-parla-il-prof-zanero/ on Mon, 04 Mar 2024 17:52:08 +0000.