The company behind the Oscar-nominated film Dallas Buyers Club sued 31 people in a federal district court in Texas this month for allegedly using the legal file-sharing service BitTorrent to download the movie illegally. The lawsuit is one of thousands that have been brought by companies against BitTorrent users in recent years, in an effort to crack down on Americans who are stealing movies, music, porn, books, and software. But it could have a tough time. Recently, several federal judges have ruled that key information—computer Internet Protocol (IP) addresses— used by film studios and others to target supposed thefts is insufficient proof to proceed with the lawsuits. And copyright experts say that even though companies are still winning lots of settlements, these firms are going after fewer plaintiffs at once than they were a few years ago. This suggests that their ability to pursue large piracy cases has been hampered.

"I think the trend is towards judges looking at [piracy] cases more carefully than they used to, requiring more upfront investigation," says Mitch Stoltz, a staff attorney at the Electronic Frontier Foundation (EFF). "There may always be some judges who will simply rubber-stamp these cases...but there are fewer of those judges than before."

When companies bring copyright lawsuits, they often don't know the identities of the alleged pirates. (This was true in the Dallas Buyers Club case.) Instead, they use IP addresses, unique numbers assigned to each device on an internet network, to track the computers that have been used for illegal downloading. Then they ask a judge to issue a subpoena to the internet service providers, so they can obtain the name of the person associated with that IP address. If the judge approves this request, plaintiffs can make additional demands, such as seeking a copy of the person's hard drive. Armed with this information, the plaintiff then typically forces the defendants to settle. The average settlement ranges from $2,000 to $5,000, says Jeffrey Antonelli, a Chicago attorney who has represented numerous people accused of illegal BitTorrent use.

But this strategy isn't perfect. "IP addresses are continuing to be less and less of an indicator of the identity of a particular person or computer on the net," says R. Polk Wagner, a law professor at the University of Pennsylvania who specializes in intellectual property law. The name connected to an IP address usually identifies who is the paying the internet bill, not who is doing the downloading. Ten years ago, most people didn't use wireless routers at home, but now, more than 60 percent of people do. And all the computers using a single wireless router have the same IP address. So if your tech-savvy neighbor is piggybacking off your wireless internet—and illegally downloading Mean Girls—you could take the heat. And Stoltz, from the Electronic Frontier Foundation, points out that when people receive settlement letters, they are often scared into paying up—"even when they didn't download illegally, or had valid defenses."

Here's an example of how imprecise IP addresses can be in pinpointing a specific computer: In 2012, law enforcement tried to catch a person making online threats to local police in Indiana by tracing the person's IP address to a specific house. After a SWAT team broke down the door and tossed a couple of flashbangs into the entryway, they realized they'd gotten the wrong place. The home had an open wi-fi router. The threats were coming from down the street.

Recently, some judges have become more wary about granting subpoenas to companies who come to them with only IP addresses. Last month, a judge in the US District Court for the Western District of Washington at Seattle dismissed a case brought by the studio that produced Elf-Man—a direct-to-video Christmas movie—against 152 anonymous defendants. According to the judge, "simply identifying the account holder associated with an IP address tells us very little about who actually downloaded Elf-Man." In May 2013, a federal judge in California came down hard and issued a $81,320 fine against copyright holders that were "porno trolling" or going after people accused of downloading porn illegally. According to the judge, the plaintiff, Ingenuity 13 LLC, relied too heavily on IP addresses and did not do an adequate enough investigation to bring claims. And in May 2012, a federal district judge in New York reached a similar conclusion about IP addresses, as did a federal judge in Illinois the year before. Wagner notes, "Judges are increasingly realizing that [IP addresses] don't have a high degree of reliability, and they're not an accurate representation of who has control of the computer."

Antonelli, the Chicago attorney, takes a different position. "Sure, we've seen a sprinkling of courts that have taken this position,” he says, “but in my opinion, it's not enough, especially when you look at just how many lawsuits are being filed. I don't see a trend yet." He notes, however, that studios are no longer going after tens of thousands of plaintiffs at once, like they were doing from 2011 to late 2012. In 2011, for example, the producers for Hurt Locker sued almost 25,000 BitTorrent users—and almost all the claims were voluntarily dismissed by the studio, because it was taking too long to track down all of the defendants via their IP addresses. "That's certainly changed. Typically we see no more than 100 defendants...I think that was a smart move on the plaintiffs. Courts were losing patience," says Antonelli. Wanger adds, "It's possible companies think that if they sue fewer people who are doing more significant activities, that's a more defensible public relations approach." (The Motion Picture Association of America and the Recording Industry Association of America didn't provide comment to Mother Jones as to whether studios are now going after fewer plaintiffs.)

For now, whether or not the Dallas Buyers Club producers will be able to successfully subpoena the alleged downloaders remains to be seen. (An attorney representing the producers did not return multiple requests for comment.) "It really depends on the judge assigned to the case," says Stoltz. He says movies studios should be able to bring claims that are plausible, based on the facts they gather before suing.

The founder of the website Die Troll Die, who goes by the name John Doe, says that he started his website to fight alleged copyright trolls after being sued for copyright infringement—something he claims he didn't do. He says he's happy to see that the tide is turning against companies using IP addresses to bring lawsuits. He told Mother Jones via email, "I can say first-hand that being threatened with a lawsuit because someone else used your internet connection is a horrible experience."