4 Attachment(s)
Did a Court Really Authorize Internet Service Providers to Block Cloudflare?
On the back of a report that LaLiga and Telefonica sought enhanced blocking measures to counter use of Encrypted Client Hello, LaLiga's earlier suggestion that blocking Cloudflare has judicial support, seems worthy of a closer look. Indeed, a process that authorizes dynamic junctions in Spain suggests a super-streamlined system that puts piracy-fighting above all else. At the same time, there are few obvious measures to prevent overblocking affecting third-parties.
With the prospect of future piracy taking place within encrypted networks designed for connectivity and enhanced privacy, the current concept of blocking may have limited shelf life.
Yet, the commitment to blocking shows no sign of retreat. Blocking requests are now so common that even the courts have grown accustomed to their frequency. Given the often harmonious outcome, some courts allow plaintiffs and defendants to solve their own problems, rather than get unnecessarily involved in the mechanics of the solution.
The Relentless Drive to Keep On Blocking
At a time when momentum is building in favor of administrative site-blocking schemes, with either limited or no judicial oversight at all, less optimal levels of scrutiny may be arriving at an inopportune time.
A year of controversy in 2024, concerning Italy’s Piracy Shield, is now overshadowed by hostilities in Spain. After Cloudflare was deliberately blocked by LaLiga/Telefonica despite multiple warnings of collateral damage, the push towards unsupervised private sector site-blocking is back under the spotlight.
Yet, the shift from court-ordered blocking towards (semi-)privately administered systems is already well underway. But a plan detailing what happens when it all goes wrong, or who might have any authority to slam on the brakes – and when, is yet to emerge.
Such a framework seems unlikely to surface voluntarily; full blocking transparency isn’t required anywhere it takes place.
Tried, tested, and effective: Dynamic Injunctions
So for the sake of curiosity, how does one go about blocking a pirate site in Spain? Or more likely, 100 pirate sites that may shut down, deploy mirrors, change their names and/or locations, or otherwise become evasive at the first sign of trouble?
For rightsholders with resources, a dynamic injunction may help. By anticipating pirate site countermeasures in advance, dynamic injunctions aim to spend more time blocking than requesting new permissions in court. Having become increasingly flexible over time, dynamic injunctions are now edging towards previously unthinkable capabilities.
Showing common ownership or direction of pirate sites is mostly a thing of the past. If a site disappears and a similar one appears, that’s often enough to justify blocking without further involvement of the court. If content offered on a pirate site is similar to content offered by a site previously blocked, in Italy that seems to be more than enough. Since no judge needs to conduct a review in Italy’s administrative process, blocking can also happen immediately.
While Spain has a similar administrative blocking system, dynamic injunctions obtained separately are sanctioned by the judiciary. Obtained by rightsholders with a specific need for more immediate and flexible blocking, a dynamic injunction was recently used by LaLiga to block Cloudflare, hoping to put pirate sites using Cloudflare’s services out of action at the same time.
Targeting potentially shared IP addresses with such measures is both rare and controversial. In a statement published Thursday, LaLiga defended the action.
“The blocking of certain IP addresses by Internet service providers (ISP) is the result of strictly executing a final court ruling, issued after a due assessment and evaluation of the multi-million dollar damages that audiovisual fraud and digital fraud cause to the legitimate owners of the rights and to the economy,” the statement reads.
“Consequently, blocking is implemented by Internet service providers. Regarding certain IP addresses that provide shelter to sites and web resources from which crimes are committed, the basis can be found in a firm judicial resolution.”
Article 138. Injunctions and Urgent Precautionary Measures
The basis for similar injunctions can be found in Spain’s Intellectual Property Act (Ley de Propiedad Intelectua)
In its first paragraph, Article 138 explains that a rightsholder can apply for an injunction to restrain the unlawful activity of an infringer. In practical terms, however, if the infringer happens to be a pirate site operator with a track record of ignoring all communications, a restraining order could prove toothless.
However, in line with established tradition, if a direct copyright infringer proves elusive, targeting other entities remains an option. Pirate sites have hosting companies, so it may be possible to throw some threats in that direction, but the preference in Spain is to sue easier targets. Consumer-focused ISPs tend to have subscribers who consume content from the pirate sites. To end that infringement and satisfy the case against them, all the ISPs have to do is block the pirate sites.
As the text reveals, the ISPs’ activities as intermediaries are not in themselves infringing. The direct infringers can be found elsewhere, but since the ISPs can block their sites, that can give the impression that a pirate site is offline, which may be good enough to deter use.
ISPs Haven’t Always Cooperated, They Do Now
Blocking a few pirate sites is unlikely to lead to much hardship and pirate operators aren’t especially likely to suddenly sue, at least not anymore. The ISPs weren’t being asked to block a legitimate business like Cloudflare either. Well, at least not in the beginning and besides, permission would never be granted to do that, surely?
Concerns not unlike these featured in early site-blocking cases in Australia, the UK, mainland Europe and elsewhere. In many cases, ISPs initially refused to block and were only compelled to do so following extended hearings. ISPs also fought hard to ensure no liability was incurred by them, and any associated costs wouldn’t leave them drastically out of pocket.
Today’s considerations are at once more complex and more straightforward. They’ll eventually be heard in the United States as part of the FADPA bill, but in what form remains to be seen. There’s no universal framework, but total agreement between rightsholders and service providers can produce the best results, although not necessarily for everyone.
Suing Friends and Family
When LaLiga applies for a dynamic injunction, it sometimes does so jointly with Telefonica. Known for its telecoms interests as an ISP, Telefonica recently bought the rights to
broadcast LaLiga matches in Spain for 1.2 billion euros.
As rightsholders, LaLiga and Telefonica sue local ISPs, including several owned by Telefonica. They are asked to block pirate sites that illegally broadcast LaLiga matches, to protect the legal broadcasts of Telefonica-owned Movistar+. A court in Barcelona summed up the arrangement in a 2022 dynamic injunction decision.
Given that several of the ISPs are owned by Telefonica and also provide legal access to LaLiga matches, it’s no surprise that defendants in these ‘lawsuits’ prefer not to fight. Indeed, the ISPs accept the allegations in the complaint and then agree to whatever terms the plaintiffs demand.
Indeed, the plaintiffs and defendants settle their differences so well, the court signs off on the blocking order “without further formalities.” An adversarial process this is not.
The Miracle of Cooperation
As evidenced by recent events, the absence of conflict and total agreement between the parties in court, doesn’t necessarily eliminate controversy when blocking gets underway.
Earlier this week, blocking targeting Cloudflare to protect Movistar+ broadcasts of LaLiga games to which Telefonica owns the rights. As a side effect, this also prevented Movistar/Telefonica customers from accessing legitimate sites using Cloudflare. After initially declining to address complaints fielded by their own customers, Telefonica and Movistar issued separate statements in one voice.
Quote:
“[A]s an operator we comply with any type of court order received regarding illegal content.”
LaLiga, meanwhile, explained that the blocking measures are authorized by the court. A more nuanced reading is that when all parties agree on a way to settle a ‘dispute’, the court is inclined to issue a “favorable judgment” on the terms requested. Compliance may therefore amount to doing what was always intended.
Do the Ends Justify the Means?
The bottom line sees the court presiding over a dispute that in material terms doesn’t actually exist, but nevertheless seeks to tackle a genuine piracy problem using the preferred solution.
With approval from the court, these injunctions are unrivaled in both power and flexibility. What they appear to lack are explicit guardrails to prevent overblocking. LaLiga says it would prefer to work with Cloudflare rather than block it, and there’s no reason to doubt that.
Even if the means of obtaining the injunction sounds a little too cosy, local and EU law recognizes the companies’ right to defend against mass infringement, albeit after consideration of factors including proportionality and fundamental rights.
It’s said that with great power comes even greater responsibility. Who is responsible for moderating power within the confines of an infinite authorization loop isn’t clear. It should be.
