LaLiga/Cloudflare Crisis: ISPs Urged to Action Amid Mass Overblocking

With assistance from Spain's leading ISPs, LaLiga continues to block pirate sites, Cloudflare, and thousands of innocents caught in the crossfire. Legal action by Cloudflare and hacking collective RootedCON tried to bring the chaos to an end but their requests were dismissed last month. Meanwhile, a non-profit group is demanding that all ISPs participate in nationwide blocking.

judge-block When rightsholders feel that conditions are optimal, site-blocking measures are presented to countries as a proportionate, precise, and entirely reasonable response to rampant piracy.

Should there be a need for new legislation, care should be taken to provide room for rightsholders to maneuver, to ensure that adaptive pirates are placed under maximum continuous pressure.

Under intense pressure itself by an impatient United States demanding that piracy needed to be taken more seriously, Spain spent years doing just that. The success story includes over a decade of site-blocking that generated zero controversy.

Piracy blocking applications even appeared to decline in 2024. A far cry from the days when a call-out on the USTR’s Priority Watch List seemed inevitable, but still light years adrift from the disaster playing out in Spain since February.

With Great Power Comes….Massive Blocking

In 2022 LaLiga and Telefonica, owner of broadcaster Movistar, found room for legal maneuver. Understandably frustrated that their premium live sports broadcasts were instantly pirated, the companies convinced a court that rapid, dynamic blocking would be a proportionate response to IPTV piracy.

These blocking orders presented new problems. The crisis currently playing out in Spain shows how easily circumvented technical restrictions can be rendered almost useless. This, in turn, triggered a disproportionate response leading to substantial collateral damage.

When enhanced privacy features at Cloudflare undermined blocking, the power of a new court order issued last December allowed LaLiga to block Cloudfare itself and by default, many thousands of innocent Cloudflare customers.

Block and Awe

After a court rejected appeals by Cloudflare and hacker collective RootedCON in March, LaLiga now appears to be blocking whatever it needs to block to get the job done. And it’s a big job, as updates from sysadmin @jaumepons on X reveal.

300 of 12382 domains behind 1 IP address

According to @jaumepons, Cloudflare IP addresses are currently being blocked by LaLiga at the rate of 3,000 every week. For perspective, Italy’s Piracy Shield caused uproar when it blocked less than a handful.

Each IP address serves thousands of innocent Cloudflare customers and whichever pirate streaming service happens to be taking cover among them.

3000 ip cloudflare
Despite having no links to pirate sites, the number of domains said to be affected by IP address-based blocking appears to be disproportionate to the stated aim. The claim that many newspapers have been caught up in the dragnet is concerning; the claim below is more disconcerting than anything else.

????
self-block
Unsolicited Press Release

While we’re generally averse to parroting press releases without broader context, a communication received late Wednesday piqued our interest and then proved unusually puzzling. The author is the Spanish non-profit DigitalES and at the time of writing the release doesn’t appear on the group’s website. Its intentions, however, are made clear right off the bat:

DigitalES, the Spanish Association for Digitalization and the employers’ association for the telecommunications, technology, and digital innovation sectors, is calling for the cooperation of all Internet intermediaries to ensure compliance with the court order requiring the blocking of resources linked to pirated audiovisual content.

—-snip—-

This court ruling is based on the material impossibility of implementing DNS-level blocking as a measure against online piracy. The main reason is that websites with illegal content and the intermediary companies that connect them to the internet employ various techniques (such as ECH or Relay) to change their IP addresses and circumvent these restrictions. Therefore, the most viable solution is considered to be either directly blocking the IP addresses associated with pirated content, or a combined strategy that includes blocking domains, URLs, and IP addresses .
Despite the agreement reached with most of these web traffic intermediaries to implement this solution, some services are not implementing the court order.
Whether the overblocking situation is linked to lacking implementation at some providers isn’t clear. In fact, the press release doesn’t mention overblocking at all; it notes the failed legal actions by Cloudflare and RootedCON but says nothing about the controversial events that triggered them.

Other Relevant Details

It may be a coincidence that Telefonica, Vodafone, MásOrange, and DIGI, are directly linked to the blocking action in Spain, while also being members of DigitalES. That no mention is made of these companies in the DigitalES press release might be an oversight, but with vested interests in how the current situation plays out, a few extra details of their involvement may prove informative.

The blocking injunction obtained last December was a joint effort by LaLiga and Telefónica Audiovisual Digital (TAD), which operates the Telefonica-owned subscription digital TV platform known as Movistar Plus+. In January it was reported that Telefonica had retained the domestic rights to broadcast LaLiga matches until the end of 2026/27 season, in a deal worth €1.29bn (US$1.43bn).

The injunction protects this investment by providing the legal basis for blocking measures at four named ISPs;

• MásOrange: Operator of brands including Orange, Yoigo, Jazztel, Masmovil, Simyo, Pepephone, Lebara, Lyca, Llamaya, and Euskaltel. An agreement between Orange and Telefonica-owned Movistar and DAZN secured broadcasting rights for LaLiga matches.
• Vodafone: LaLiga matches are available on Vodafone TV through a deal with DAZN
• DIGI: Romanian telco sells access to LaLiga matches via its DIGI TV platform in Spain
• Movistar: Telefonica-owned telco (LaLiga shown on Movistar+)

The process through which blocking injunctions are obtained is typically non-adversarial. Ultimately signed-off by a judge, ISPs are indeed compelled to implement piracy blocking measures, albeit under pre-arranged terms to which they all agreed.

The theory is straightforward. LaLiga/Telefonica monitor the internet for pirate streams and send their IP addresses to the ISPs. Once the ISPs add those IP addressees to their internal blacklists, their own customers watching those streams can no longer do so.

The companies believe that with enough disruption, pirates will decide to go legal. How well that’s going right is unclear. The massive overblocking of Cloudflare denies access to legitimate platforms for pirates and non-pirates alike.

A Surprise Intervention

According to RootedCON, Vodafone surprised by intervening in its case.

One of the most controversial points in the development of the case has been Vodafone’s intervention: before the judge made a decision, it appeared to reject RootedCON’s presence in the legal process. The operator maintained, now with the support of the judge, that the only ones entitled to challenge the ruling were the operators that were sued at the time by LaLiga and Telefónica.

However, they themselves have not filed their own request for annulment. “What Vodafone is effectively saying is that operators are happy to be forced to block.”
And as distributors of LaLiga content, purchased at considerable expense, that makes complete sense. As internet service providers knowingly blocking legitimate resources and their own non-pirating customers? Not so much.