Serie A Legal Action Claims Cloudflare Helps Pirates Evade Piracy Shield

Billed as the most advanced anti-piracy system ever, Italy's Piracy Shield had no chance of living up to the hype. It transpires that just eight weeks after its launch early February, top tier football league Serie A filed a complaint at an Italian court accusing Cloudflare of providing "services to pirates" that undermine Piracy Shield. In parallel, the system is already exceeding blocking limits agreed with ISPs. Now the law needs to be changed, so domains and IPs can be unblocked to free up capacity.
During the first week of April 2024, the CEO of top Italian football league Serie A was brimming with confidence.

Luigi De Siervo said that Piracy Shield, Italy’s brand new anti-piracy blocking system, was having such an effect that “No pirate can sleep peacefully.” Those who doubted its capabilities, he implied, should note what Serie A investigators were seeing on pirate Telegram channels after the system’s launch; ‘excitement’ apparently, but of what kind wasn’t made clear.

Piracy Shield Had an Exciting First Two Months
It’s certainly possible that when AGCOM finally admitted that weeks earlier Cloudflare had indeed been blocked in error, that may have caused a little excitement.

Maybe Piracy Shield code leaking online helped to get pulses racing too, or perhaps a third party site, publishing blocking data that the authorities should’ve published, but did not, could be somewhat responsible?

It’s not out of the question that the figures released in the first week of April played their part: 10,000 sites blocked in 60 days was a powerful statement, with the caveat that for technical reasons, that wasn’t entirely true.

Legal Action Ensues

If the excited pirates had known at the time that Serie A had filed a legal complaint against Cloudflare just days before these figures were released, that might’ve been cause for excitement. More likely it would’ve been confusing, however, because despite all talk of blocking successes outside court, inside court Cloudflare was being painted as an underminer of blocking and a partner of pirates.

A summary of the complaint, filed at the Court of Milan on April 3, 2024, arrives courtesy of La Repubblica (paywall). Numerous allegations leveled against the U.S. company can be boiled down to one thing; the circumvention of Piracy Shield’s blocking measures via Cloudflare’s services, by consumers of streams and pirate suppliers alike.

According to Serie A, a pirate strategy is playing out online. While circumventing Piracy Shield’s best efforts, pirates of all kinds are spreading instructions online to train others. This includes information on how to remain anonymous, an important skill for those wishing to avoid AGCOM’s recently elevated piracy fines.

All of this is made possible thanks to Cloudflare, Serie A informed the Court.

‘Facilitating Pirate Sales and Providing Escape Routes’
In the words of La Repubblica, Serie A’s legal team accuse Cloudflare of “providing pirate match dealers” with the “dealing room and the exit routes” to evade capture.

Specifically, Cloudflare is under fire for providing its free VPN, otherwise known as WARP, which according to the league “moves the connection between pirates and their customers from a public network to a private one, in a secret circle where it is possible to operate outside the controls of the authorities.”

Last October, the head of AGCOM described the promotion of VPNs among pirates as “positive news” on the basis that their apparent intent would mean limited avenues of defense. In its complaint filed at the Court of Milan, Serie A bemoaned Cloudflare’s apparent resistance when it comes to handing over subscribers’ traffic logs.

And then there’s Cloudflare’s CDN service, which allegedly pipes streams as closely as possible to football fans for clear, uninterrupted viewing. Serie A insists that Cloudflare could easily reject pirate services as customers but apparently does not. Cloudflare’s DNS also gets a mention; unlike DNS services mostly operated by ISPs in Italy, Cloudflare’s has none of the site-blocking drawbacks of those compelled to work with AGCOM.

Serie A also complained about a flood of emails allegedly sent to AGCOM by Cloudflare customers protesting the blocking of the company’s IP addresses in February. Serie A’s attorneys say that since this campaign was orchestrated by Cloudflare, the company forfeited its neutrality as a service provider.

More Woes For Piracy Shield

Just one of the many serious flaws highlighted by experts, even before Piracy Shield had a name, was the danger of placing domains and IP addresses on a blacklist, with no mechanism in place to remove them. Concerns were even aired that the country might simply run out of accessible IP addresses.

Of course, those at the more enthusiastic end of the internet blocking market showed little concern about unblocking these internet assets at the time, but appear to be regretting it now. Wired.it reports that ISPs were assured that the number of fully qualified domain names (FQDN) blocked would not exceed 18,000, with IP addresses capped at 15,000.

With the football season almost over in Italy, rightsholders reportedly filed 1,332 tickets to the Piracy Shield system on May 24, for a total of 3,626 IP addresses and 15,791 FQDNs added to the ISPs’ blacklists. Since the law passed year has no provision for removing domains or IP addresses from the list, AGCOM will now prepare a report for the government requesting the power to do so.

The irony of a blocking system vacuuming up scarce IP addresses which, at least in part, is a shortage that Cloudflare’s system exists to mitigate, is unlikely to pass the company by.

The Court of Milan will ultimately have to decide whether to investigate the claims against Cloudflare. It seems highly improbable that it will also be required to investigate the football broadcasting monopoly in Italy, or the coincidental subscription price rises imposed since the launch of Piracy Shield.