The Pirate Bay is an FBI honeypot? A disconcertingly plausible conspiracy theory

http://motherboard.vice.com/read/the-pirate-bay-is-an-fbi-honeypot-a-disconcertingly-plausible-conspiracy-theory

by nreece • 11 years ago

75 63 11 years ago

motherboard.vice.com

oceanstone• 11 years ago

“In a post-Snowden world,” Sanabria said, “nothing would surprise me.”

That's the spirit.

TheOtherHobbes• 11 years ago

I'm not so sure about TPB.

4chan, however...

cLeEOGPw• 11 years ago

Who is this 4chan you are talking about?

junto• 11 years ago

Decentralize all the things.

eloisant• 11 years ago

Well Bittorrent is decentralized, because you can use one of the other dozens of torrent sites that exist besides TPB.

xyzzy123• 11 years ago

Yep. The protocol is one thing, but what's also needed is distributed curation. This is a trickier problem that no one has solved yet [for a universal system where no-one has to go to jail].

There's a user story in this: "I use this thing to get stuff that I want". If the system backing that action isn't distributed then it's vulnerable.

For the average user, a legit torrent site is indistinguishable from a spam site. TPB have actually done an enormous service to the Internet for years by reducing the amount of malware installed by "download assistants" and so on. Despite the issues with many of the torrents themselves.

rakoo• 11 years ago

You must be talking about indexing torrents then, which has nothing to do with bittorrent per se. It's "just" a website where people drop content and comments evaluating the quality of said content. Indexes are used for searching for and retrieving content.

Bittorrent is decentralized, but Bittorrent (the protocol) says nothing about how you retrieve a torrent. It starts the moment you have retrieved a torrent (or, possibly, a magnet link), and not before.

simplicio• 11 years ago

The article gives rather short shrift at the end to what seems like a pretty strong argument against this theory, which is that it isn't clear what it would get the FBI. Is there any info they can get from running the site that they can't from just logging torrent traffic?

Plus, while the FBI is allowed to facilitate minor illegal actions during under-cover operations (like having one of their agents work as a mod at Silk Road), this would involve them essentially paying for and running the infrastructure for hundreds of thousands of acts of piracy. I'm pretty sceptical the people in charge would sign off on that, especially if most of the information could be gathered using other methods.

ryanlol• 11 years ago

There isn't really any valuable information FBI could get from the site, especially since TPB doesn't operate their own tracker anymore. Only possibility would be getting IPs the uploaders use to log into the site, but that's pretty far fetched.

mmmooo• 11 years ago

It's not unheard of for the fbi to operate (and pay for) the infrastructure to facilitate and even promote piracy. See "operation bandwidth" where they essentially did just that for 2+ years. Granted that effort was targeted somewhat higher up the food chain then your average home user trying to download a copy of the latest overhyped blockbuster.

sarciszewski7• 11 years ago

Is there any info they can get from running the site that they can't from just logging torrent traffic?

Yes!

They can glean the IP addresses of the people who upload torrent files to TPB by running a honeypot. There's a much stronger case going after the providers of stolen material than the consumers.

Does that mean they're doing that? I don't know.

EDIT - REPLY LIMIT HIT - REPLYING HERE SINCE I CAN'T RESPOND BELOW

If that's what they wanted to do, couldn't they just set it up so they continuously downloaded all new torrents and looked at the ip of the initial seeder?

How do you know you got the new seeder and not the first consumer? That's less reliable than "hey look an HTTP/1.0 POST with the exact torrent file came from this IP address at this time".

Lewton• 11 years ago

If that's what they wanted to do, couldn't they just set it up so they continuously downloaded all new torrents and looked at the ip of the initial seeder?

dwild2• 11 years ago

Well one of them will have 100% of the content and the other one 0%...

Beltiras• 11 years ago

They could be, but then they just don't understand the tech involved. If you want to log who's seeding, just hop onto the torrent and log away.

anon4• 11 years ago

Which would be less honeypot set up by the FBI and more FBI agents loafing around the park covertly checking which of the thousands of people singing copyright infringing songs also swap pictures of naked children.

tinco• 11 years ago

What is also a disconcertingly plausible conspiracy theory? The recording industry spreading the rumor on Twitter that filesharing sites are being monitored by the FBI.

Not that I believe that, but it's simple to point out that all evidence for this theory is a bunch of Twitter messages with second hand information.

Nice journalism on Vice's part..

rnhmjoj• 11 years ago

I think they would monitor who is actually sharing the copyrighted files with bittorrent, not who log into tracker sites. There is nothing illegal with visiting the pirate bay, right?

Shank• 11 years ago

Correct. Even clicking a magnet link or getting a torrent file doesn't say you'll connect to the swarm and download it. You're only pirating once you do that, and you start getting pieces of the files in the torrent.

stefantalpalaru• 11 years ago

It doesn't make sense. You can get 99% of the real IPs by simply connecting to each swarm.

porpoisemonkey• 11 years ago

I don't necessarily subscribe to the theory but one possible angle is that they want members to log into the site. I suspect that it's easier to prove a user account (with a privately held secret password and activity history) belongs to an individual than just an IP address.

failed_ideas• 11 years ago

FBI honeypot? Why bother, just cross reference your advertising shadow profiles with a few trackers of what you're interested in. Combine that with the scrape Canada is doing with all the download services, and the pre host intercepts to AWS, Google, Microsoft, etc... that the NSA is doing and you capture all the file transfers for all but the savviest of people. Operating TPB would expose them to potential liability at home. I highly doubt the MPAA/RIAA/etc... are not going to sue if they found out the FBI is directly responsible for disseminating 300K copies of frozen and Taylor Swift's album for free to capture the fairly useless proxied VPN of the uploaders. America and Canada have proven that they don't need to operate the hosts, they can capture all the data just fine without exposing themselves to the risk.

Regardless, assume the FBI/NSA/CSIS/MI-X/etc... are capturing everything you do including the comments on here, reddit, twitter, Facebook, 4-chan, torrent, tor, and really everywhere else. The can unravel that onion, so unless it's carefully encrypted, and it on the internet, assume the governments either have it or have access to it.

PlzSnow5• 11 years ago

Why would I assume that the FBI/NSA are capturing everything I do online? It's an absurd proposition without a shred of evidence.

celticninja• 11 years ago

The capture everything done online and store it. They can wait until you become a person of interest then plug your email address and name into the system to get your Amazon, eBay purchases, Google searches, FB comments and likes, GPS data from your phone to see where you went, who you were with by cross referencing FB friends and their phones GPS data.

They are not looking at you specifically but they are keeping your data in case one day they do want to look at you.

RottenHuman2• 11 years ago

In case you lived under a rock the last two years:

https://en.wikipedia.org/wiki/Global_surveillance_disclosure...

https://en.wikipedia.org/wiki/Tempora

https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

chippy• 11 years ago

you forgot the /s

nabla9• 11 years ago

http://www.theguardian.com/world/2013/jul/31/nsa-top-secret-...

https://en.wikipedia.org/wiki/XKeyscore

nickik2• 11 years ago

You are either a brilliant troll or kind of a idiot.

madaxe_again• 11 years ago

Ironically, those of us who live in countries where access to TPB is censored, like the UK, have to use tor to access TPB - and therefore this method of tracking would be utterly ineffectual.

If it is a honeypot, it's pretty crappily made one, with honey dribbling out through a crack and "hunny" written on it.

koyote• 11 years ago

So, in another ludicrous conspiracy, one could assume that the UK government knows about the honeypots the FBI sets up, then adds them to the banned website list in order to protect its citizens?

AlyssaRowan2• 11 years ago

Actually it's currently not blocked on the ISPs I've tested, and I know why. The existing order doesn't cover CloudFlare, and much of the blocking was IP-based false route injection, not DNS-based or HTTP-Host:/TLS SNI-based.

If there is no existing censorship infrastructure installed at the respondent ISPs which can fulfil the terms of the existing court order, the applicant may need to go back to court - and it may need a re-hearing, as the order was allowed only on the basis that existing infrastructure could do it. I don't think the Digital Economy Act site blocking provisions made it in, so there's no primary legislation, no case law that I know of (bearing in mind I'm just an interested layperson!), this specific thing was discussed and specifically dropped in Parliament, and the balance of harm has changed.

I don't know if it's a honeypot - the staff are reportedly locked out, and CloudFlare (US) might be as neutral as they can be when it comes to what they reverse-proxy, but The Pirate Bay (real or not) is possibly the most internationally-notorious website in the world; a ruthless test of CloudFlare's legal and technical resilience if it's not FBI. (I certainly wouldn't expect them to hold the line in these circumstances!)

But I can't see what the site itself would really get the FBI/etc. that they can't get by easier means: these are all public torrents and they run no tracker.

Either way, I'm getting popcorn.

jrochkind13• 11 years ago

Woah! Good observation!

Yeah, this could get good. Will countries block Cloudflare entirely, potentially forcing cloudflare to refuse to have piratebay as a customer? Will they require cloudflare to provide special IP's used just for piratebay? Will they give up?

It would not have occured to me that something as simple and widespread as using cloudflare -- so widespread by 'legit' businesses that nobody can think it's just a tool for criminals -- would put such a wrench in current censorship attempts.

Go internet!

jrochkind13• 11 years ago

This argument doesn't make any sense at all.

If the FBI were running PirateBay, why would they need CloudFlare to grab IP addresses?

Who knows if the FBI is running the new pirate bay, but this article provides no particular reason to think so.

sarciszewski7• 11 years ago

If the FBI were running PirateBay, why would they need CloudFlare to grab IP addresses?

More like: They're harvesting IP addresses, and they're using cloudflare to disguise the IP address of the server? That's what I would do if I were an FBI cybercrime team member assigned to this case.

jgrahamc• 11 years ago

The main concern people seem to have is the site's use of CloudFlare, a content delivery tool company that can protect sites from DDoS attacks and help manage a large influx of traffic.

To do this, it grabs IP addresses (a number assigned to each internet-connected device by its internet service provider that can often be used to identify a person), which conspiracy-minded folks say would be a nice thing for the FBI to have. Theoretically, if CloudFlare is saving these IP addresses, the FBI could subpoena CloudFlare for that data. And if the government is actually running the site, then it would have those IP addresses by default.

This is a very confusing argument. If the FBI controls The Pirate Bay then it wouldn't need CloudFlare to be able to get the IP addresses of people connecting to The Pirate Bay because... they'd be The Pirate Bay and so would see people connecting.

nickik2• 11 years ago

The IP is also not enougth, you need to prove that these people actually downloaded files and that still happens peer to peer, right?

nissehulth• 11 years ago

They could be more interested in people uploading stuff, aka posting new torrents. That's done on-site.

sarciszewski7• 11 years ago

I think a more convincing argument is that they're relying on CloudFlare to hide the IP address of the server, which is probably not very covert.

http://www.wired.com/2013/08/freedom-hosting/

"It just sends identifying information to some IP in Reston, Virginia."

If the FBI does nothing else, they learn from past mistakes.

eli• 11 years ago

Wouldn't a non-FBI owner of Pirate Bay also want to obscure the IP of the server just as much? I don't really follow this argument.

skidoo• 11 years ago

I've always been weary of TOR, considering its origins. And I think Silk Road was co-opted ages ago.

jackweirdy• 11 years ago

Presumably you’re also weary of all encryption algorithms that have ever come out of NIST then.

lawnchair_larry3• 11 years ago

Probably not the best example anymore.

lawnchair_larry3• 11 years ago

Curious, is that because you don't understand it and are not familiar with the people developing it?

rilita• 11 years ago

It's unsafe to torrent on a IP that can be connected to you. Nothing has changed. Carry on.

sys32768• 11 years ago

I read somewhere a few months ago many websites through TOR had suddenly started popping up CAPTCHAs on CloudFlare, which apparently requires enabling JS. Why would CloudFlare start doing that to known TOR users?

The Pirate Bay is an FBI honeypot? A disconcertingly plausible conspiracy theory

Related Stories