Literally illegal. Discussing crimes doesn’t equal crime, so there’s no reason for them to requeust IPs. And at least in the EU you aren’t even allowed to disclose information related to your person.
They don’t care. It’s the film industry equivalent to the Microsoft support scammers. Get a bunch of targets, spam out hundreds of thousands of threatening emails, profit off the small percent of people who fall for it.
I had a Microsoft support scammer once… I let him in to my system too…well not really.
I quickly spin up a quick fresh install of slack ware Linux in a virtual machine that didn’t even have x11 never mind wine installed. When it was up I told him a friend uses something called tellynet (aka telnet but I was playing dumb) to help me on the computer.
He telnetted in and could not understand why any of his malware wasn’t working…
uses something called tellynet (aka telnet but I was playing dumb)
I wonder if he got the joke, or was a scriptkiddie who just relies on existing tools without understanding them, and thought you meant television or similar.
They’re basically telemarketing workers with hacking tools provided by an employer. They follow scripts and click the buttons they’ve been trained to use.
I’m surprised they got in with telnet and not their usual RDP. However I’m not sure they would have gotten anywhere on a Linux box with commands that are so different, unless they were a little familiar with at least MacOS (bash or zsh based now a days).
Yes they do. They are boxed in neatly in the current laws and unless you are discussing specifics about doing a crime in the past or future, they will not get that subpoena and thus they are in a catch 22.
Now if you are actively torrenting, chances are you could run into one of those fake peers that will grab your IP and they can start suing you. But other than that they would need real good evidence to subpoena.
Subpoenas are tools the government uses to compel a private entity to provide information. This isn’t that though, this is one private entity asking another private entity to just give them data. It’s not a legal case, and because of our non-existant privacy regulations in the US, Reddit is free to just hand over this information, or not if they want. No crime has to even be alleged, Reddit can just hand that information out.
Ok yes sorry I should have specified, what you’re saying might apply to the US.
What I said applies to the EU.
Thing is, companies need to know beforehand if they are dealing with a user from US or EU because they don’t wanna break laws when they have to deal with the court system anyway on stuff like this. So technically they could transmit information about US citizens, but in practice this is super tricky and risky.
Let’s say you got an IP. Alright you can pinpoint The location. Problem: you don’t know whether you just grabbed the target IP or an IP from a VPN or a proxy. There’s ways to obscure this so you might not even be able to find out. Now if you turn this over, there’s a small risk you just did a crime because they are spoofing their location. And if you just captured a VPN or proxy, you are now pursuing the wrong person and in EU law this won’t go over well.
So in practice there’s basically no way to do this and be sure you didn’t make a mistake, and mistakes in law are risky and costly. No company would ever take such a risk.
Now I could go into detail about all the technical details on why things work like that but it would make this twice as long.
TL;DR in theory you are right for US users, in practice there’s no way to tell and it gets risky pretty fast.
Also obligatory IANAL and always check in with a lawyer if you need specific legal advice.
That’s a really interesting point, has it been tested in court? The article is about US companies and US websites so I figured EU law was irrelevant, but I am curious to see if the EU can claim jurisdiction for actions foreign companies take outside the EU, regardless of if they have any official EU presence.
Well I can not give you a specific case for that, but it widely accepted that online actions against users from the EU that violate laws in the EU can get persued.
Do you remember seeing some US websites saying “we don’t service EU users at the moment”? That’s because they didn’t want to get a lawyer so they can comply with the EU GDPR back then. I assume this is because they knew there was some precedent.
If you are keen on it I can go digging for case law though.
Note that one of the headings literally says “Why US companies must comply with the GDPR” and the answer is “because it is extra-territorial in scope”.
On that page you linked, they say “So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis.” So it hasn’t really been tested yet it seems. It’s true that there are extradition treaties and interpol that aid in cross-border prosecution, but that tends to be used primarily when the alleged crime happened in the prosecuting country’s jurisdiction, or the alleged crime is handled similarly in both countries. A GDPR violation by a US company wouldn’t be considered a crime at all in the US, so it’s entirely possible that they might decline to assist in prosecution.
Ok you wound me up now so I had a little scouring of the internet.
Yes, I can not find case law of extradition of US based companies through US entities.
What I can find is a couple of cases against bigger companies that also act in the realm of the EU. Google has been fined in the Netherlands for global violations if I understand correctly. Meta has been fined even a few times for global violations, enforced in Ireland.
So yes, technically enforcement in the US is not guaranteed, but they basically can’t build up their company in the EU anymore unless they deal with it. It’s not perfect, but violations can still suck for business expansion, and that is good. and then I do have to look into the new EU data privacy laws if they changed enforcement or anything else important.
You should read the article. I don’t agree with them, but it’s more nuanced than that/isn’t about discussing piracy.
They are basically trying to get the IP‘s so that they can claim frontier is at fault and not being proactive. It is not actually targeting the users in a way that is designed to go after them individually. It’s trying to prove users are using frontier to pirate with impunity.
I literally said I don’t agree with them lol but the point is they aren’t trying to figure out who is discussing piracy on Reddit. They are trying to implicate frontier. Again, I don’t agree. I am against this.
The important legal concept is that it’s literally impossible for discussion of piracy to entitle them to any information in any possible context.
The target of their harassment does not matter. Giving them a single bit of data is every bit as unconditionally unacceptable in either case, and you don’t get to any ruling on anything else unless you bypass that.
Again, this isn’t about the discussions. They are taking IP’s discussing it and tracing them to frontier. They’re “moving upstream” instead of targeting users, which means they need less info,the discussion themselves are immaterial because they aren’t targeting individuals - which means it’s more likely. This is a different tactic.
It is exclusively about the discussion. If discussion doesn’t entitle them to any information, that’s the end of everything. They have no path to proceed in a case or get a ruling on anything else without that barrier being destroyed.
They have many ways to harass both users and companies if it is. It’s the only line that means anything. There can’t be any precedent set on anything else without that being trampled.
Great explanation, it’s what I was hoping to write until my lemmy client crashed with the unfinished comment.
I’m curious what would happen if some copyright holder tried to get information about a user on lemmy. Iirc only the users instance could log their IP, but almost all instances are run by volunteers, so risking a lawsuit might no be viable. Just look at what Tachiyomi devs have to go through, even though all they’re doing was and is legal.
Literally illegal. Discussing crimes doesn’t equal crime, so there’s no reason for them to requeust IPs. And at least in the EU you aren’t even allowed to disclose information related to your person.
They don’t care. It’s the film industry equivalent to the Microsoft support scammers. Get a bunch of targets, spam out hundreds of thousands of threatening emails, profit off the small percent of people who fall for it.
I had a Microsoft support scammer once… I let him in to my system too…well not really.
I quickly spin up a quick fresh install of slack ware Linux in a virtual machine that didn’t even have x11 never mind wine installed. When it was up I told him a friend uses something called tellynet (aka telnet but I was playing dumb) to help me on the computer.
He telnetted in and could not understand why any of his malware wasn’t working…
I wonder if he got the joke, or was a scriptkiddie who just relies on existing tools without understanding them, and thought you meant television or similar.
They’re basically telemarketing workers with hacking tools provided by an employer. They follow scripts and click the buttons they’ve been trained to use.
I’m surprised they got in with telnet and not their usual RDP. However I’m not sure they would have gotten anywhere on a Linux box with commands that are so different, unless they were a little familiar with at least MacOS (bash or zsh based now a days).
Yes they do. They are boxed in neatly in the current laws and unless you are discussing specifics about doing a crime in the past or future, they will not get that subpoena and thus they are in a catch 22.
Now if you are actively torrenting, chances are you could run into one of those fake peers that will grab your IP and they can start suing you. But other than that they would need real good evidence to subpoena.
Subpoenas are tools the government uses to compel a private entity to provide information. This isn’t that though, this is one private entity asking another private entity to just give them data. It’s not a legal case, and because of our non-existant privacy regulations in the US, Reddit is free to just hand over this information, or not if they want. No crime has to even be alleged, Reddit can just hand that information out.
Ok yes sorry I should have specified, what you’re saying might apply to the US.
What I said applies to the EU.
Thing is, companies need to know beforehand if they are dealing with a user from US or EU because they don’t wanna break laws when they have to deal with the court system anyway on stuff like this. So technically they could transmit information about US citizens, but in practice this is super tricky and risky.
Let’s say you got an IP. Alright you can pinpoint The location. Problem: you don’t know whether you just grabbed the target IP or an IP from a VPN or a proxy. There’s ways to obscure this so you might not even be able to find out. Now if you turn this over, there’s a small risk you just did a crime because they are spoofing their location. And if you just captured a VPN or proxy, you are now pursuing the wrong person and in EU law this won’t go over well.
So in practice there’s basically no way to do this and be sure you didn’t make a mistake, and mistakes in law are risky and costly. No company would ever take such a risk.
Now I could go into detail about all the technical details on why things work like that but it would make this twice as long.
TL;DR in theory you are right for US users, in practice there’s no way to tell and it gets risky pretty fast.
Also obligatory IANAL and always check in with a lawyer if you need specific legal advice.
That’s a really interesting point, has it been tested in court? The article is about US companies and US websites so I figured EU law was irrelevant, but I am curious to see if the EU can claim jurisdiction for actions foreign companies take outside the EU, regardless of if they have any official EU presence.
Well I can not give you a specific case for that, but it widely accepted that online actions against users from the EU that violate laws in the EU can get persued.
Do you remember seeing some US websites saying “we don’t service EU users at the moment”? That’s because they didn’t want to get a lawyer so they can comply with the EU GDPR back then. I assume this is because they knew there was some precedent.
If you are keen on it I can go digging for case law though.
EDIT: Nevermind I literally only had to do one Google search and here’s an official link: https://gdpr.eu/compliance-checklist-us-companies/
Note that one of the headings literally says “Why US companies must comply with the GDPR” and the answer is “because it is extra-territorial in scope”.
On that page you linked, they say “So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis.” So it hasn’t really been tested yet it seems. It’s true that there are extradition treaties and interpol that aid in cross-border prosecution, but that tends to be used primarily when the alleged crime happened in the prosecuting country’s jurisdiction, or the alleged crime is handled similarly in both countries. A GDPR violation by a US company wouldn’t be considered a crime at all in the US, so it’s entirely possible that they might decline to assist in prosecution.
Ok you wound me up now so I had a little scouring of the internet.
Yes, I can not find case law of extradition of US based companies through US entities.
What I can find is a couple of cases against bigger companies that also act in the realm of the EU. Google has been fined in the Netherlands for global violations if I understand correctly. Meta has been fined even a few times for global violations, enforced in Ireland.
So yes, technically enforcement in the US is not guaranteed, but they basically can’t build up their company in the EU anymore unless they deal with it. It’s not perfect, but violations can still suck for business expansion, and that is good. and then I do have to look into the new EU data privacy laws if they changed enforcement or anything else important.
You should read the article. I don’t agree with them, but it’s more nuanced than that/isn’t about discussing piracy.
They are basically trying to get the IP‘s so that they can claim frontier is at fault and not being proactive. It is not actually targeting the users in a way that is designed to go after them individually. It’s trying to prove users are using frontier to pirate with impunity.
That’s not really extra nuance, and is about discussing piracy.
The premise that an ISP has an obligation to proactively monitor traffic when they shouldn’t even legally be permitted to do so is disgusting.
I literally said I don’t agree with them lol but the point is they aren’t trying to figure out who is discussing piracy on Reddit. They are trying to implicate frontier. Again, I don’t agree. I am against this.
That’s not a meaningful distinction.
They’re still trying to take action against discussion of piracy. The target does not matter and is not meaningful to the discussion.
What? That is incredibly meaningful. The legal implications are are very distinct, and also open some pretty frightening doors.
If we can’t even distinguish the legal channels they are trying to screw us with, how can we possibly protect Internet privacy?
I get you want to win an Internet argument or whatever but let’s keep our eye on the ball here, dude
The important legal concept is that it’s literally impossible for discussion of piracy to entitle them to any information in any possible context.
The target of their harassment does not matter. Giving them a single bit of data is every bit as unconditionally unacceptable in either case, and you don’t get to any ruling on anything else unless you bypass that.
Again, this isn’t about the discussions. They are taking IP’s discussing it and tracing them to frontier. They’re “moving upstream” instead of targeting users, which means they need less info,the discussion themselves are immaterial because they aren’t targeting individuals - which means it’s more likely. This is a different tactic.
It is exclusively about the discussion. If discussion doesn’t entitle them to any information, that’s the end of everything. They have no path to proceed in a case or get a ruling on anything else without that barrier being destroyed.
They have many ways to harass both users and companies if it is. It’s the only line that means anything. There can’t be any precedent set on anything else without that being trampled.
Great explanation, it’s what I was hoping to write until my lemmy client crashed with the unfinished comment.
I’m curious what would happen if some copyright holder tried to get information about a user on lemmy. Iirc only the users instance could log their IP, but almost all instances are run by volunteers, so risking a lawsuit might no be viable. Just look at what Tachiyomi devs have to go through, even though all they’re doing was and is legal.
I am very much against this and totally agree. I think this could open some really dangerous doors re: internet privacy.
Wear a VPN, folks.
My server is in Brazil. So fuck those companies.
If discussing crimes equals crime then police, CEOs, and politicians should all be in jail.
If they were held accountable for their crimes then police, CEOs, and politicians would already all be in jail.
It’s not illegal if they ask for it and reddit gives it to them.
I’ve always read it that action must be taken, above and beyond speech.
I could argue that these users collaborated to break the law and did so, but I don’t see that being argued. Fuck I know, INAL.