On his Random Thoughts blog, security researcher Nicholas Weaver speculates about how ISPs, particularly AT&T, could aid the fight against copyright infringement. His proposal to map torrent participants to IP addresses and verify that those addresses are uploading copyrighted material will be controversial, even if it is workable.

Weaver's first observation is that "AT&T probably has a huge incentive to block pirated traffic" because, apparently, 5 percent of its users use 50 percent of the bandwidth. Weaver continues to observe that it's extremely easy to get a hold of pirated content on the Internet. Legal campaigns against BitTorrent search sites have resulted in some small successes, but sites like The Pirate Bay continue to taunt the copyright industry with the likes of a Valentine-inspired sharing is caring slogan.

Weaver's solution?

All that is necessary is that the MPAA or their contractor automatically spiders for torrents. When it finds torrents, it connects to each torrent with manipulated clients. The client would first transfer enough content to verify copyright, and then attempt to map the participants in the Torrent.

The MPAA can then use an automated mechanism to inform the ISPs in question, which can then block the IP address of the BitTorrent user for a short time. This would work much better than wide-scale deep packet inspection. As noted before, routers have a hard enough time just routing the packets.

So what about this torrent mapping approach? Can it work, and would it be an attractive move for the MPAA to make?

Basic operation shouldn't be a problem. The idea behind BitTorrent is that a large file, such as a Divx-encoded movie, is partitioned in 256KB to 2MB parts. People download the parts they don't have yet, and at the same time upload the parts that they do have to others. Because everyone is both downloading and uploading at the same time, the total bandwidth of a BitTorrent "swarm" is huge, and the software is fairly good at making sure the uploading and downloading is tit for tat.

Traditionally, BitTorrent uses a "tracker," a central server that keeps track of everyone downloading a certain file. However, newer BitTorrent clients also use Dynamic Hash Tables, a mechanism that makes it possible to publish and find information (such as torrent participants) without a central server. In both cases a client application needs to find other machines to connect to, so it would be trivially easy for an organization like the MPAA to hook into that and siphon off the list of IP addresses of people participating in a torrent.

It's unclear whether having your IP address listed in a BitTorrent swarm would be sufficient evidence of copyright violation. To show a clear-cut case of copyright infringement, it would likely be necessary for the MPAA to connect to those IP addresses to see if they actually upload pirated content. That would make the process much more difficult, because large swarms can have thousands of participants and getting any specific one to upload to a given client doesn't always work or can take a while. Also, it's uncertain whether a handful of 256KB chunks of a 1.2GB movie uploaded by a single member of a swarm would be sufficient to prove in court that copyright infringement occurred.

The MPAA would itself also have to upload in this scenario in order to avoid being flagged as a "leecher" and therefore ignored. However, once the MPAA is satisfied that a certain address is distributing certain content, the RIAA's legal campaign demonstrates that it's possible (at least in the US) determine which ISP that address belongs to by filing a Doe lawsuit and subpoenaing the ISP.

Filtering these addresses in that ISP's network, or even in the ISP's network can be done by injecting routing information into the network that directs packets to (from is a bit harder) the address in question toward a black hole or a filter. It's not even necessary to go into routers to configure access lists to block packets.

So all of this could certainly work, although it may not work fast enough to make much of a dent in BitTorrent traffic: if it takes the MPAA and ISPs fifty minutes to find a pirate and they then block her for ten minutes, that's still fifty minutes of prime downloading time per hour. So it's feasible, but is it a good idea?

If the MPAA decides that it's game for a legal campaign that will cost it tens of millions of dollars and turn into a PR nightmare, it could certainly happen in the US. A EU commissioner recently called IP addresses "private information," and a European Court of Justice ruling that ISP subscriber data can only be divulged in criminal cases make a legal campaign a much more dicey proposition in the EU. So far, the motion picture industry has contented itself with moving against the P2P sites as opposed to individual users, and there's no sign that will change anytime soon. But if the MPAA decides to open the Pandora's box of litigation, this could be a useful tool