IGF 2022 Day 1 Lightning Talk #18 Off-Shore hosting, a legitimate use of an ASN or a subterfuge?

The following are the outputs of the captioning taken during an IGF intervention. Although it is largely accurate, in some cases it may be incomplete or inaccurate due to inaudible passages or transcription errors. It is posted as an aid, but should not be treated as an authoritative record.

***

 

>> MODERATOR: Can you guys hear me online?

Please just say hi. Good to see all the usual suspects. Welcome.

Welcome, everyone. Good afternoon from Ethiopia. And good evening, good morning from other parts of the world. Welcome to this session on IGF 2022 lightning talk on offshore hosting. We'll be talking about ASN or Subterfuge. And the person who will be giving the talked to is Lee Kent affiliated with AAPA and media group. And I will probably be your on-site moderator today. My name is Caleb Olumuyiwa Ogundele. Thank you for coming in. But first, I would like to confirm if Lee is online right now. Go ahead and introduce your lightning talk.

>> LEE KENT: Thank you. Sport and entertainer broadcast and three different languages. So the internet is -- all its good uses. Unfortunately, as we all know, there are some bad actors. Part of that is what I'm going to talk to you today. Being members of the audio visual anti-piracy lines. And way of introduction to AAPA. These are our members of the alliance.

We all work closely together on issues concerning content rights and ownership and the distribution of those rights on content. And broadcasters as well. This approach mission statement is to lead efforts talking anti-piracy and beyond through the facility of the collaboration amongst members and others working closely with wider group of audiences to understand key issues and solutions to tackle those. Lobbies for better legislation and enforcement. Build partnerships with private and public sectors to achieve more efficient enforcement. The lightning talked to is about part of that landscape who facilitate in the distribution of piracy. And as you may or may not know, provide landscape continues to evolve and become proliferated with companies using the term offshore hosting. For us, curious term given the fact nothing can be truly offshore and the aim of this talk is to engage with everything there. To understand what does it actually mean?

And how can we get a better understanding of how ASNs are used. Is our view correct or have we missed something?

I would like some interruption from everybody in the room to have some questions and understanding of our position. The ultimate aim is to seek to understand whether or not structure of offshore hosting is legitimate or established to facilitate criminality. The structure and offshore host. They don't appear to own any physical hardware. Thick or questionable headquarters in countries. The IPs from outside the ASN registered territory. However, they heavily depend on inter connections and renting service within nature hubs and the U.S. to name a few. They have had ripe ASNs which we don't know whether or not that is a deliberate act or whether or not it's just the opportunity or the process they have gone through in order to get an ASN. The benefits advertised by the offshore hosts is they have that accredited ASN.

And one particular one is the example I'm using here. Headquarters address is in Hong Kong. Use IPs and they rent service base in the Netherlands. Which then gives them the ability to be able to advertise. They have hardware and based in the European union in particularly the Netherlands. Further examples of what the benefits are or the advertising bragging rights for these off shore hosts. They will keep your content, your web site or whatever it is you have hosted with them online no matter what. They also advertise the fact they will ignore or at least encourage the fact that they will not deal with DMCA notices. I will come on to what those are in a moment. One of them, one particular hosting company has even gone as far as offering services to support elicit distribution of IP TV systems in providing easy access to a TV platform that distributes content on all broadcasters at a global level. It's not particularly expensive. 200 TV streams could be 2,000 end users accessing that service and having an impact on broadcasters on the distribution rights. Offshore host and providers. Typical demonstrated here. The way they are organized is that they will be assigned an ASN through a local internet registrar and that is -- gained from that -- I see somebody's posted a question.

Not at all. We're not saying that all offshore hosting is for bad. As I mentioned in my opening content, the question is an open question. Is an open question to you guys. That is legitimate use. Certainly, the ones that I'm now describing in the examples I'm giving. The view is they are being used primarily for criminal interests. When actually they could be used in a better way. This is a two-way conversation. And I'd be very keen to pick up -- pick that up with you. Coming back to -- yes, Caleb.

>> CALEB OLUMUYIWA OGUNDELE: Sorry about the interruption. Some of the audience in the room would want you to read out the questions that have been asked online so they can get the questions and they can follow along.

>> LEE KENT: Yes. I'll repeat the question. Internet is for global good. Offshore infrastructure solves concerns.

[ Audio breaking up ]

>> LEE KENT: Wants to portray all offshore and reiterating the point this is an open question on whether or not what we see is unique and in a way unique to facilitate criminality. And these examples that are now working through, and in the examples I'm giving, is that the normal?

Is that the standard for all offshore hosting companies to be set up? So it's a question. And if you have any answers or any comments to that particular question, feel free to post them.

For those in the room, please put them to Caleb. I want this to be an open discussion. That's the whole purpose of this particular session. So the answer is yes. Could be 100 times or 1,000 times as good as a portion of your eternal copy right revenues that might be heard. Only viewed with a short site. To this user posting the questions, this is becoming a bit of a destruction I'm afraid. I appreciate your point of view, however the revenues of copy right are quite substantial. And this is the entertainment on creative art globally.

So we're not just talking about TV content. There are many forms of creative content distributed across the internet and this impacts all. And the user in the chat I do feel you are not addressing the question that I'm asking. I am going to move on.

>> CALEB OLUMUYIWA OGUNDELE: Sorry to interrupt. What I would suggest is for all the questions in the chat, you can answer them after your presentation.

>> LEE KENT: Yep. I agree. So moving on. As I mentioned, ASN numbers for the offshore hosting companies are assigned through local registrar who gets it from regional registrar. What we have seen is that it's the owner of the ASN. However, the ASN is used across multiple companies who on research are ultimately down streaming here. And ending up back with host one. And its host one that maintains the upstreaming connectors with the on-shore elements. So those hardware-based service in Europe under the UK. So how do content owners broadcast this and other members direct the issue of infringement?

The first step is always to send DMCA notice. It's a degenerative copy right notice which is a piece of U.S. legislation which has been accepted globally. Because it sets out some particular standards. The content owner must meet for any host or ISP to accept that particular play. Firstly, must demonstrate you make the claim and have to provide evidence of the infringement and then you have to address where the infringement content to be removed. For the most, it works. And once they've done their review. And their checks and content is removed.

However, for a large proportion of the offshore hosting companies, this isn't the case. So next step to be program with the host company sending physical letters and emails to any emails that we can find associate with our company. If they continue to go unresponded to, then we will look to leave action. That in itself can be a challenge. As mentioned, generally, web sites for the most don't have any contact pages. Company addresses a fake or P.O. boxes and making legal recourse is difficult in legislation because the owners of the horsing company cannot be traced. So why is this an issue to the audio-visual industry and beyond?

This is an example of one particular off-shore hosting company and reviewing data for the last six months for policies. And 90% of our requests take down content were ignored. As I mentioned earlier --

>> So you have first question from someone who looks like Sebastian.

>> Thanks for the presentation. It was interesting. Your last slide, I think asked about taking all reasonable steps. I want to start there. The two things, I guess, I was thinking about it would be helpful to hear more about maybe. One is in no particular order. One is if these hosts are -- have touch points with another lens in the UK which have very mature legal systems, why wouldn't you go to court and say I need an order against the well identified hosting provider who is selling to these guys?

Get a John Doe order and figure out who is their customer and go after those people. Normally, I would think you'd want a court order rather than DMC order. And then the other question. And you didn't talk about the financial flows. And the first thing I would have thought of is these guys are receiving money somehow. I bet they are receiving money rather than Z-cash. So why not go after the financial flows?

That would be the other -- the orders against the western European providers.

>> LEE KENT: In terms of doing subpoenas, that itself brings additional problems. Unfortunately, there has been some attempt to do that. The one in particular is a case with sports on scale away. Unable to provide any details of the user siting on infrastructure because they didn't keep any records. And it was found that was reasonable. There are other considerations that are currently going through and whether or not we can use that in other jurisdictions and working with other copy rights organizations to look at the legalities and whether or not we can proceed with us. In terms of follow the money, as a private entity, we have limited resources to follow money. We do have the ability to make information requests. And, again, that is a process we're currently going through. Again, it's challenging because, as you said, we have to find the way that the money is received in the first place.

And they do certainly the organizations we've interrupted with do use payment facilities that make it challenging to investigate and challenging to track. So all the elements you have mentioned, we are using them and we are going through those processes. And this is basically something that's in parallel to those processes and actions. It is really about getting that understanding.

The person who put the questions forward online, we do want to have an overall view and we do appreciate it. In a way, we are looking at this purely from our point. What we see and how it facilitates copy right infringement. We have no reason to look at it to be honest from any other way. So it's an open view to challenge the status quo ultimately and if somebody wants to tell us and demonstrate that, yes, this is perfectly acceptable and normal for ASNs to be used like this, then change our minds. At the moment, we only say it one way.

>> CALEB OLUMUYIWA OGUNDELE: We have one more question.

>> My name is Leslie and I work with Erin. So the thing about policies to issue autonomous system numbers, they are very easy to obtain. You either have to have a unique routing policy or you have to tell us you are going to be multi homed with another autonomous system or interconnect with another autonomous system. There's not a lot of vetting done for that. You give us who your other system is going to be. And we look at it. And do some vetting but it's very simple and it is in the ripe region as well.

So anyone can get one basically as long as you are multi homed. If there's illegal activity, if a number of resource is being used for any illegal activity, our services agreement says go back and pursue that with law enforcement. If something is reported, I believe ripe would do something similar. If you can report that and show us something hard core. Something that can sort of prove this is happening. Something we can take to law enforcement. Law enforcement needs really concrete evidence before they'll even look at it. In the U.S., the FBI has to see there's some type of financial damage. If you can show us things like that or provide evidence to us, first of all, we would research it more fully. But we could turn it over to law enforcement or at least assist. We have general counsels that can look at these things and liaise with law enforcement. It is fairly simple. As an RAR, we ensure you follow the unique policies. You can get an IP address or autonomous system's number if you can meet community established policy. We don't look much further as to how you are utilizing the resources until it comes to them being used illegally. Hope that makes sense to you.

>> LEE KENT: Most definitely. I do appreciate that. It's a question we've had. And one of the reasons why I've made the request to speak at the IGF to have these conversations. Ultimately, we want to work with and not against and by having an insight into this Eco system and the processes, I believe that we can work a lot closer in making the internet a better place. Is it possible at all we could connect offline?

>> CALEB OLUMUYIWA OGUNDELE: Absolutely, she said. I will try and get a contact and share with you. I just wanted to adjust one additional question on the role of some of those folks which some of them distribute content which is a little bit illegal. And then you look at the statute of limitation. And you find out you can get to prosecute some of them. Given the operations within sudden regions. Don't have strong copyright act laws that can protect you. So even though you try to follow the money, the laws that can help you prosecute some of those guys -- most copy right laws now do not include internet or some of the African laws I know of do not have more of the use of internet infrastructure as part of their copyright stuff. The copy right law act are not strong enough to help you prosecute. Maybe you might have a little thing to talk about that, Lee.

>> LEE KENT: Certainly. That's one of AAPA's roles in gathering information and doing white papers in order to lobby government to recognize copy right. Our focus as mentioned in the beginning on Europe and the Middle East. Have been working closely with the EU government to change legislation and to make things better.

In France and the European union currently look at a new piece of legislation which will help protect content and copyright and the creative services across the board. That is currently being dispersed in the finer detail is being worked out. And hopefully been enacted, that will be good legislation that protects not just the creative services but people's online presence within Europe and potentially countries. Hopefully, it's a domino effect. We saw that with the DMCA. And that was globally accepted. So their thinking is the new EU law that once that's established will have the same. And those conversations will continue in all of the territories where IP legislation is not -- hasn't matured in a way that the internet has matured.

>> CALEB OLUMUYIWA OGUNDELE: There are no questions from the audience here on site. So if there are no questions -- I see a question come online on the role of WIPO in all of this.

>> LEE KENT: Yeah. Sheila is the chair of AAPA. And just reminding me WIPO also has a role in setting standards in legislation. It's a statement. Not a question.

>> CALEB OLUMUYIWA OGUNDELE: Okay. Great. If there are no questions from the online audience, I guess, Lee might want to say thank you to everyone for coming.

>> LEE KENT: I do appreciate it. Thank you very much. Your points and questions have been very welcomed, and I feel like we're on a good road. Thank you.

>> CALEB OLUMUYIWA OGUNDELE: So on that note, we are adjourned. Thank you so much, everyone, for coming.

>> LEE KENT: Thank you very much for facilitating.

>> CALEB OLUMUYIWA OGUNDELE: My pleasure. Thank you.

>> LEE KENT: Thank you. Thank you, everyone. Good-bye.