Last month, movie companies Svensk Filmindustri and Nordisk Film, and anti-piracy partner Rights Alliance were handed an IP address by Cloudflare believed to be in use by The Pirate Bay.
Armed with this information they went to court in Sweden, obtaining an injunction targeting Obenetwork, claiming the ISP operated the IP address. It transpired the address was actually owned by VPN provider OVPN and the injunction was thrown out.
In response, the plaintiffs filed for a new injunction against OVPN, demanding that the provider hand over the information about its customer, which they believe to be The Pirate Bay. Last week, OVPN informed TF that they would fight the case and we can now provide some details on its initial position.
The injunction application is disputed by OVPN in its entirety but the company also homes in on specific aspects that it hopes will resolve the matter.
No-Logs to Hand Over, Specific IP Address No Longer in Use
Firstly, as a no-log provider, OVPN says that it does not have access to the information requested in the injunction, including the name and address of the customer who used its IP address, how long that customer used the service, or how much money was handed over.
While that’s straightforward enough, it’s alleged that the OVPN customer used the provider’s Public IPv4 add-on. That tool is covered by exactly the same no-logging policy but since in this case a static IP address is assigned to a specific customer, OVPN does have a limited ability to determine who is using it, but only at the time it’s in use. Once that use has expired, it has no ability to carry out retroactive checks.
“[W]e can not provide any information as to who had a specific Public IPv4 address at a specific date, as users are free to change Public IPv4 address at will, and another user might have been using that Public IPv4 address at that time,” the company explains.
To illustrate this restriction, OVPN told the court that anyone attempting to access The Pirate Bay using the IP address listed in the application would find that the website can’t be reached. Furthermore, anyone trying to ping the address would find that it’s completely unavailable. Since it’s not currently in use, OVPN can’t say who was using it.
The Electronic Communications Act
According to OVPN’s response to the injunction, the provision of a VPN service “does not constitute a notifiable activity” as referenced by Sweden’s Electronic Communications Act. As a result, VPN services are exempt from the data storage obligations of the legislation.
OVPN argues that VPN services operate over the top of an Internet connection like any other Internet-based service might. Citing the Tele2 case that went all the way to the European Court of Justice, the provider says that it does not provide an electronic communications service as described under the Act and is not subject to its storage obligations.
Precautionary Measures and Financial Damage
In their application (which was conducted without OVPN being aware of the procedure) the studios and Rights Alliance demanded financial penalties if OVPN did not provide the requested information plus penalties if they deleted any user information that could show who used the IP address at the specified time.
According to OVPN, the precautionary measures demanded by the applicants were not backed up by evidence showing exceptional circumstances, as required under case law. The company further rejects suggestions made in the application that it is somehow a bad actor for providing a privacy service.
“We wholeheartedly disagree with the Rights Alliance claims that we’re running a ‘disloyal service’ used to circumvent law enforcement. On the contrary, we have a wide range of different customers, such as journalists, lawyers, politicians, government agencies and consumers.
“To be perfectly clear: We do not, in any way, endorse or advocate using OVPN to commit crimes,” the company says.
In its response, OVPN told the court that as a provider of services designed to offer a high degree of confidentiality, any order granted on behalf of private parties requiring it not to destroy information (even if any was available) would put the entire company at risk of great financial damage.
Therefore, the claim that it would not “suffer any economic injury” as a result of precautionary measures is incorrect, the provider added.
Not a Party to Copyright Infringement, Standing Firm
Finally, OVPN informed the court that as a service provider, it is not a party to any of the infringements allegedly carried out by The Pirate Bay or its users. As a result, should the injunction be dismissed, it should be entitled to have its costs covered by the applicants.
“Our main goal is to protect people from hackers and avoid being monitored online,” an OVPN statement adds.
“We wholeheartedly believe that people have a right to communicate privately whether it is in a physical or a digital world. Communications online should be as private as a communication in a room between two people. We are standing firm.”
