Anti-piracy groups and rightsholders in Europe are reportedly interested in a so-called "Know Your Customer" proposal to tackle pirate sites. In the finance world, companies are required to know exactly who their clients are to prevent money laundering but what if this stretched to domain, hosting and cloud storage companies too?
Most adults seeking to do any kind of business with banks, financial entities or even gambling companies will have experienced efforts to positively identify who they are.
So-called ‘Know Your Customer’ regulations require that companies, mostly in the financial sector, carry out checks to determine that the individuals they are dealing with are actually who they say they. Such verification is usually carried out when an account is opened but can be revisited thereafter, with the provision of ID cards, passports, driving licenses, and even face verification becoming a condition for business.
The main goals of these regulations are to prevent obvious crimes such as fraud and money laundering, with the latter often linked to criminal behavior and even terrorist financing. However, an interesting question being mulled by several anti-piracy groups and rightsholders is whether similar identification requirements could also hinder the ability of pirate sites to do business.
Know Your Business Customer – An Emerging Anti-Piracy Tool?
During a webinar hosted by Italian anti-piracy group FAPAV and attended by representatives from Europol, the MPA, Guardia di Finanza and local football league Serie A, among others, the topic of ‘Know Your Business Customer’ (KYBC) was raised in respect of online copyright infringement mitigation.
Describing the “increasingly cross-border dimension of piracy” as a complex challenge for the authorities, FAPAV reports that KYBC was welcomed as a useful and practical way to tackle pirate sites, whose operators have a tendency to hide in the shadows.
“This type of approach would allow us to combat anonymity on the web, now a constant of those who work illegally to exploit and earn through the unauthorized use of audiovisual works, through the verification of the information provided in the context of the purchase of services such as hosting, domains, storage etc,” FAPAV said.
“[A]fter the difficult months of the lockdown, the effects of which they are still heavily impacting our economy. A proposal such as the ‘KYBC’ (Know Your Business Customer) arrives at a time when it is essential to strengthen protection actions to support the re-launch phase of the audiovisual sector.”
How Would KYBC Work
TorrentFreak requested comment from FAPAV on how such a system might work in respect of piracy mitigation but at the time of writing the group had yet to respond. However, it’s not difficult to see how such a mechanism, if companies could be persuaded or compelled to adopt it, might affect the piracy landscape.
Currently, it is easy to register a domain name for use on a pirate site within minutes. Domain registrars do require customers to provide identifying information when buying a domain but the process of verifying the information is nowhere near the standard required for opening a bank account, so it can be easily falsified.
That means that when a subpoena is served on a domain registrar, the information retrieved may be of limited use.
The same can apply to hosting companies, many of whom are happy to start doing business with a customer based on personal details that haven’t been strictly vetted. As a result, the same problems appear when a copyright holder attempts to find out who is actually in control of a particular server when alleged infringements are being carried out. Add in the complication of customers paying using cryptocurrency, for example, and tracking down alleged infringers becomes even more difficult.
Drawbacks of Know Your Business Customer
At this early stage and without further commentary from anti-piracy groups it’s hard to know exactly what type of regime they have in mind and how they would like it implemented. However, the introduction of such a program at web services companies has cost implications since carrying out stringent checks via third-party resources isn’t cheap. As a result, smaller companies would be most negatively affected.
Also worth considering is clients’ perception of such checks. The vast majority already supply accurate information and operate legally, so might even be deterred from doing business with a ‘compliant’ company and move to one that doesn’t require photographs of their driving licenses or passports. Equally, people operating sites that require a level of privacy, such as whistleblower platforms, rely on being able to do what they do without fear that their information will fall into potentially hostile hands.
In short, expanding KYC/KYBC has the potential to negatively affect far more people than the current regime and without providing any notable benefits to regular customers either. Law enforcement and anti-piracy groups may not be too concerned about that but such changes don’t exist in a vacuum so need to be considered.
