Spain’s Ongoing Pirate Site-Blocking War Targets Thousands of Subdomains

Amendments to Spain’s Copyright Act (Law No. 2/2011) in 2011 led to the formation of an administrative body known as the Second Section of the Intellectual Property Commission (S2CPI).

S2CPI launched in 2012 under the Spanish government’s Ministry of Culture and Sports and has the authority to instruct the country’s internet service providers to block subscriber access to confirmed pirate sites and services.

Data just published, covering the first quarter of 2024, begins with an overview of the number of blocking applications filed by rightsholders since records began in 2012. Even though three-quarters of the year remains, it seems unlikely that 2024 will see as many applications as 2023 or 2022.

Blocking applications to S2CPI (2021-2024(Q1)

The blocking process is triggered when rightsholders file an application with S2CPI to block a domain operated by a pirate site or service. From 2012 to Q1 2024, 909 applications were submitted, although just 11 of those during the first three months of 2024.

Over a Third of Applications Fail

While the specifics aren’t for public consumption, since its launch, S2CPI has rejected 24 blocking applications. Four of those were rejected in Q1 2024 for complaining about the registration of a website, not an established website where infringement is taking place.

In fact, the Spanish system seems quite prone to applications failing for one reason or another. Of the 909 applications ever received, 335 were closed for various rightsholder-related reasons, including withdrawing their own applications, failing to correct defective applications, and filing applications on insufficient grounds.

Other applications failed due to the disappearance of the pirate site in question, or the removal of the infringing content during S2CPI’s preliminary investigations.

“In the first quarter of 2024, no applications have been closed after the phase of investigations prior to the initiation agreement due to the applicant’s withdrawal,” S2CPI’s report notes.

564 Successful Applications From 2012 to Q1 2024

An application is considered successful if it complies with the law and “has given rise to the initiation of a procedure.” From 2012 to Q1 2024, 564 applications met the standard and of those, 447 were “fully processed” after a final resolution of withdrawal or blocking- or a resolution to archive.

“In the first quarter of 2024 there were 17 final resolutions corresponding to two special procedures (shorter because the responsible party was not duly identified in accordance with article 10 of Law 34/2002, of July 11, 2002, on information society services) and one ordinary procedure,” S2CPI notes.

Domain Names Subject to Final Resolution

There are no specific requirements for EU member states to make the domain names they block on copyright grounds available to the public. For those that do, transparency is often cited as important; for those that don’t, it’s not unusual for the justification for non-transparency to be just as opaque.

Despite recent controversies with its Piracy Shield blocking system and a marked reduction in transparency, no country comes close to the detailed reporting of Italy in respect of its regular site blocking system. Spain could do much more, but it still goes further than most.

By making lists of targeted domains public it hopes to “encourage and promote the adoption of voluntary measures of collaboration by intermediary services, electronic payment services and advertising services with respect to these infringing services.”

The domains listed below are those for which the S2CPI has issued a firm “Final Resolution” for the removal of pirate content or ISP blocking.

Administrative Blocking in Spain

When the site blocking movement was first gaining momentum, concerns at internet service providers were not uncommon. As providers of internet connectivity, blocking elements of the internet ran counter to their core mission. Others quite rightly expressed concerns that if they agreed to block a few bad actors, it most likely wouldn’t stop there.

But even more importantly, where were the legal protections should everything go wrong? In the UK, Scandinavia and other European countries testing these waters, applications for injunctions at competent courts allowed increasingly flexible ISPs to offload their concerns onto the shoulders of a judge.

Judicial oversight on blocking matters still plays a role in some countries but in Denmark, Germany, Portugal, and more recently Spain, codes of conduct agreed between rightsholders, ISPs, and other interested parties, tackle site-blocking on an administrative basis.

Operated within the confines of the law but without its persistent oversight, those who request blocking and those with the ability to carry it out, do so directly.

Countering Blocking Countermeasures

For blocking proponents, eliminating friction in the system is increasingly important; blocked sites tend not to stay blocked for very long, so any blocking countermeasures need to be countered quickly. In Spain, sites that have already been blocked after being declared infringing, are handled under the administrative system when infringement persists.

That can mean rightsholders reporting replacement domains, proxy and mirror sites, or the growing deployment of subdomains by pirate sites whose main domains are usually already blocked.

According to the latest S2CPI report, late December 2023 the technical committee representing rightsholder signatories to Spain’s code of conduct, was submitting around 132 reports on a weekly basis, relating to more than 848 domains which together had deployed at least 3,972 subdomains.

Since in many cases these subdomains are configured to undermine blocking, swift and direct action is preferred to the relatively laborious process offered by the courts.

In this case all were quickly blocked but the use of subdomains to mitigate blocking isn’t anything new. Spain mentioned the practice in its 2021 report but with smaller numbers; 172 domains deploying 697 subdomains. In reality, this has been going on for a long time, but it’s the scale that makes it more notable today.

If we compare Spain’s figures to a small sample of the subdomains deployed by pirate IPTV providers to evade blocking by Sky in the UK, we get some idea of just how quickly matters can get out of hand when it’s possible to generate and deploy thousands of subdomains at will, within just a few minutes.

The 848 domains and by extension their 3,972 subdomains mentioned in the report are likely to be outdated figures after five additional months of blocking. However, when compared to other countries, Italy for example, Spain’s blocking of main domains is fairly low. At the time of writing, Italy’s main blocklist (not Piracy Shield) contains exactly 4,000 domains. Perhaps the closest by volume is Denmark’s list, which currently contains 783 domains.

The final list of domains made public by S2CPI in its latest report is somewhat similar to the UK’s Infringing Website List. It’s designed to prevent advertisers from doing business with the sites but also rolls in ISP blocking for good measure.

From: TF, for the latest news on copyright battles, piracy and more.