Catching Illegal Downloaders

To reduce the illegal downloading of copyrighted material via their networks, colleges are relying on a mix of technology, education, and punishment.

• By Sue Marquette Poremba
• 02/01/12

When it comes to the theft of copyrighted material, the crime spree may be over, but it's not exactly Mayberry out there. Illegal file sharing of copyrighted material peaked about four years ago after high-profile legal battles by the Recording Industry Association of America and the Motion Picture Association of America. But it remains a significant problem.

"A year ago it was movies. This year, it is reverting back to music," says Duane Woerman, manager of the university technology office at Arizona State University. "Last year, we had about 9,000 cases we had to respond to.

Numbers like that translate into a significant headache for colleges and universities, particularly in the wake of the 2008 reauthorization of the Higher Education Opportunity Act (HEOA), which requires institutions to take active steps to prevent unauthorized distribution of copyrighted materials on their networks.

"It costs the recording industry a loss in its revenue stream," Woerman points out. "And for us it's a manpower issue because we have to respond to all these incidents."

As the operator of the network, it is the university that receives Digital Millennium Copyright Act (DMCA) takedown notices sent by aggrieved copyright holders. And it is the university that has to track and respond to violations. The costs to the institution don't end there, however. Illegal peer-to-peer (P2P) file sharing hogs network bandwidth, and often leads to increased malware infections.

In some ways, the prevalence of illegal file sharing is the result of both improving technology and changing cultural norms. "The networks are extremely fast, which means movies, albums, and TV shows can be downloaded at record speed," explains Justin Webb, security analyst with Marquette University (WI). "Also, most incoming students have always had the internet and have inevitably been exposed to nonlegal methods of obtaining artistic material."

To fight the scourge, colleges and universities are trying a cocktail of three remedies in line with HEOA mandates: education, technology, and punishment.

Education
In Webb's eyes, there's a misapprehension among students that, because there isn't a physical theft, no harm is done.

His theory--that students don't believe they are stealing--makes sense. Today's college students are used to sharing everything online and having their entertainment available at the click of a mouse. And even though most students are heavy tech users, many don't understand what constitutes acceptable, legal behavior online. It's in the university's interests to educate them on these finer points.

"We give annual notices to students informing them that downloading of copyrighted material is illegal, and we offer a website that gives alternative--and often free--options to allow students to obtain content legally," explains Webb.

Other schools turn to student leaders for help. The University of Houston (TX), for example, has an extensive awareness program that was designed in part by students to educate fellow students on a variety of technology security topics. Included in this program are details about what constitutes illegal downloading, as well as information about where students can download material legally.

"Our awareness program utilizes an innovative e-book format, complete with interactive games and videos designed to engage students' attention and encourage information retention," explains Mary Dickerson, Houston's chief information security officer. "The truth is, if you are downloading without the copyright owner's consent, it is stealing. All you need to do is keep reminding your users that it is just that simple."

Technology
If educational efforts fall on deaf ears, technology offers ways to discourage illegal file sharing--and to catch the perpetrators. However, there are significant differences among institutions in how willing they are to interfere with students' ability to share P2P files.

Marquette, for example, does not block P2P file sharing. "But," says Webb, "we do throttle that traffic using a packet shaper on our student network, which reduces its load on our bandwidth."

It's a similar scenario at Washington State University. To discourage P2P file sharing, IT administrators set it as a low priority on the network, slowing downloads of potentially copyrighted content. "Not all P2P is illegal, but a whole lot of it is," says Craig Howard, director of administrative services information systems.

For its part, Arizona State tried a number of different third-party products. One program stopped file transfers, but not until after the download had started. "The technology allowed us to stop the activity, but there was no reduction in [industry] complaints," says Woerman, who explains that it still constituted a violation in the eyes of the recording industry.

The vendor he uses now, Palo Alto Networks, blocks all P2P file transfers on the campus wireless network and in the dorm buildings. In the year since the new system was implemented, Arizona State has seen the number of violations drop from 9,000 to 2,000.

Obviously, some students continue to find ways to carry out P2P transfers. According to Woerman, "they go to the computer labs," which are not blocked by the Palo Alto Networks firewall. The labs and other unprotected areas of campus are expected to have protection in 2012.

The other half of the technology solution involves tracking down and identifying the culprits. When Arizona State receives a DMCA takedown notice, says Woerman, "we use ForeScout Network Access Control to help identify where the violation originated, and our Cisco network infrastructure to pinpoint the offender's location."

At Wiregrass Georgia Technical College, CIO Amos Terrell uses a Microsoft Access directory to track what students do online and what they download. Students have to log on to the network, and everything they download goes into their own folders. Terrell can monitor what kinds of files (including their size) are being downloaded, which makes it much easier to identify potential problems--and violators.

At Houston, Integrity monitoring software from Red Lambda tracks the protocol used for downloading. "The software correlates complaints received from the copyright holders and publishers against our system logs and data to identify the person downloading the material," explains Dickerson.

Punishment
Short of blocking all P2P traffic, though, there is no surefire way to halt illegal downloading. Ultimately, it is the threat of being caught--along with the penalties for infractions--that dissuade the majority of students from engaging in the practice. Most universities publicize these penalties in the materials that are sent to students as part of their awareness programs.

At the University of California, Santa Barbara, a student's first DMCA violation results in a 30-day disconnection from the residential network. A second violation leads to the loss of internet access for as long as the student remains in a residence hall. In addition, the case is referred to a campus judicial officer, and the student might lose his eligibility for university housing.

Appalachian State University (NC) takes a less punitive approach for the first couple of offenses--the first results in a warning, the second in the loss of internet access for 10 academic days. For the third offense, though, the school throws the book at violators: the loss of internet access for 75 academic days, and academic probation. Simply put, three strikes and you're out.