Report Identifies Dangers to Internet Users from Malvertising and Piracy

On September 15, the Digital Citizens Alliance released a report titled "Unholy Triangle: From Piracy to Ads to Ransomware: How Illicit Actors Use Digital Ads on Piracy Sites to Profit by Harming Internet Users." The report, which the Digital Citizens Alliance prepared jointly with White Bullet and Unit 221B, spotlights the phenomena of online pirates working with "malvertisers" and with the effective assistance of online ad intermediaries to exploit Internet users. 

As the report explains, operators of piracy websites lure Internet users by offering them access to "free" content – including copyrighted movies, TV shows, music sound recordings, and ebooks. But many piracy sites feature a barrage of malicious ads intended to confuse, deceive, or scare Internet users into clicking them. The clicked ads then infect Internet users' computers with malware that can steal their financial and personal information as well as with spyware that can track all of their online activities. The report identifies the creators of these harmful ads as "malvertisers" and it calls their tactics "malvertising."

One particularly pernicious malware-related activity is known as "ransomware." In a ransomware attack, an Internet user's computer files are encrypted and the user is locked out. Cybercriminals then demand payment from the Internet user in order to unlock the files. A source cited by the report estimated that global losses due to ransomware totaled $20 billion in 2021.

 

The report authors investigated many online piracy sites and found ransomware and other malware schemes in operation. According to the report, in just a one-month period, visitors to piracy sites were barraged with an estimated 321 million ads designed to harm them. Indeed, the report found that malvertising accounts for 12% of total ads on piracy sites and generates an estimated minimum of $121 million annually, with more than $68 million coming from U.S. Internet user visits to such sites. 

 

Significantly, these piracy website-hosted malvertising schemes would not be operating without ad intermediaries. In their investigation, the report's authors found that some foreign owned and operated ad intermediaries were willing to place deceptive ads and thereby effectively facilitate malvertising campaigns. The report found that the ad industry has made progress in reducing ads for legitimate companies on piracy sites, and it credits the creation of the Trustworthy Accountability Group (TAG) by U.S. ad associations for helping bring about those reductions. 

 

Copyright piracy is wrong in itself and commercial traffickers in infringing content ought to be the target of federal law enforcement efforts. Free State Foundation President Randolph May and I have written about the harms from online piracy – including the role of online ads in facilitating piracy – which undermines copyright owners' ability to seek financial returns and devalues their intellectual property. But the harms of online piracy don't end there. The "Unholy Triangle" report rightly calls attention to the dangers to unsuspecting Internet users from malware on piracy websites that host infringing content. More Internet users should become aware of those dangers. Hopefully, further efforts will be made by responsible U.S. ad associations and by others to curb the high volumes of malicious ads and the illicit revenue streams that they generate.

Consumer Survey Shows the Dangers of Malware from Video Piracy

A survey released on June 22 by the U.S. consumers by the Digital Citizens Alliance offers additional evidence of the strong link between video piracy and malware. According to the Digital Citizens Alliance, 13% of respondents admitted to using devices like Kodi boxes or jail-broken Amazon Firesticks to view pirated copies of copyrighted movies and TV shows. Of those users of piracy devices, 49% reported experiencing malware in the last year and 25% reported a malware problem in the prior three months. Check out the Digital Citizens Alliance website – including its handy infographic – for more on the survey's findings.

In a June blog post, I noted the dangers of malicious software to users of illicit streaming devices and illegal IPTV services. Those dangers were the issue focus of the U.S. Trade Representative's 2019 Review of Notorious Markets Report. FSF President Randolph May and I also addressed the dangers of malware to users of illicit streaming devices and illegal IPTV services in our newest book, Modernizing Copyright Law for the Digital Age – Constitutional Foundations for Reform.

Piracy of copyrighted video content is violation of the exclusive property rights of copyright owners, and therefore wrong in itself. But as the Digital Citizens Alliance's survey reminds us, video piracy also poses harms to the viewers of pirated content.

State Attorney Generals Warn About Piracy Sites

The Digital Citizens Alliance (DCA) has launched a campaign with the help of 15 state Attorney Generals to warn consumers about the risk of malware on piracy websites. According to a Variety article, many websites bait consumers with stolen videos or music and then steal the consumers’ identifications and financial information.

The state Attorney Generals participating in the campaign are:

IN: Curtis Hill

AZ: Marc Brnovich

KY: Andy Bashear

DC: Karl Racine

KS: Derek Schmidt

MT: Tim Fox

OR: Ellen Rosenblum

CT: George Jepsen

SD: Marty Jackley

LA: Jeff Landry

ND: Wayne Stenehjem

WI: Brad Schimel

ID: Lawrence Wasden

NC: Josh Stein

HI: Doug Chin

A 2016 study by RiskIQ found that one out of three piracy websites exposes consumers to dangerous malware. Moreover, 45% of malware from piracy websites is delivered through so-called “drive-by downloads,” meaning malware invisibly downloads to the consumer’s computer without requiring the consumer to click on a link. RiskIQ estimated that piracy websites were making about $70 million a year from allowing malware to be placed on their sites. When consumers expose themselves to this type of vulnerability, hackers are able to steal personal information, steal bank and credit card data, and even lock a consumer’s computer and demand a ransom fee.

It is important that DCA and a group of state Attorney Generals are now speaking out to warn consumers of this dangerous criminal activity. The best way to reduce piracy is to stop the cash flow. Educating consumers about the risks they assume should make them think twice before visiting a piracy website, ultimately slowing the growth of online piracy.

Online piracy is a major problem in the United States and abroad, but voluntary campaigns can help minimize piracy by informing consumers about the risks to them and the harm suffered by artists and entrepreneurs from theft of intellectual property.

MPAA and Donuts Establish New Voluntary Initiative Tackling Piracy

On February 9, 2016, the Motion Picture Association of America (MPAA) and Donuts Inc., the world’s largest operator of new domain name extensions, established a voluntary initiative to help ensure that websites using Donuts-operated top-level domains are not engaging in large-scale piracy. Under the terms of the agreement, Donuts will treat MPAA as a “Trusted Notifier” with respect to referrals that include clear evidence of copyright infringement.

MPAA will submit referrals to Donuts regarding domains which provide false Whois information, engage in copyright infringement, and/or facilitate the sale of illegal content. Then, Donuts will review the referrals and take appropriate enforcement action against the domains.

In December 2015, “Digital Bait”, a Digital Citizens Alliance report, found that malware associated with piracy sites cost consumers $70 million per year.

Piracy online remains a problem. Additionally, for instance, the recent movies “Interstellar” and “The Wolf of Wall Street” have been pirated over 46 million and 30 million times, respectively. This agreement between MPAA and Donuts and other voluntary initiatives, such as TAG and MPAA’s WheretoWatch.com, help consumers find legal content and raise awareness about websites, enterprises, and advertisers that violate intellectual property rights.

Other initiatives, like the Copyright Alert System, allow artists and creators to protect their intellectual property by alerting Internet service providers when a subscriber has engaged in copyright infringement.

It is necessary to address and hopefully diminish piracy and content theft with voluntary initiatives to help ensure that content providers, artists, innovators, and marketers can earn a return on their creative works – thereby incentivizing more innovation, investment, and economic growth. The new Donuts-MPAA voluntary agreement is a positive step in the ongoing fight against piracy of online content. 

Piracy and Malware Are Closely Related Problems

On December 3, 2015, I posted a blog about a new Interactive Advertising Bureau (IAB) study, which found that advertising fraud, piracy websites, and “malvertising” costs the U.S. digital marketing, advertising, and media industry $8.2 billion annually in potential revenue. The study also specifically found that illegal content costs advertising companies and digital marketing firms $2.4 billion annually in potential revenue.

This week, on December 8, the Trustworthy Accountability Group (TAG) announced a list of major advertisers who have pledged to require their advertising partners to take aggressive steps to help fight the $2.4 billion annual loss. Some of the big names include Allstate, American Express, Comcast, and Walmart. (See my February 2015 blog on TAG’s Brand Integrity Program Against Piracy.)

Also, on December 9, the Digital Citizens Alliance (DCA) released a new report entitled “Digital Bait.” The report found that one out of every three piracy websites contains malware. Additionally, consumers are 28 times more likely to receive malware from a website with illegal content than from a website with licensed content providers. The report also found that 45 percent of malware is delivered by “drive-by downloads,” which invisibly download malware onto a user’s computer without the user clicking on anything. Lastly, the report found that advertising revenue and sales of user information on piracy websites amounted to $70 million in revenue in 2015.

If it was not already clear, the IAB and DCA reports show that advertising fraud, piracy, and malware-related advertising are serious problems costing companies billions of dollars in potential revenue. However, it is encouraging to see voluntary initiatives from TAG and major advertisers that stand up against websites which facilitate illegal content.

It is necessary to diminish ad-supported piracy and advertising fraud to help ensure that content providers, artists, innovators, and marketers can earn a return on their creative works – thereby incentivizing more innovation, investment, and economic growth.