YouHaveDownloaded

» see youhavedownloaded.com as it lived, on the wayback machine

~ the goodbye ~

The whole design of this site rested on the idea that an IP address means a person. On ttnet in 2011 mine was handed out fresh from a pool every time the line came back up, so anything sitting under my number on any given afternoon would have belonged to whoever held it last week. That is not a flaw somebody overlooked. It is the central fact about consumer internet in most of the world, and the site was built on top of it anyway.

YouHaveDownloaded went up in December 2011. It was made by a team of three led by Suren Ter-Saakov, a Russian developer living outside Philadelphia, and the interface was a single text field. You typed in an address and got back a list of torrents that address had been observed sharing. If you arrived without typing anything, it looked up your own address first, which is why the site spread the way it did.

None of the data was stolen or intercepted. Every BitTorrent swarm publishes the addresses of everyone in it, because that is how peers find each other, and the distributed hash table hands the same information to anybody who asks politely in the protocol. The site simply crawled that and wrote it down. What it demonstrated was not a breach. It was that nobody had bothered to look.

~ the chronicle ~

~ the breakout ~

Over fifty million addresses ended up in the index, which the operators estimated covered roughly a fifth of all torrent traffic on earth. The entire thing ran on one server for less than three hundred dollars a month. Brian Krebs wrote it up in December 2011 and the mainstream press followed within days, mostly under headlines built around the second person.

The stories that gave it a news cycle were about institutions rather than individuals. An address belonging to the Élysée Palace turned up attached to Beach Boys records and a run of comedy films, which was awkward for a government that had spent years pushing the HADOPI law and cutting off households for exactly this. In early 2012 addresses from US congressional offices appeared in the same datasets, at the height of the SOPA argument. Both stories carried the caveat that a building address proves nothing about who was at the keyboard, and both were reported anyway.

~ what it proved ~

The site went offline during 2012 without a takedown notice or a court case that anyone recorded. It stopped and the domain went dead. The argument about it moved on somewhere else. Ter-Saakov had described the whole thing as starting from a theoretical conversation with friends about what could be tracked, which is a reasonable description of the eventual result.

Its real inheritance is the surveillance industry that formalized the same trick. Within a few years, firms were selling swarm monitoring as a service to rights holders, feeding the same public peer lists into automated infringement notices delivered through ISPs at scale. YouHaveDownloaded showed the data was lying in the open and free to collect, then closed. Everyone who noticed built a business on it instead of a novelty.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »