In a landmark ruling, the Court of Milan has ordered Cloudflare to block pirate streaming services that offer Serie A football matches. The court found that Cloudflare’s services are instrumental in facilitating access to live pirate streams, undermining Italy’s ‘Piracy Shield’ legislation. The order, which applies in Italy, affects Cloudflare’s CDN, DNS resolver, WARP and proxy services. It also includes a broad data disclosure section.
The broad blocking powers it provides certainly made an impact this year but not all news was positive.
Multiple reports of overblocking included mishaps where the anti-piracy system blocked access to Google Drive and other legitimate sites and services. An incident just after launch saw a Cloudflare IP-address blocked which rendered many legitimate websites inaccessible.
Cloudflare’s Piracy Shield Responsibilities
Cloudflare wasn’t only targeted inadvertently. Earlier this year, football league Serie A filed a complaint against the company at the Court of Milan, an attempt to compel Cloudflare’s participation in the novel anti-piracy system.
Cloudflare was able to fend off this approach after the court concluded that it lacked authority to compel Cloudflare to join the Piracy Shield program. Serie A’s subsequent appeal turned things around, however.
On appeal, the Court of Milan concluded that Cloudflare’s services are instrumental in enabling the illegal streaming of football matches, since they allow users to bypass the Piracy Shield blocks imposed by AGCOM.
The court sees this as a “causal contribution” to copyright infringement, which is sufficient to establish legal responsibility and compel Cloudflare to take action.
“Both Cloudflare’s causal contribution to the reported offenses through its services, and its refusal to prevent the violations despite the warning issued by the rightsholders, are established,” the Court of Milan writes (loosely translated).
All Cloudflare Services
The Court of Milan’s decision prohibits Cloudflare from resolving domain names and routing internet traffic to IP addresses of all services present on the “Piracy Shield” system. This also applies to future domains and aliases used by these pirate services.
The order applies to Cloudflare’s content delivery network (CDN), DNS services, and reverse proxy services. The order also mentions Cloudflare’s free VPN among the targets, likely referring to the WARP service.
If any of the targeted pirate streaming providers use Cloudflare’s services to infringe on Serie A’s copyrights, the company Cloudflare must stop providing CDN, authoritative DNS, and reverse proxy services to these customers.
(Note: This is an Italian court order and Cloudflare previously used geotargeting to block sites only in Italy. It may respond similarly here, but terminating customer accounts only in Italy might be more complicated. )
Finally, the order further includes a data disclosure component, under which Cloudflare must identify customers who use Cloudflare’s services to offer pirated streams. This should help Serie A to track down those responsible.
The data disclosure section also covers information related to the ‘VPN’ and alternative public DNS services, where these relate to the IPTV platforms identified in the case. That covers traffic volume and connection logs, including IP-addresses and timestamps.
In theory, that could also cover data on people who accessed these services using Cloudflare’s VPN and DNS resolver.
‘Crucial Ruling’
Law firms Studio Previti and SPTech Legal, who represented Serie A and several intervening parties, are pleased with the outcome. In a press release, they state that the order highlights Cloudflare’s responsibility as a third-party intermediary and access provider.
“This decision represents a crucial step in the battle against digital piracy,” Lawyer Lorenzo Pinci writes in a detailed overview of the order.
“Not only because it constitutes the first interpretative ruling of Law 93/2023 and the functioning of the ‘Piracy Shield’ platform, but also because it established Cloudflare’s role as an intermediary and provider of network access services utilized to facilitate piracy.”
Cloudflare did not respond to our request for comment at the time of publication, but it’s clear that the order is a massive setback for the company, which sees itself mostly as a passive intermediary.
The court ordered Cloudflare to cover the costs of the proceeding and if it doesn’t implement the blocking requirements in time, an additional fine of €10,000 per day will apply.
—
A copy of the order, as issued by the Court of Milan, is available here (pdf, Italian).
