Torrented files under my IP address

Question

Last year (2018) I was accused of torrenting Files whilst in my residence in Germany. I have never torrented any file ever. One thing that stands out is that during the same day CyberGhost (the VPN [paid license] provider I use) installed a plug-in in my computer approximately 5 hours before the time and place I am accused of the torrented files. Is it possible that this Plug-in used my IP address, or hacked into my personal information and an anonymous user committed the crime? I am now forced to pay a fine of 1000+ EUR or go to court. Can someone help me out here and provide me with sources/feedback to articles regarding this possibility? Any help is really appreciated because I do not dispose of the money to pay a fine for a crime I did not commit. Thank you all.

Answer 1

I encountered similar situations.

1. P2P itself is not illegal. German law considers that sharing content protected by copyright is illegal. You can share non-protected content, like let's say an .iso image of a public Linux distribution. Simply using P2P does not violate anything.

2. If they can prove that you did download copyright protected files, then yes, fines are possible, but not that easy. German courts have stated that the owner of the internet access is in theory responsible for any wrong-doings happening on that network and that it is their duty to secure them.

3. An IP address does not represent a person. Legally, an accusation based on IP-only does not stand. That IP can be hijacked by malware or another person can be behind the terminal using it when the offense is done.

4. The notice you got can be considered blackmail. I put it under blackmail because the letter is sent by law firms (that hire specialized third-party services that are scanning P2P nodes and clients, recording IP adresses that are currently downloading illegally in Germany, after which they are authorized by law to ask your internet provider to disclose any information linked to that IP adress), which in turn are hired by companies owning the copyrighted items. So it's a 3rd party involved. Basically, the letter is a warning to let you know that this 3rd party entity knows what you did and if you do not want to go to court you should pay a fine.

5. Given (4), such a case would rarely reach a court because of (3) and other aspects.

Conclusion: Ignoring it would be the recommended choice is this situation. You'll probably never hear from them again, unless you repeat the offense, in which case they will dig more into the matter and they could gather more evidence than (3), which will make the basics for a possible legal case. If you also received a document named "Unterlassungserklärung" you should not sign it as doing that would be an admission of guilt, which would give them a lot more legal ground to pursue things further.

Answer 2

First of all, before you have more info DO NOT pay anything. Consider the possibility that this is a scam. In particular, if you were using a VPN, then there should have been no way for the authorities obtained your IP address unless the VPN provider just handed it over. That would be a terrible publicity move for the VPN.

Furthermore, it doesn't sit right that you would get one of these letters just based on an IP address unless you have specifically paid for a static ip address. Of course the authorities can go to your ISP and ask who had that IP at that time, but if you were using a VPN, then no way.

Finally, how were you informed that you will be fined? By email, phone, or post? And how do they want you to pay? For instance, do they give you an IBAN that you should transfer money to? All of these things are important when it comes to determining whether it is a scam. If they informed you by post and gave you an IBAN, then this is probably legitimate. If they informed you by email and want you to put in Bitcoin, then this is a scam.

Answer 3

While I am not sure if the CyberGhost extension is the culprit, malware that uses your computer to do nefarious things is common. It is called botnet.

The way it could have worked in this case is that your computer was infected (maybe by the extension or in another way) and used as a VPN exit node. Legitimate VPNs use their own servers in data centers as exit nodes. This means you connect to the server and the server then sends the data on your behalf. This means the data has the IP of the server of the VPN provider, instead of yours. A neferious VPN provider may choose to save money for having a server by infecting peoples computers and using these as VPN exit nodes. Them or their customers would then connect to your PC and send their data under your IP. This has the same effect as using a legitimate VPN but does not cost them anything.

Another possibility is that CyberGhost uses your computer as an exit node as part of their service. I never heard about a legitimate VPN doing this but it may be burried somewhere in the EULA.

Of course other possibility is someone stealing your internet connection by for example guessing your wi-fi password. This would also result in them having the same IP.

Finally, IP should not be enough to convict you in court. But whether it would ever be possible or cost effective to fight it in court is a question for your lawyer. You should also ask about the law part of this question on Law SE.