How did my ISP know someone in my house downloaded a file over BitTorrent?

Question

Recently I got an email from Xfinity (my internet provider) that a pirated file had been downloaded. It is true, a pirated file was downloaded by my brother (who was downloading games for a WII emulator) but the email said the IP that downloaded the file, the domain from which the file came, and that the file was downloaded via BitTorrent. When I asked the customer service person how they got that information, he said he couldn't disclose that information. The site didn't have SSL/TLS, but isn't BitTorrent encrypted?

One of two things could have happened

1. Xfinity detected the traffic and called crap on the download, which means that the communication with BitTorrent was unencrypted.

2. the site from which the file was downloaded was a "honeypot" and the information was derived from the site.

I'd think this was social engineering except that they knew who to email when the file was downloaded.

I guess I'm curious how this information was gathered. It says that OpSec Online Antipiracy reported the DMCA against my brother. Did they have a proxy around the other site? Is Xfinity monitoring traffic to such an extent (which I believe is an infringement of their privacy policy) where they detected the BitTorrent over plain HTTP?

I visited the website on my brother's computer and it had SSL/TLS, but. somehow, it doesn't have SSL/TLS on my computer.

Answer 1

You are jumping to speculations and ignoring the facts in front of you:

1. OpSec Online Antipiracy detected the download, not Xfinity
2. BitTorrent clients have to know who is serving what content (that's the whole point of P2P networks)

So, by checking out the company, they say:

OpSec® PeerScan enables you to protect your content against Peer-to-Peer (P2P) piracy abuse. Its unique intelligence enables you to see the number of peers connecting to a swarm, their geo-location, title, asset quality, and language ...

and then

Industry-leading BitTorrent Level 1 public trackers and Distributed Hash Table (DHT) client designed from the ground up to provide excellent scheduling and data capture capabilities.

and

Powered by OpSec® PeerScan, OpSec® Acuity Pro systematically monitors an index of music, film, and television titles worldwide to provide visibility into piracy consumption across different markets and media on file-sharing networks. This data helps you gain a deeper understanding of when, where, and how copyrighted content is being used

So, it's all quite simple: OpSec Security simply watches active BitTorrent traffic, as anyone can do from their own BitTorrent clients, and reports to copyright holders.

Answer 2

A few things to unpack:

"The site didn't have SSL/TLS, but its't bittorent encrypted anyways?"

Bittorrent is a distributed communication protocol, it is not itself encrypted but encryption doesn't matter.

Encryption protects content, it does not protect attribution. This means the fact that a transfer is taking place is known even if the content is undecipherable.

In the case described, everything was hanging out on the wire: your IP address, and unencrypted content.

"... I visited the website on my brother's computer and it had SSL/TLS, but. somehow, it doesn't have SSL/TLS on my computer."

When using bittorrent protocol, the website is not providing the content, it's a tracker (in essence a directory) of other computers to get the content from, it doesn't come from the website.

"Is xfinity monitoring traffic to such an extent (which I believe is infringment {sic} of their private policy) where they detected the bittorent over plain HTTP?"

I don't know what Xfinity is doing but it's irrelevant. There are numerous, as in thousands, of bittorent participants doing nothing but collecting contacts consisting of IP adresses and file segment requests in order to generate piracy claims. Even if the files were encrypted, as soon as your bittorent agent requested a file segment from one of these special participants, they have the file requested and the IP requesting it because you gave it to them. There is no secret Xfinity trickery required, you provided everything needed to a third party.