Last year (2018) I was accused of torrenting Files whilst in my residence in Germany. I have never torrented any file ever. One thing that stands out is that during the same day CyberGhost (the VPN [paid license] provider I use) installed a plug-in in my computer approximately 5 hours before the time and place I am accused of the torrented files. Is it possible that this Plug-in used my IP address, or hacked into my personal information and an anonymous user committed the crime? I am now forced to pay a fine of 1000+ EUR or go to court. Can someone help me out here and provide me with sources/feedback to articles regarding this possibility? Any help is really appreciated because I do not dispose of the money to pay a fine for a crime I did not commit. Thank you all.

  • 3
    This is more of a legal question. In most jurisdictions, IP address is not enough evidence to use in court. – schroeder Apr 11 '19 at 19:23
  • Based on your own description of the situation, nothing posted here will stop whatever lawful authority that intends to fine you, from doing so, without you taking that information to court and presenting it. – Don Simon Apr 11 '19 at 20:16
  • the purpose of a VPN is to hide your IP address. How did the authorities get that info? Did Cyberghost hand it over? – bremen_matt Apr 11 '19 at 21:53
  • @bremen_matt That is not what the purpose of a VPN is, but it is what people often misuse it for. – forest Apr 12 '19 at 6:42
  • I presume you mean that the true purpose is so that your ISP does not track you traffic? And having a different outward-facing IP is just a side effect of that? – bremen_matt Apr 12 '19 at 6:43

I encountered similar situations.

  1. P2P itself is not illegal. German law considers that sharing content protected by copyright is illegal. You can share non-protected content, like let's say an .iso image of a public Linux distribution. Simply using P2P does not violate anything.

  2. If they can prove that you did download copyright protected files, then yes, fines are possible, but not that easy. German courts have stated that the owner of the internet access is in theory responsible for any wrong-doings happening on that network and that it is their duty to secure them.

  3. An IP address does not represent a person. Legally, an accusation based on IP-only does not stand. That IP can be hijacked by malware or another person can be behind the terminal using it when the offense is done.

  4. The notice you got can be considered blackmail. I put it under blackmail because the letter is sent by law firms (that hire specialized third-party services that are scanning P2P nodes and clients, recording IP adresses that are currently downloading illegally in Germany, after which they are authorized by law to ask your internet provider to disclose any information linked to that IP adress), which in turn are hired by companies owning the copyrighted items. So it's a 3rd party involved. Basically, the letter is a warning to let you know that this 3rd party entity knows what you did and if you do not want to go to court you should pay a fine.

  5. Given (4), such a case would rarely reach a court because of (3) and other aspects.

Conclusion: Ignoring it would be the recommended choice is this situation. You'll probably never hear from them again, unless you repeat the offense, in which case they will dig more into the matter and they could gather more evidence than (3), which will make the basics for a possible legal case. If you also received a document named "Unterlassungserklärung" you should not sign it as doing that would be an admission of guilt, which would give them a lot more legal ground to pursue things further.

  • I think this is possibly off-topic here. Yes, this questions has several angles: the law, the practical application of the law, the technical part, the scam possibility... As this is on security stack exchange and from the way the question is asked, I would suspect it is the technical part that should be discussed here. That is what I did. I and probably most people here have no idea if your answer is correct, sensible and have no ability to give feedback. That is why I think this question should be re-asked on law stackexchange if the law part is to be discussed. – Peter Harmann Apr 12 '19 at 13:43
  • Agreed, but the 2 are related. – Overmind Apr 15 '19 at 5:07

First of all, before you have more info DO NOT pay anything. Consider the possibility that this is a scam. In particular, if you were using a VPN, then there should have been no way for the authorities obtained your IP address unless the VPN provider just handed it over. That would be a terrible publicity move for the VPN.

Furthermore, it doesn't sit right that you would get one of these letters just based on an IP address unless you have specifically paid for a static ip address. Of course the authorities can go to your ISP and ask who had that IP at that time, but if you were using a VPN, then no way.

Finally, how were you informed that you will be fined? By email, phone, or post? And how do they want you to pay? For instance, do they give you an IBAN that you should transfer money to? All of these things are important when it comes to determining whether it is a scam. If they informed you by post and gave you an IBAN, then this is probably legitimate. If they informed you by email and want you to put in Bitcoin, then this is a scam.

  • If he has to go to court it's probably not fake. – Vit Apr 11 '19 at 22:34
  • Scammers almost always put something like that in the email/letter to scare you into paying – bremen_matt Apr 11 '19 at 22:38
  • Yeah, if its just an email, don't worry, but if its really from the court is what I meant. – Vit Apr 11 '19 at 22:44
  • 1
    Simple: BTC or €? – Mirsad Apr 12 '19 at 0:14

While I am not sure if the CyberGhost extension is the culprit, malware that uses your computer to do nefarious things is common. It is called botnet.

The way it could have worked in this case is that your computer was infected (maybe by the extension or in another way) and used as a VPN exit node. Legitimate VPNs use their own servers in data centers as exit nodes. This means you connect to the server and the server then sends the data on your behalf. This means the data has the IP of the server of the VPN provider, instead of yours. A neferious VPN provider may choose to save money for having a server by infecting peoples computers and using these as VPN exit nodes. Them or their customers would then connect to your PC and send their data under your IP. This has the same effect as using a legitimate VPN but does not cost them anything.

Another possibility is that CyberGhost uses your computer as an exit node as part of their service. I never heard about a legitimate VPN doing this but it may be burried somewhere in the EULA.

Of course other possibility is someone stealing your internet connection by for example guessing your wi-fi password. This would also result in them having the same IP.

Finally, IP should not be enough to convict you in court. But whether it would ever be possible or cost effective to fight it in court is a question for your lawyer. You should also ask about the law part of this question on Law SE.

  • 1
    These 1000+ EUR threat letters are cousins to those "I have a video of you watching porn" ransom emails. Probably nothing will happen if you don't pay, but the amount is comparably low as the alternative is way worse. – Esa Jokinen Apr 11 '19 at 20:14
  • @EsaJokinen ; see my reply. It's a possibility, but not likely. – Overmind Apr 12 '19 at 8:08
  • 1
    @EsaJokinen I do not disagree, but I don't think this is the correct stackexchange site to discuss law, that is why I stick to the technical part. Edited to add link to law se – Peter Harmann Apr 12 '19 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.