Shaw dragged into legal battle

SPAM ALLEGATION

Amazon.com subsidiary Twitch has petitioned the B.C. Supreme Court in an effort to find out the identity of a Shaw Communications IP address user after Twitch’s social streaming site, used mainly by gamers, suffered a spambot attack that allegedly originated in the Vancouver suburb of Coquitlam, B.C. customer information in accordance with the Personal Information Protection and Electronic Documents Act and does not release such information unless mandated by law.”

This type of request, called a Norwich order based on a U.K case, permits a court to order a third party to cough up information to an applicant that has no cause of action against it and isn’t party to any action.

This particular request is a bit unusual since Twitch is demanding slightly more information than is typically turned over, said David Fewer, executive director at the Canadian Internet Policy and Public Interest Clinic.

Protocol dictates Internet service providers don’t give out subscribers’ identity to private entities without a court order. Since such requests are based on allegations, not judgments, Fewer said it’s a tricky balance for providers who want the public to know they protect privacy but don’t want to be seen as helping criminals.

“Internet service providers hate these things because they’re just a cost,” Fewer said. “The only plus side is getting a black eye in media.”

Providers rarely challenge the evidence since it would cost far more than any reimbursements, he added, leading to Norwich orders being given out a “bit too routinely” in Canada without compelling evidence.

He said he’s surprised a company with Twitch’s resources — Amazon bought it for nearly $1 billion in 2014 — wasn’t able to thwart the attacks, and said the petition might be a bid to deter future attackers.

Companies have become better at blocking spammers over the past few years, helped by anti-spam organizations and local laws that come with onerous penalties, Digital Defence CEO Robert Beggs said. Still, Beggs said it remains challenging to catch a perpetrator based on an IP address since it can be difficult to prove a specific person was using the connection at a specific time.