What Is Peer to Peer File Sharing? How P2P Works, Legality and Risks

Billions of files were shared across FastTrack and Gnutella networks each month, according to the Supreme Court’s 2005 Grokster opinion. Peer to peer file sharing takes its name from that design: The peer to peer (P2P) networks are so called because users’ computers communicate directly with each other, not through central servers. The design outlived the lawsuits: At Microsoft IT, more than 76% of content came from peer devices versus the Internet after it deployed Delivery Optimization.

The US Copyright Office warns that sharing copyrighted files without the copyright owner’s authority can bring statutory damages of up to $30,000 per work. The Federal Trade Commission (FTC) has also notified almost 100 organizations that their data was exposed on P2P networks.

Key Takeaways

• The Grokster record showed well over 100 million copies of the software at issue had been downloaded.
• Microsoft IT got more than 76% of its content from peer devices after deploying Delivery Optimization.
• US copyright law sets statutory damages at not less than $750 and not more than $30,000 per work, or up to $150,000 if willful.
• Grokster was decided on June 27, 2005, holding distributors liable when they promote infringement.
• In February 2010 the FTC notified almost 100 organizations that customer or employee data was available on P2P networks.
• A 2006 study of the KaZaA network found over 15% of crawled files were infected by 52 different viruses.

What is peer to peer file sharing?

The FTC describes P2P technology as letting computer users share communications, processing power and data files with other users. In a P2P network, users’ computers communicate directly with each other, not through central servers, as the Supreme Court put it. By June 2005, tens of millions of individuals had used a P2P file-sharing program, per the FTC.

Cloud storage services work the other way: The file sits on the provider’s servers, and every download starts there. In a P2P setup, the copy you download comes from other people on the same network. Syncthing, for example, says none of your data is ever stored anywhere other than on your computers, and there is no central server that might be compromised.

Peer and node: BitTorrent’s specification defines a peer as a client or server that implements the BitTorrent protocol. A node is a client or server that implements the distributed hash table protocol.

Where P2P File Sharing Runs Today

Microsoft’s Delivery Optimization lets Windows devices download update packages from other devices on the network, in addition to internet servers. It is enabled by default for peer to peer sharing on the local network in the Enterprise, Professional and Education editions of Windows client. Microsoft also says the use of peer to peer is optional.

By the numbers: Microsoft IT deployed Delivery Optimization to all managed devices through Group Policy, limiting sharing to devices in the same Active Directory domain. Content stayed cached for 24 hours, and more than 76% of content came from peer devices versus the Internet.

The InterPlanetary File System (IPFS) applies the idea to a whole file system. IPFS addresses data by its contents rather than by a location such as an IP address. BitTorrent applies a related check: A client verifies each downloaded piece against its hash, whichever peer sent it.

Do peer to peer networks still exist?

Yes, in Windows updates, sync tools and public swarms. Windows update downloads can come from other PCs on the same network. Syncthing syncs files with no central server, encrypts all communication and lets only devices you approve connect. Public BitTorrent swarms carry on alongside them for large open-source and media downloads.

How does peer to peer file sharing work?

The BitTorrent specification explains the core trick: When many people download the same file at once, the downloaders upload to each other. That lets the file source support very large numbers of downloaders with only a modest increase in its load. Every current BitTorrent implementation requests data in 16 kiB blocks and closes connections that ask for more. A typical transfer runs in four stages:

1. Find the file. On the FastTrack network, a search goes to a supernode, which checks its index and tells the requester where the file is.
2. Download the pieces. BitTorrent splits a file into pieces numbered from zero, and a peer checks each finished piece against its hash.
3. Announce and share back. Once a piece’s hash matches, the peer announces to all of its peers that it has that piece.
4. Manage who gets data. Choking tells a peer that no data will be sent until unchoking happens.

In the FastTrack and Gnutella programs, the downloaded file landed in a designated sharing folder, where other users could download it in turn. That sharing folder matters for privacy, and it returns in the risks section below.

What are the three types of P2P networks?

Most P2P networks find files in one of three ways. FastTrack sent searches to supernodes that kept temporary indexes of files on connected computers. Some versions of the Gnutella protocol had no supernodes, so each search passed from one connected peer to the next. BitTorrent’s distributed hash table (DHT) stores peer locations across nodes, so each peer becomes a tracker.

Textbooks label these hybrid, unstructured and structured networks. The flat Gnutella design is the simplest: Every computer is equal, and a search simply spreads outward until someone answers.

Source: Supreme Court of the United States 2005, BitTorrent.org BEP 5

How BitTorrent Finds Peers With Trackers and DHT

A BitTorrent tracker answers a downloader with a list of peers, each with a peer ID, an IP address and a port number. The reply also sets an interval, the number of seconds to wait before asking again. DHT node IDs are chosen at random from the same 160-bit space as BitTorrent infohashes.

BitTorrent clients include a DHT node, which contacts other nodes to get the location of peers to download from. Either way, other members of a swarm see your IP address, which is why people who route torrent traffic through a virtual private network (VPN) run a VPN leak test before trusting it.

Benefits of Peer to Peer File Sharing

The FTC’s June 2005 staff report said P2P can yield significant benefits: faster file transfers, conserved bandwidth and reduced storage needs. Universities, government agencies, corporations and libraries use P2P networks to store and distribute files, the Supreme Court noted.

• Speed for popular files: Because copies of a popular file sit on many users’ computers, file requests and retrievals may be faster than on other networks.
• Lower server cost: With no central server, high-bandwidth server capacity and costly server storage are not needed.
• No single point of failure: A glitch in a server cannot disable the network in its entirety.
• Scale for the publisher: One source can serve very large numbers of downloaders with only a modest increase in its load.

Popular File Sharing Programs of the 2000s

Copyright holders sued Napster, the notorious file-sharing service, with court rulings in 2000 and, on appeal, in 2001. Grokster ran on the FastTrack network, and Morpheus made the Gnutella network available to its users. Frostwire offered FrostWire Desktop and FrostWire for Android, both sharing files over Gnutella.

StreamCast gave away OpenNap after Napster was sued, a program compatible with Napster and open to Napster users. KaZaA was the network a 2006 measurement study crawled for more than 500,000 files. The timeline below tracks how courts and the FTC caught up with each generation of software, with Grokster as the pivot. Grokster was decided on June 27, 2005.

Is peer to peer file sharing legal?

The U.S. Copyright Office says uploading or downloading copyrighted works without the owner’s authority infringes the owner’s rights of reproduction and distribution. An infringer may owe statutory damages of up to $30,000 per work, or up to $150,000 per work if the infringement is willful. The software is a tool; what you upload or download decides the risk.

The statute lets a court award not less than $750 and not more than $30,000 per work. A court may lower that to not less than $200 for an infringer who had no reason to believe the acts were infringing. The infringer may also owe the copyright owner’s attorney’s fees.

The willful ceiling of not more than $150,000 per work is 750 times the innocent-infringer floor of not less than $200. In Grokster, the Supreme Court held that one who distributes a device to promote infringement is liable for the resulting infringement by third parties. That liability applies regardless of the device’s lawful uses, and the opinion was delivered for a unanimous Court.

Key finding: A statistician commissioned by MGM found nearly 90% of the files available on the FastTrack system were copyrighted works, a figure Grokster and StreamCast disputed. Statutory damages are counted per work, so a shared folder of albums or films multiplies the exposure.

What are the disadvantages and risks of P2P?

The FTC’s 2005 report listed consumer risks related to data security, spyware and adware, viruses, copyright infringement and unwanted pornography. A 2006 KaZaA study used 364 malware signatures and found over 15% of crawled files were infected by 52 different viruses.

Check what your client shares: The FTC warns that when P2P file-sharing software is not configured properly, files not intended for sharing may be accessible to anyone on the network.

In February 2010, the FTC notified almost 100 organizations that sensitive customer or employee data had been shared from their networks onto P2P networks. It found health-related information, financial records, driver’s license numbers and Social Security numbers. The notices reached businesses with as few as eight employees and corporations employing tens of thousands.

In October 2011, Frostwire settled FTC charges over FrostWire for Android, whose default settings publicly shared users’ photos, videos and documents right after setup. The settlement bars Frostwire from default settings that share consumers’ files.

Worth noting: The same FTC report found little empirical evidence that these risks are greater with P2P programs than with web surfing, software downloads or email. The risk sits in configuration and in what you download, more than in the P2P design itself.

How to Use P2P File Sharing More Safely

Authorized services let consumers avoid infringement liability and limit exposure to viruses, unexpected material or spyware, according to the Copyright Office. The FTC says P2P programs should be properly configured, because a misconfigured client can expose files never meant for sharing.

1. Share one dedicated folder. Keep personal documents, tax files and photos outside the folder your client shares.
2. Check the defaults after every install. The FTC’s October 11, 2011 settlement says Frostwire’s Android app shared users’ files immediately upon installation and setup.
3. Prefer tools that approve devices. Syncthing identifies every device with a cryptographic certificate and lets only devices you have explicitly allowed connect. It is one of the legal P2P file sharing programs built around that approval model.
4. Scan programs before running them. Treat any program downloaded from a swarm as untrusted until an up-to-date scanner has checked it.
5. Decide how Windows shares updates. Admins can change Delivery Optimization’s peer behavior in Group Policy or in mobile device management tools such as Microsoft Intune.

Conclusion

Grokster’s record showed billions of files crossing FastTrack and Gnutella each month. Microsoft IT got more than 76% of its Delivery Optimization content from peer devices. Peer to peer file sharing survived because the design is efficient; the legal and privacy risk sits in what a client uploads and downloads. Before installing any P2P client, check its sharing folder and defaults, and keep to files you hold the rights to or that are openly licensed.