The Pirate Bay Is an FBI Honeypot: a Disconcertingly Plausible Conspiracy Theory

After months of false starts and constant hype about its prospective return, The Pirate Bay finally came back this weekend. But the response hasn’t been purely excitement from would-be pirates. Instead, it’s been suspicion: Is the FBI running The Pirate Bay as a means to crack down on piracy?

The Pirate Bay truther movement doesn’t really have any hard facts or any suggestions as to who could actually be running the torrent site, but theorize that the FBI or other government agency (either in the US or Sweden) could have brought the site back online as a honeypot, or fake site meant to entrap criminals. In any case, something “feels off” to many Twitter users and some Reddit users.

An Anonymous sect called The Anonymous Message has also tweeted that it’s “gotten reports that [TPB] has been seized indirectly by the FBI and is logging IPs.”

It’s worth noting that The Anonymous Message is quite controversial and that its Twitter account often serves mainly to promote itself with hacking and raiding campaigns that have been underwhelming. In the last few months alone, it has started campaigns against ISIS, GamerGate, the KKK, pedophiles, and police who have been accused of killing people. Few of those raids have turned up anything worthwhile. The Anonymous Message provided no proof of the FBI being involved in The Pirate Bay, but that hasn’t stopped its theory from gaining some steam online.

The main concern people seem to have is the site’s use of CloudFlare, a content delivery tool company that can protect sites from DDoS attacks and help manage a large influx of traffic. 

To do this, it grabs IP addresses (a number assigned to each internet-connected device by its internet service provider that can often be used to identify a person), which conspiracy-minded folks say would be a nice thing for the FBI to have. Theoretically, if CloudFlare is saving these IP addresses, the FBI could subpoena CloudFlare for that data. And if the government is actually running the site, then it would have those IP addresses by default. The FBI could also use CloudFlare to hide the address of its server to those who are suspicious of it. 

“If done correctly, there is little to nothing that would give them away.” 

In a blog post, The Pirate Bay’s current administrator (we’re not sure who it is) said the site is only temporarily using CloudFlare.

“We have seen that there has been some question to why we are using CloudFlare. This is only initially to handle the massive load upon the servers. It will be removed shortly,” the admin wrote.

To add to the confusion, and to give some more fodder to conspiracy theorists, the admin also noted that he had fired all the moderators working for the site.

“Due to severe security issues regarding the old moderator team all moderation has temporarily been disabled. Before we sort everything out we have instead added a ‘Report link’ to all torrents which you can find in the details page,” the admin wrote.

“I have talked to FBI agents hypothesizing about carrying out such replacements on sites.”

Others have noted that there are no longer ads on the page, which normally went to sketchy porn sites. If a government agency was running the site, some argue, it wouldn’t want to promote porn.  I don’t believe that’s an argument worth buying into, but the idea of a government agency setting up a torrent site honeypot isn’t beyond the realm of possibility.

“There is a natural paranoia that kicks in on such matters, simply based on the logic of a single site lasting this long without being truly shut down,” Brian Martin, CEO of Attrition, one of the world’s most famous and longest-lasting hacker and security information websites, told me. Martin also works with a firm called Risk Based Security. “If done correctly, there is little to nothing that would give them away. I have talked to FBI agents hypothesizing about carrying out such replacements on sites.”

The fact that the site and seemingly all of its assets were seized by the Swedish government, only to return a couple months later with these changes is enough to make people skeptical. 

Adrian Sanabria, a security researcher with 451 Research, said that there’s no “one thing that could reveal any truth to a conspiracy.”

Sanabria ran some basic investigation tactics for me, taking a look at who is hosting, who owns the site, and DNS records. He said nothing eyebrow-raising came up. 

Meanwhile, people are already uploading torrents to the site, which, if the government were monitoring it, would be the point. The Pirate Bay doesn’t actually host any torrent files, it’s merely a repository of magnet links (which a torrent client can use to download the files). The idea would be that the government could have access to whoever is linking to these files and could use them to take down piracy rings.

The idea that piracy rings wouldn’t take adequate anonymization tactics seems farfetched, but ​considering how careless cybercriminals have been in the past, it’s not worth dismissing out-of-hand. 

It’s worth noting, however, that monitoring torrent traffic isn’t all that difficult in the first place. Seeders, the people who host the files being downloaded, are regularly identified by their internet service providers if they don’t take proper anonymization steps, and it’s not difficult for government agents to get their hands on that data either. It would merely require an agent to download a torrent and run some analytical tools on where download traffic is coming from.

Chances are, the Pirate Bay has not been compromised. But, at this point, we can’t say for sure, which seems a bit unsettling.

“In a post-Snowden world,” Sanabria said, “nothing would surprise me.”