In a significant escalation of its ongoing efforts to curb online copyright infringement, Belgium’s Department for Combating Online Infringement (BAPO) has launched a sweeping new legal campaign. Moving beyond traditional—and frequently circumvented—site-blocking orders, BAPO has executed a series of targeted legal maneuvers designed to unmask the individuals and entities operating major pirate platforms.
Backed by a set of unprecedented decisions issued this week by the French-speaking Business Court of Brussels, BAPO is compelling domain name registrars and registries to surrender exhaustive data profiles on suspected infringers. Rather than playing an endless game of whack-a-mole with rapidly shifting domain names, the Belgian authorities are striking at the financial and operational roots of online piracy.
However, the aggressive scope of these legal decisions has ignited a fierce debate over digital privacy, transparency, and the limits of cross-border enforcement. The court orders mandate the handover of deeply sensitive personal records, including complete banking histories, cryptocurrency transaction hashes, historical server logs, and associated IP addresses. Compounding these privacy concerns is a strict gag order prohibiting the targeted intermediaries from notifying their customers that their data has been compromised.
While BAPO relies on the European Union’s Digital Services Act (DSA) and domestic civil procedures to justify its expansive reach, legal experts are questioning how these extraterritorial demands will hold up against international data protection frameworks. As the public and the press are left in the dark due to heavy redactions, this watershed moment in European anti-piracy enforcement signals a stark new paradigm: anonymity online is increasingly fragile, and the judiciary is willing to bypass transparency in the name of safeguarding the modern sports and entertainment economy.
Detailed Chronology
The Limitations of Traditional Site Blocking
For years, BAPO has functioned as Belgium’s administrative frontline against digital piracy, routinely issuing site-blocking decisions anchored in orders from the Brussels Business Court. While these measures have historically succeeded in blocking mainstream access to notorious illicit streaming and torrenting portals, they suffer from a fundamental flaw: domain hopping.
Operators of pirate websites frequently pivot to new domain names within hours of a block being implemented, rendering reactive IP and DNS blocking strategies largely inefficient. Frustrated by the cat-and-mouse nature of traditional enforcement, Belgian authorities began exploring proactive strategies to target the structural foundations of illegal streaming networks.
The Brussels Business Court Intervenes
The turning point arrived this week with the issuance of five distinct administrative decisions by BAPO, directly tied to an underlying order from the Business Court of Brussels. Four of these legal instruments target prominent domain name registrars, while a fifth focuses on a domain name registry holding direct registrant records.
While the documents are heavily redacted—omitting the names of rightsholders and specific targeted websites—the court’s legal reasoning explicitly highlights the necessity of preserving "the sports economy and the European solidarity model." This specific phrasing serves as a clear indicator that the primary focus of the operation is combating unauthorized streaming of major athletic competitions.
Despite the sweeping nature of the orders, BAPO maintains that the extreme secrecy surrounding the proceedings was mandated by the judiciary rather than chosen by the enforcement agency itself. According to BAPO officials, the presiding judge ordered the disclosure of specific dossiers exclusively to empower plaintiffs to identify infringers and pursue further investigations, while simultaneously ruling that the identities of the targeted platforms and select intermediaries must remain confidential.
Accidental Disclosures and Targeted Intermediaries
Although the court attempted to scrub all identifying information from the public record, inadvertent mentions within the published documents have unmasked three major EU-based domain registrars caught in the crosshairs:
Hosting Concepts
Hostinger
Key Systems
A fourth registrar, an unnamed domain registry, and the specific domains under investigation remain shielded behind legal placeholders. BAPO has not clarified whether or when these domain names or remaining intermediaries will be publicly identified.
Supporting Context & Metrics
The information extraction demands authorized by the Brussels Business Court are staggering in their breadth. The four registrar decisions compel intermediaries to yield seven distinct categories of personal and technical data, effectively stripping away any veil of digital anonymity previously enjoyed by the account holders.
The Anatomy of a Data Demand
The information ordered to be surrendered spans personal identification, financial trails, and deep-level technical connection metrics:
Personal Identity Records: The customer’s legal name, alongside every postal address, email address, and telephone number historically attached to the account.
Traditional Banking Details: Full International Bank Account Numbers (IBANs), the exact legal names of bank account holders, and exhaustive credit or debit card metadata down to the issuing bank, country of origin, and card type.
Cryptocurrency Transactions: Comprehensive tracking for blockchain-based payments, including specific crypto-wallet addresses utilized, the exact type of cryptocurrency transacted, and transaction identifiers (hash IDs).
Account Creation Telemetry: Server logs capturing the initial IP address, device type, operating system, and web browser employed during account registration.
Connection Logs: Twelve months of historical connection logs and network data detailing how the customer accessed and utilized the intermediary services over the past year.
In contrast, the order directed at the unnamed domain registry is somewhat narrower, focusing on baseline registrant details, the identity of the registrar of record, active nameservers, and a complete chronological history of domain modifications. The Brussels Business Court concluded that these extensive intrusions into personal privacy are proportionate when weighed against the economic damages inflicted by large-scale copyright infringement.
The Gag Order and the DSA Clash
Compounding the severity of these data handovers is a strict gag order barring the intermediaries from informing affected customers or third parties—including the media—about the existence of the proceedings, the information requests, or any related matters.
This directive places Belgian enforcement in direct tension with the European Union’s Digital Services Act (DSA). Typically, the DSA mandates that digital service providers notify users when their data has been accessed or transferred pursuant to an administrative or legal order. However, BAPO has invoked a statutory exception within the regulatory framework that waives notification requirements when criminal investigations and prosecutions are actively at stake.
While the precise criminal allegations underpinning the orders remain undisclosed, the practical reality is absolute: pirate site operators face the prospect of having their entire digital footprint—from banking histories to personal IP addresses—handed over to private rightsholders without their knowledge or an opportunity to mount an immediate legal defense.
Official Statements
When questioned about the legal viability and jurisdictional limits of these orders, BAPO offered an expansive interpretation of its authority. The agency asserted that its powers are not strictly bound by Belgian or even European borders.
Speaking to digital rights publication TorrentFreak, BAPO representatives argued that under Belgian civil procedure principles and the framework of the DSA:
"Every intermediary whose service is being used to give access to illegal content within the Belgian territory can be ordered to disclose information regarding its customer."
This assertion represents a remarkably broad jurisdictional claim. Because all of the identified registrars operate outside of Belgium—spanning multiple European jurisdictions—the enforceability of these administrative decisions across national borders remains a critical question for international legal scholars.
Furthermore, BAPO reiterated that the decision to obscure the identities of the targeted platforms, the rightsholders, and most of the intermediaries was a judicial requirement dictated by the Brussels Business Court, intended strictly to protect the integrity of ongoing private and criminal investigative proceedings.
Future Outlook
The launch of BAPO’s data-collection campaign marks a watershed moment in European copyright enforcement, fundamentally shifting the battleground from network-level blocking to the systematic dismantling of operator anonymity. By forcing domain registrars to hand over financial, crypto-asset, and connection data, Belgium is pioneering a blueprint that other EU member states may soon seek to replicate.
However, this aggressive strategy faces significant hurdles and profound criticisms:
Jurisdictional Battles: Legal experts are closely watching whether foreign domain registrars—some operating under different national interpretations of the DSA—will voluntarily comply with sweeping Belgian court orders, or if they will challenge the extraterritorial reach of BAPO in higher European courts.
Privacy and Due Process Concerns: Civil liberties advocates are expected to sound the alarm over the weaponization of gag orders to bypass the transparency protections built into the Digital Services Act. Depriving individuals of notice and the right to contest data disclosures sets a controversial precedent for digital privacy rights within the EU.
The Adaptability of Illicit Networks: While unmasking operators is a severe blow, sophisticated pirate networks have historically demonstrated immense resilience, frequently utilizing proxy registrants, stolen identities, and decentralized corporate structures to insulate actual ringleaders from direct legal liability.
Ultimately, whether BAPO’s gambit succeeds in deterring sports piracy or merely drives illicit operators further into the shadows will depend on how international courts balance intellectual property rights against fundamental data privacy guarantees in the digital age.
