In a dramatic shift from traditional website-blocking tactics that have long frustrated intellectual property enforcement agencies, Belgium’s Department for Combating Online Infringement (BAPO) has launched a sweeping new campaign designed to unmask the individuals operating major illicit streaming and download networks. Rather than merely playing a game of digital whack-a-mole—where pirate sites quickly circumvent DNS-blocking orders by adopting new domain names—Belgian authorities are targeting the infrastructure of anonymity itself.
Backed by decisive rulings from the French-speaking Business Court of Brussels, BAPO has issued a series of binding legal demands compelling domain name registrars and registries to hand over deeply sensitive personal, financial, and technical data belonging to suspected site operators. While court-mandated redactions obscure the identities of the specific rightsholders and targeted domains, the legal rationale explicitly invokes the preservation of the "sports economy and the European solidarity model," pointing squarely at the multi-billion-dollar ecosystem of unauthorized sports broadcasting.
The scope of these orders is unprecedented in its invasiveness. Registrars have been instructed to dredge up historical customer data spanning basic contact details, full International Bank Account Numbers (IBANs), credit card details, cryptocurrency transaction hash IDs, and a full year’s worth of server access logs, IP addresses, and user-agent fingerprints. To ensure these investigations proceed without interference, the courts have slapped strict gag orders on the targeted intermediaries, utilizing exceptions under the European Union’s Digital Services Act (DSA) to prevent registrars from notifying their customers that their digital footprints have been exposed to private litigants.
This comprehensive investigative report examines the mechanics of BAPO’s latest legal offensive, evaluates the extensive scope of the data collection orders, analyzes the regulatory tensions surrounding the EU’s Digital Services Act, and explores the broader implications of extraterritorial enforcement in the ongoing war against digital piracy.
For years, Belgium’s anti-piracy strategy relied heavily on reactive site-blocking mechanisms. Governed by decisions issued by the Brussels Business Court and executed through BAPO, internet service providers (ISPs) were ordered to block access to domains flagged for copyright infringement. However, this method suffered from inherent structural weaknesses. Pirate networks routinely engaged in "domain hopping," shifting their operations to alternative top-level domains or freshly minted web addresses almost as quickly as authorities could update blocking injunctions.
Frustrated by the persistent game of evasion, BAPO and its yet-unnamed rightsholder allies shifted their strategic focus upstream. Instead of stopping end-user access to infringing streams, the legal strategy now aims to choke off the operators by cutting through the veil of corporate privacy that protects domain registrants.
The Brussels Business Court Rulings
This week, BAPO unveiled a tranche of five distinct legal decisions rooted in a foundational order handed down by the French-speaking Business Court of Brussels.
Four Domain Registrar Orders: These decisions target specific companies providing domain registration services, compelling them to turn over exhaustive customer profiles.
One Domain Registry Order: This decision targets a top-level domain registry that retains registrant records directly, requesting structural account histories, nameserver configurations, and historical modification logs.
Although BAPO maintains that the blanket redactions and secrecy surrounding the filings are mandated directly by the court rather than administrative choice, contextual clues within the documents provide transparency. The court’s justification explicitly emphasizes safeguarding the financial integrity of the European sports economy. Furthermore, inadvertent disclosures within the text of the public documents reveal that at least three prominent EU-based domain registrars have been snared in the enforcement net: Hosting Concepts, Hostinger, and Key Systems.
The identities of the fourth registrar, the domain registry, the rightsholders, and the exact pirate domains remain hidden behind judicial placeholders, leaving industry observers to speculate on the full scale of the operation.
The Granular Scope of Data Demands
The breadth of information demanded by the Brussels Business Court underscores a sophisticated understanding of how modern illicit operations are funded and managed. The four registrar decisions do not merely ask for registration names; they demand seven distinct categories of exhaustive metadata designed to map out every facet of an operator’s digital existence.
1. Identity and Contact Profiles
Intermediaries must surrender all historical identity markers attached to the targeted accounts. This includes:
Full legal names of account holders.
Every postal address ever associated with the account.
All email addresses linked to the user profile, including secondary or recovery contacts.
Every telephone number registered across the lifecycle of the account.
2. Traditional Financial Trails
Recognizing that many commercial pirate networks operate for profit through subscriptions or illicit advertising revenue, the court orders require the disclosure of traditional banking data:
Complete IBANs (International Bank Account Numbers).
Exact legal names of all individuals holding or controlling the relevant bank accounts.
Detailed credit and debit card information, including card types, countries of issue, and the specific identity of the issuing banks.
3. Cryptocurrency and Decentralized Assets
Modern cybercrime frequently utilizes digital currencies to obfuscate cash flows. BAPO’s orders specifically sweep in blockchain transactions. Registrars must provide:
All crypto-asset payment methods utilized by the customer.
Specific blockchain wallet addresses used for deposits or payouts.
Identifiers regarding the exact type of cryptocurrency involved.
Transaction identifiers and cryptographic hash IDs mapping out specific payments.
4. Technical Logs and Digital Fingerprints
To tie a physical human being to a digital console, the directives demand deep technical forensics from the registrars’ server logs:
The original IP address utilized when the customer account was first created.
Device types, operating systems, and web browsers used during account generation and subsequent administrative logins.
Complete historical connection data and access logs retained by the intermediary for the preceding twelve (12) months.
Meanwhile, the single domain registry order adopts a more focused technical approach, requesting foundational registrant data, the identity of the retail registrar handling the domain, active nameservers, and a comprehensive historical record of all administrative changes made to the domain configuration over time.
The Gag Order Controversy and the Digital Services Act (DSA)
One of the most legally contentious elements of BAPO’s current campaign is the imposition of an absolute gag order. The targeted domain registrars and registry are strictly prohibited from notifying their customers—or any external third parties, including the press—that their private data has been subpoenaed, compiled, and handed over to private litigants.
The blanket restriction covers "any information concerning the very existence of these proceedings or of the order, or of any matter connected with the proceedings."
Navigating the DSA Exemption
This secrecy directly collides with the standard operating procedures mandated by the European Union’s Digital Services Act (DSA). Under normal circumstances, Article 10 of the DSA and broader European consumer protection frameworks require online intermediaries to inform affected users whenever administrative or judicial orders result in the disclosure of their personal data.
However, BAPO has invoked a vital statutory exception embedded within the regulatory framework: the exemption for criminal investigations, prevention, and prosecution. By framing the data-gathering exercise as a necessary precursor to penal action against intellectual property theft and organized fraud, the Belgian authorities have effectively locked the door on user transparency.
Civil liberties advocates and digital rights groups have expressed quiet concern over this mechanism. The arrangement means that suspected operators of pirate networks can have their banking histories, cryptocurrency portfolios, and domestic connection logs funneled directly to rightsholders and prosecutors without ever receiving formal notice, a preliminary hearing, or an immediate opportunity to challenge the breadth of the subpoena in open court.
Jurisdictional Reach and Enforceability Challenges
A central question hanging over BAPO’s latest initiative is whether a Belgian administrative department and a local business court possess the jurisdictional authority to compel foreign corporations to surrender such sensitive data.
The Reach of Article 10 of the DSA
The legal foundation of BAPO’s orders relies heavily on Article 10 of the Digital Services Act, which governs how information orders apply to digital service providers established in other EU member states. However, BAPO’s statutory powers derive strictly from Belgian national legislation. Because all publicly identified intermediaries—Hosting Concepts, Hostinger, and Key Systems—are headquartered outside of Belgium within the broader European Union, the actual enforceability of these cross-border administrative demands remains untested.
When pressed by investigators, BAPO adopted an exceptionally aggressive stance regarding its jurisdictional reach. Representatives asserted that the agency’s authority is not even strictly limited to the borders of the European Union. Citing Belgian civil procedure codes and interpretations of the DSA, BAPO claimed:
"Every intermediary whose service is being used to give access to illegal content within the Belgian territory can be ordered to disclose information regarding its customer."
A Global Precedent or an Overreach?
This assertion represents a remarkably broad interpretation of digital sovereignty. If accepted and enforced by courts across international jurisdictions, it would grant European anti-piracy agencies unilateral power to demand user identification from registrars globally, provided a fraction of a website’s traffic crosses into Belgian cyberspace.
Legal scholars note that this expansive claim will likely face severe friction. Foreign registrars operating under distinct national privacy laws—such as the CCPA in California or GDPR-adjacent frameworks in non-EU jurisdictions—may push back against foreign administrative orders that bypass domestic mutual legal assistance treaties (MLATs). Furthermore, because the proceedings remain shrouded in strict judicial secrecy, the public, the press, and legal experts are left entirely in the dark regarding whether foreign intermediaries are actively complying with the demands or preparing to mount legal challenges in higher European courts.
Future Outlook: What Lies Ahead for Digital Enforcement
The launch of BAPO’s unmasking campaign marks a critical evolution in European copyright enforcement. As domain blocking proves increasingly insufficient against adaptable pirate networks, rightsholders and regulatory bodies are pivoting toward financial tracking and personal identification as the ultimate deterrents.
Key Trends to Watch
The Rise of Identity-First Enforcement: If Belgian authorities successfully leverage these registrar orders to unmask operators, other EU member states (such as Italy, France, and Spain, which maintain aggressive anti-piracy postures) are virtually guaranteed to adopt identical legal playbooks.
Litigation Over the DSA Gag Orders: Civil rights organizations and privacy watchdogs are expected to scrutinize the routine use of criminal investigation exemptions to bypass DSA user-notification requirements. Legal challenges questioning whether intellectual property enforcement meets the rigorous threshold required to suppress user notification could soon reach the Court of Justice of the European Union (CJEU).
Decentralized and Bulletproof Registrars: As mainstream EU-based registrars face increasing pressure to hand over comprehensive financial and technical logs, the underground piracy ecosystem will likely accelerate its migration toward offshore, non-compliant, and privacy-centric domain registries that routinely ignore European court orders.
For now, the digital battleground in Belgium has moved away from the browser and deep into the corporate archives of domain registrars. Whether BAPO’s sweeping financial and technical subpoenas will successfully dismantle major streaming rings—or simply drive the infrastructure further into the shadows—will depend on how foreign intermediaries respond to these extraordinary legal demands behind closed doors.
