| Italian here. If somebody wants to read the full document about the fine (in italian) it's here: https://www.agcom.it/sites/default/files/provvedimenti/delib... Part of this doc states: ```
The rights holders also declared, under their own responsibility, providing
certified documentary evidence of the current nature of the unlawful conduct, that the reported
domain names and IP addresses were unequivocally intended to infringe the
copyright and related rights of the audiovisual works relating to live broadcast sporting events
and similar events covered by the reports.
``` So, I'm not sure anybody verified that what the right holders claimed was actually true. While I understand what AGCOM (the italian FCC, more-or-less) is trying to do, it seems that, as usual, a law was created without verifying how the implementation of such law would work in practice (something very common in Italy), and this is the result. Cloudflare CEO seems irate, and some of his references are not great, but I'd be inclined at thinking he's got at least _some_ reason on his side. |
It’s a mess technically: it mandates ISPs and DNS providers to block IPs/domains within 30 minutes of a report, with zero judicial oversight. It’s infamous locally for false positives—it has previously taken down Google Drive nodes and random legitimate CDNs just because they shared an IP with a pirate stream.
The NUCLEAR threat regarding the 2026 Winter Olympics (Milano-Cortina) is the real leverage here. He’s bypassing the regulator and putting a gun to the government’s head regarding national prestige and infrastructure security.
My personal take idea likely outcome: Cloudflare wins.
EU Law: The order almost certainly violates the Digital Services Act (DSA) regarding general monitoring obligations and country-of-origin principles. Realpolitik: The Italian government can't risk the Olympics infrastructure getting DDoS'd into oblivion because AGCOM picked a fight they can't win. They will likely settle for a standard, court-ordered geo-block down the road, but the idea of Cloudflare integrating with a broken 30-minute takedown API is dead on arrival.