The Machine That Builds Strike 3's Case Against You — and Why the Foundation Is Shakier Than It Looks
If you have received a letter telling you that Strike 3 Holdings has filed a federal lawsuit over alleged BitTorrent downloads of copyrighted films, you have almost certainly also encountered the phrase "VXN Scan." Strike 3 treats it as a trump card, a proprietary detection system so technically sophisticated that any denial of wrongdoing is futile. The implied message is simple: the machine caught you, resistance is pointless. You better settle or be shamed and lose a case about downloading pornography.
That framing deserves some skepticism — and I say that as someone who has tested it in litigation.
This firm was among the first in the country to take BitTorrent copyright evidence to the limit rather than settle. We pushed these cases into discovery, demanded the underlying PCAP data, retained technical experts, and forced Strike 3 to defend its detection methodology under conditions where the other side actually showed up to fight. What we found, and what the record in those cases reflects, is that VXN Scan is substantially weaker evidence than Strike 3's polished declarations suggest. We won.
Understanding why requires a look at what the technology actually captures — and, more importantly, what it does not.
What BitTorrent Is, and Why It Matters for the Lawsuit
BitTorrent is a peer-to-peer file-sharing protocol. Unlike downloading a file directly from a single server, BitTorrent breaks files into small pieces and distributes the work of sharing them across a network of users. Each participant in a "swarm" simultaneously downloads pieces from others and uploads pieces to others. Every device in the swarm is identified by an Internet Protocol (IP) address — a numerical label assigned to a network connection.
Strike 3, allegedly, built VXN Scan specifically to surveil BitTorrent swarms. The system operates by deploying a proprietary client, that is software that joins a swarm just like any other BitTorrent user, and recording the IP addresses it encounters along with timestamps, port numbers, BitTorrent client identifiers, and something called an "Info Hash value," which identifies the specific file being shared. The transaction records are captured in what are called PCAP files, which are packet-capture logs of raw network traffic. Strike 3 stores these logs, waits until a particular IP address accumulates at least 24 alleged infringement events, and then files suit.
The process sounds comprehensive. It is not nearly as airtight as it sounds.
The Problem VXN Scan Cannot Solve: IP Addresses Identify Routers, Not People
The most fundamental limitation of VXN Scan is also the most straightforward: an IP address identifies a network connection, not a human being. A single IP address is typically shared by an entire household. It covers every device connected to that router — laptops, phones, tablets, smart televisions, gaming consoles — and every person who uses those devices. It covers guests. It covers neighbors who may have accessed an unsecured or weakly secured network. It even covers an intruder who cracked a password.
Courts have recognized this problem explicitly. In at least one Strike 3 case, a federal court issued a protective order acknowledging that the names and addresses Strike 3 obtained from ISPs through subpoena "will not in fact be those of the individuals" responsible for the alleged downloading. The court recognized that the "risk of false positives gives rise to the potential for coercing unjust settlements from innocent defendants." That is a federal court saying, in plain language, that Strike 3's methodology is liable to identify the wrong person.
Strike 3 knows this. The company's model depends on it, in a perverse way. Because the IP-to-person connection is ambiguous, a defendant cannot easily prove a negative. Someone in the household may have done it. Someone passing through may have done it. The router may have been accessible to the street. None of that is easy to demonstrate, and Strike 3 exploits the resulting uncertainty to pressure settlements from people who may be entirely innocent.
What VXN Scan's Own Record Reveals
In the rare cases where Strike 3's detection methodology has been subjected to independent scrutiny, the results have been uncomfortable for the company.
In litigation that approached the trial stage, the defense obtained the underlying raw PCAP data — the actual packet captures that form the evidentiary foundation of every Strike 3 case — and subjected them to technical analysis. The defense's assessment was blunt: the raw PCAP data was extremely weak and close to non-existent, and when defense experts attempted to reconstruct viewable video files from the captured data, nothing was playable. Strike 3 settled the case before trial.
Even more striking is the question of quality controls. In legal proceedings, the issue of VXN Scan's false positive rate has been raised directly. The answer that emerged from Strike 3's own disclosures: there is no known false positive rate, because it was never measured. The system also lacked a user's manual and formal design documentation at the time of that inquiry, and it had never been independently verified by a third party.
To be clear about what that means: Strike 3 has been filing lawsuits by the thousands, it currently leads the nation in copyright lawsuit filings, on the basis of a detection system whose accuracy it has never formally tested and whose error rate is unknown.
What Strike 3 Actually Has to Prove — and Cannot Prove from VXN Scan Alone
This is the argument that Strike 3 least wants defendants to understand, because it goes to the heart of what copyright infringement actually requires.
Copyright infringement is not proved by showing that an IP address appeared in a BitTorrent swarm. It is proved by showing that a specific person copied protectable expression from a copyrighted work without authorization. Those are different things, and VXN Scan bridges the gap between them far less completely than Strike 3's complaints suggest.
Here is the problem. BitTorrent distributes files by breaking them into small pieces — sometimes hundreds of pieces — and exchanging them among participants in the swarm. VXN Scan captures that an IP address was present in a swarm associated with a particular file and that some packet exchange occurred. What VXN Scan does not establish, and what the PCAP data has failed to establish when actually tested, is that any protectable copyrighted expression was actually downloaded or uploaded from that IP address. The system records the traffic; it does not reliably reconstruct the content.
When defense experts in cases this firm litigated examined the underlying PCAP captures, they found the data insufficient to reconstruct viewable video. That is not a technical curiosity. It is a direct challenge to the infringement claim itself. If Strike 3 cannot show from its own detection data that any copyrightable expression — the film, or any meaningful portion of it — actually traveled to or from the defendant's IP address, then the entire premise of the lawsuit is unproven. I was one of, if not the first, to put to bed that software like this cannot prove infringement: We secured a summary judgment against a prior iteration of this business-litigation model when the only evidence was similar scan evidence without an admission or files on a computer.
What this means practically is that Strike 3 faces a significant evidentiary problem unless it can establish infringement through one of two alternative routes: an admission by the defendant, or the actual film file found on the defendant's device or in their digital history. Absent one of those, the evidentiary chain from "IP address in a swarm" to "this person infringed this copyright" has a gap that trained defense counsel can exploit.
A Critical Warning: Do Not Destroy Evidence
If you are reading this because you received a Strike 3 complaint or a notice from your ISP that your subscriber information has been subpoenaed, the next few sentences are the most important thing in this article.
Do not delete files from your devices. Do not wipe your hard drive. Do not factory-reset your phone or computer. Do not uninstall software. Do not ask anyone else to do any of these things on your behalf.
The moment you receive notice of a lawsuit, or notice that a lawsuit is reasonably anticipated, which includes an ISP subpoena letter, you have a legal duty to preserve potentially relevant evidence. That duty applies regardless of what the evidence shows. Destroying, altering, or concealing evidence after that duty attaches is called spoliation, and courts respond to it severely: adverse inference instructions that tell the jury to assume the destroyed evidence would have hurt you, monetary sanctions, and in egregious cases, dismissal of defenses or default judgment.
Here is the irony. If the film is not on your device, that is actually useful to your defense. A forensic examination that turns up no relevant files, no BitTorrent client, no download history, is evidence that supports your position. But it is only useful evidence if you can show it was preserved intact from the moment you had notice of the litigation. The moment you delete anything, you transform a clean examination into an inference of guilt.
Get counsel before you touch your devices. Let your attorney advise you on what a proper litigation hold looks like and whether a forensic preservation step is appropriate. The absence of infringing content on your hardware is a powerful defense — but only if you did not clean house first.
The 24-Download Threshold: A Feature, Not a Safeguard
Strike 3 presents its policy of waiting until a defendant has allegedly accumulated at least 24 documented downloads as evidence of care and precision. A more accurate description is that the threshold is a litigation strategy, not a quality control measure.
Requiring 24 alleged incidents before filing does make the case easier to defend against a motion to dismiss — it gives the complaint a certain heft. But if the initial detection methodology is unreliable, accumulating 24 unreliable data points does not produce a reliable result. It multiplies an error. The fact that VXN Scan flagged the same IP address two dozen times is not independent corroboration; it is the same technology generating the same type of output repeatedly.
What the threshold actually accomplishes for Strike 3 is improving the economics of each lawsuit. More alleged violations means more potential statutory damages, which means more settlement leverage. The 24-download minimum is calibrated to the settlement table, not the courthouse.
How Courts Have Actually Responded to Challenges
The judicial record on VXN Scan challenges is mixed but instructive. Some courts have accepted Strike 3's declarations at face value in early-stage proceedings, particularly when ruling on motions for expedited discovery — the preliminary step that allows Strike 3 to subpoena ISPs for subscriber information. Those rulings are made with minimal briefing and without adversarial testing of the technology.
Courts that have permitted actual scrutiny of the underlying data have reached different conclusions. The case that nearly went to trial is particularly significant: Strike 3's own evidence, when subjected to independent technical review and reconstruction, did not hold up. The company chose settlement over cross-examination of its expert witness about how a detection system with no measured error rate could reliably identify infringers.
Several judges have also questioned whether the mass filing model — identical complaints filed against John Doe defendants based on IP-address evidence, with demands for early discovery to unmask the subscriber — amounts to using the federal courts as a collection mechanism rather than a genuine dispute resolution process. Judge Beryl Howell of the District of Columbia, years before the current wave of Strike 3 cases, characterized predecessor BitTorrent litigation schemes in similar terms. The concern has not disappeared.
What This Means for Someone Who Has Been Sued
If you have received a Strike 3 complaint, the first thing to understand is that paying the settlement demand is not the only rational response. The evidentiary foundation of these cases is more vulnerable than the company's aggressive posture suggests.
The relevant questions are straightforward. Who else had access to your network during the relevant period? Do you use a router with WPA2 encryption, and has the password ever been shared? Did you have any roommates, guests, or household members who used your network? Do you even own or use the kind of device that would typically be used for BitTorrent? Was the IP address identified by Strike 3 actually assigned to your connection on the dates in question — a fact that requires confirmation from your ISP, not just Strike 3's records?
None of these questions proves innocence, but all of them create space between "Strike 3's machine flagged this IP address" and "this specific person infringed this specific copyright." That space is where a defense lives.
There are also procedural options. Challenging service, challenging jurisdiction (Strike 3 files in districts with no necessary connection to the defendant other than the defendant's ISP), and challenging the sufficiency of the complaint are all available tools that an experienced defense attorney can deploy before the case ever gets to the merits.
The Stakes — and What Experience Has Taught Us About Them
Strike 3 is not a small-time plaintiff. The company is sophisticated, well-resourced, and has substantial experience in federal litigation. Its not a slipshod scam like Prenda Law was. Nor is it as bold as Malibu Media was. Its settlement demands are calibrated to the range of statutory damages available under the Copyright Act — between $750 and $30,000 per infringed work, rising to $150,000 per work for willful infringement. The leverage is real, and the company deploys it aggressively because it works on defendants who do not understand that the underlying evidence can be challenged.
This firm has challenged it. We were among the first to take BitTorrent copyright evidence into full adversarial testing rather than advise clients to pay and move on. What that experience demonstrated is that the evidentiary chain Strike 3 presents in its complaints — from swarm participation to infringement of a specific copyrighted work — depends entirely on defendants not examining it too closely.
When examined: the false positive rate is unknown and was never measured. The PCAP data has been found insufficient to reconstruct viewable content. The IP address identifies a router, not a person. And without either an admission or the film found on a defendant's device, Strike 3 cannot close the gap between "this IP address was in our swarm" and "this person infringed our copyright."
That is not a defense that writes itself. It requires counsel who understands the technology, has retained the right experts, and is prepared to litigate rather than settle. But it is a real defense, and it has worked.
If you are facing a Strike 3 lawsuit, do not delete anything, do not respond to Strike 3's lawyers directly, and get counsel before you make any decisions. The machine that built the case against you has more than a few loose bolts.
Jonathan Phillips is an intellectual property attorney that handles BitTorrend defense across the U.S. across multiple federal districts and was among the first in the country to take this evidence to the mat and prevail. This article is for informational purposes only and does not constitute legal advice. Contact the him HERE.