🌐 TI-2026-021L · The Architecture of Impunity · Part 12 of 14

The Mere Conduit: How EU Law Protects Criminal Infrastructure Carriers

You want to sue a transit provider for carrying traffic from a network that attacked you. You want a European upstream to explain why an abuse-tolerant downstream remains reachable. You want a routing intermediary to lose its shield after the tenth, hundredth, or thousandth complaint. EU law's answer, stripped of polite language, is simple: probably not. And not because legislators forgot to consider abuse. The immunity is there because the legal architecture was deliberately designed to protect the network layer from liability broad enough to chill ordinary connectivity.

That design has virtues. Without it, every ISP, backbone, CDN, and access provider would be pressured to act as a private censor and adjudicator. The internet would fracture quickly under precautionary over-blocking. But the same shield also protects bad actors who know exactly how to remain one layer higher than the clearly illegal endpoint. In the architecture of impunity, the doctrine of the mere conduit is one of the deepest support beams.

This article therefore makes a narrow claim and a broader one. The narrow claim is legal: Article 12 of the E-Commerce Directive 2000/31/EC and Article 4 of the Digital Services Act, Regulation (EU) 2022/2065, preserve a powerful liability exemption for transmission and access providers who do not initiate, select, or modify the traffic. The broader claim is structural: even when a routing or transit business looks far more involved than the words “mere conduit” suggest, the threshold for stripping protection remains extremely high, and that high threshold is part of why abuse survives.

1. The original shield: Article 12 of the E-Commerce Directive

The foundational European rule is Article 12 of Directive 2000/31/EC. It did not emerge from nowhere. It emerged from a late-1990s policy judgment that internet growth required legal certainty for intermediaries. If every access provider could be held liable for all transmitted content or conduct, service provision across the single market would become legally unmanageable. The Directive therefore created a liability safe harbor for transmission and access.

The architecture of the article is revealing. Liability is excluded not because providers are innocent in some moral sense, but because their role is defined functionally. If they are passing traffic or giving access, and if they are not choosing content or recipients, the law treats them as neutral infrastructure. That neutrality is not empirical. It is a legal presumption designed to keep transmission services operable.

The recitals reinforce the point. Recital 43 states that a provider that “deliberately collaborates with one of the recipients of his service in order to undertake illegal acts” goes beyond mere conduit or caching and loses the exemption. This is the opening through which claimants hope to argue. But note how high the threshold already is. The issue is not passive awareness. It is deliberate collaboration.

That is why people are often shocked when abuse reports seem to do so little. They assume notice should create liability. Article 12 is built precisely so that, for conduit services, it usually does not.

2. The Digital Services Act did not kill the conduit shield

Many observers assumed the Digital Services Act, adopted in 2022, would fundamentally alter intermediary immunity. In political rhetoric, the DSA is often described as the great tightening of platform accountability. That is true for some platform duties. It is not true for the underlying conduit regime. In fact, the DSA preserves it almost verbatim.

This is not a drafting oversight. It is a policy choice. The DSA is explicit that providers of intermediary services remain central to the Union economy and daily life. The Regulation responds to new online-platform risks, but it does not reconceive the network layer as presumptively liable. The result is that a backbone, carrier, access network, or routing intermediary still begins inside a strong safe harbor unless its conduct departs from neutrality in a meaningful way.

For threat investigators, this is the first uncomfortable truth. You can collect logs, abuse tickets, route objects, WHOIS records, and recurrence graphs showing that dirty networks remain carried by European intermediaries. That may be powerful intelligence. It is still not automatically powerful law.

3. “Actual knowledge” is a hosting concept, not a transit weapon

One of the most misunderstood features of intermediary law is the role of actual knowledge. People often assume that once a provider knows abuse is occurring, immunity should vanish. That is not how the DSA is structured. The key actual knowledge provision appears in the hosting context, not the conduit context.

The DSA's recital 22 sharpens the point further. It says actual knowledge or awareness cannot be considered obtained “solely on the ground that that provider is aware, in a general sense, of the fact that its service is also used to store illegal content.” That line is devastating for claimants who want to argue from pattern alone. General awareness of dirty use is not enough even for hosting; for transit it is even less useful, because transit immunity does not turn on the notice standard in the same way.

So when an upstream carrier receives a complaint saying a downstream network sends malware, DDoS traffic, phish, or scanner traffic, the carrier can often respond—legally speaking—that it remains a conduit. The complaint may matter operationally, commercially, or reputationally. But absent stronger facts, it does not by itself transform the carrier into a liable collaborator.

4. The deliberate-collaboration test: the only real breach point

If notice is weak, where is the opening? The answer lies in the recitals. The E-Commerce Directive and the DSA both protect providers only when the service is provided neutrally. The DSA's recital 18 states that when a provider “deliberately collaborates with a recipient of the services in order to undertake illegal activities”, the service should not be deemed neutral and the provider should not benefit from the exemption. That sounds promising until one asks what evidence would satisfy it.

Not much case law gives victims an easy route here, and the policy reason is obvious. If “collaboration” were read broadly enough to cover commercial indifference, insufficient response time, or poor customer selection, half the immunity regime would evaporate. Legislators therefore framed the exception around a much stronger form of involvement: services marketed for illegal use, technical assistance tailored to illegal activity, or conduct showing the provider's purpose is to facilitate the wrong.

That is why the shield is structural, not merely textual. Even when the text says liability is lost upon deliberate collaboration, legal systems interpreting infrastructure markets will be cautious, because lowering the threshold risks turning transit providers into all-purpose private police. The result is that only unusually explicit facts tend to threaten conduit status.

In other words, the law does not ask whether the provider made abuse cheap. It asks whether the provider got close enough to the abuse's execution to stop being a conduit. That gap is where impunity lives.

5. Case study: M247, Pfcloud, Omegatech, and the limits of notice

Take the kind of chain examined elsewhere in this series: M247, Pfcloud, OMEGATECH LTD, and related wrappers or downstreams. Suppose abuse reports are sent. Suppose honeypot logs show repeated scanner behavior. Suppose the same downstream appears in multiple reputation systems. Does that create DSA-level liability for the carrier or intermediary? Usually, no. Not automatically, and not on those facts alone.

Why? Because the provider can still frame itself as a transporter. It did not initiate the attack. It did not select the victim. It did not modify the transmitted packets in a way that changed the relevant illegal information. Even if its commercial judgment was poor, that is not necessarily the same as deliberate collaboration.

This is why the law frustrates investigators. Abuse reports feel morally decisive and operationally informative. Legally, they are often weaker than intuition suggests. They show notice of a problem. They do not necessarily show the kind of specific involvement Article 4 and the recitals are designed to target.

The key point is not to excuse any named company. It is to explain why legal pressure so often fails. A claimant who can prove recurrence, dirtiness, and commercial carriage still may not prove the doctrinal element that matters.

6. IPXO: when does a marketplace stop looking passive?

The investigation data behind this article highlights IPXO UAB and asks a harder question: what if the intermediary is not merely carrying traffic, but actively participating in routing control? The evidence cited here is that certain route objects were configured via netutils-mnt, suggesting more than inert leasing paperwork. If a company helps structure route objects, availability, and control pathways, the intuitive argument is that it looks less like a passive conduit and more like an active infrastructure orchestrator.

Legally, however, the answer is still not simple. A marketplace or broker can argue that route-object management is part of providing a network-resource marketplace, not part of collaborating in any specific abuse. The company may be shaping the conditions of routability while still denying meaningful involvement in the content or purpose of the traffic itself. That is exactly the kind of ambiguity modern infrastructure businesses exploit.

This is the place where the architecture of impunity becomes intellectually frustrating. The provider may be more involved than a layperson imagines, yet still not involved enough for liability doctrine to bite cleanly.

7. Governance conflict: Vincentas Grinius, RIPE, and anti-abuse legitimacy

The problem sharpens when governance roles and commercial roles overlap. The investigation data identifies Vincentas Grinius, IPXO co-founder, as participating in RIPE anti-abuse governance while operating a company whose business model depends on leasing routable address resources in a market repeatedly used by abusive actors. That does not prove bad faith. It does prove a structural conflict worth naming.

Governance legitimacy matters in the internet-number ecosystem. Participation in working groups, anti-abuse discussions, and policy fora creates the appearance that the market is self-correcting. But if one of the people helping shape anti-abuse discourse also profits from the fluidity and scale of routable address leasing, then the system is at risk of institutionalizing its own soft spots. The market's referee is not literally the same as the market, but the social distance may be too small.

This matters legally because governance conflicts do not usually alter Article 4 or Article 12 directly. They alter the enforcement environment around them. They affect how quickly dubious actors are challenged, how aggressively number-resource anomalies are escalated, and how much institutional patience abusive patterns receive before they are called what they are.

8. GDPR: the privacy shield around subscriber identity

Even when a victim or investigator knows a downstream network is abusive, identifying the responsible customer is another problem. Here GDPR and related privacy rules play a complicated role. They protect legitimate users from overbroad data disclosure, and that protection is essential. But the same framework can also make it difficult to obtain subscriber or account information that would help tie infrastructure to operators quickly.

This article does not claim that GDPR was designed to protect criminals. It was not. It claims that privacy law, when combined with conduit immunity and cross-border infrastructure layering, creates a practical shield around routing customers. Providers can often say they cannot disclose subscriber data absent a valid legal basis, court order, or specific statutory mechanism. That means abuse intelligence strong enough for operational defense may still be too weak for identity extraction.

So the shield is cumulative. First the conduit says it is not liable for the traffic. Then, when you try to identify the user behind the traffic, data-protection rules impose another procedural wall. Each wall makes sense in isolation. In combination, they can be brutal.

9. De-peering: economic pressure exists, legal obligation usually does not

One might hope that if law does not compel shutdown, market pressure will. Sometimes it does. Spamhaus can list infrastructure in the SBL and create reputational or deliverability consequences. Transit partners may quietly reduce comfort with a chronically dirty customer. But within the EU, there is generally no automatic legal mechanism forcing de-peering merely because a network is widely accused of abuse.

This distinction matters. De-peering is economically disruptive and technically consequential. It can also overreach badly if used on weak evidence. European law therefore tends to preserve freedom to provide network services unless stronger orders, sanctions, or specific violations intervene. The result is that private reputation systems can create pressure, but they rarely impose the kind of mandatory routing isolation victims often imagine should exist.

That is another place where impunity becomes architectural. A network can be notorious enough to appear in watchlists and still remain legally routable, because the threshold for mandatory disconnection is much higher than the threshold for widespread suspicion.

10. Cloudflare versus the offshore silence model

A useful contrast comes from Cloudflare. Cloudflare is often criticized, sometimes fairly, for how it handles controversial customers. But one thing Cloudflare does that many offshore or shell-heavy infrastructure providers do not is publish regular transparency material. Its transparency page states that Cloudflare publishes semi-annual updates on government, court, and private-party requests, and declares: “Cloudflare has never turned over our encryption or authentication keys ... to anyone.”

This does not make Cloudflare morally pure. It makes it legible. Legibility matters. A provider that publishes transparency reports, abuse-process summaries, and explicit commitments gives outsiders something to audit and critique. By contrast, many Seychelles-, BVI-, or shell-mediated networks publish almost nothing meaningful by design. Their business model often depends on remaining administratively thin and publicly opaque.

The contrast is important because it shows the issue is not merely that the law shields intermediaries. It is that some intermediaries operate within a culture of public explanation while others exploit opacity almost as a service feature.

11. Hetzner, Contabo, and why legitimate providers still matter

The investigation names Hetzner Online GmbH and Contabo GmbH not to equate them with bulletproof providers, but to show how major legitimate infrastructure can appear somewhere in the chain while still staying inside doctrinal neutrality. That is part of what makes abuse tracing so awkward. The path from attacker to victim may cross respected providers, leased resources, offshore wrappers, and EU transit without any single respectable node obviously breaching Article 4.

Victims often experience this as absurdity. How can the chain be so visible and yet so hard to legally attack? Because visibility of path is not the same thing as proof of collaboration. The mere-conduit doctrine was built to preserve the former without automatically triggering the latter.

12. Structural design: why the shield exists at all

To say the shield enables abuse is true but incomplete. One must also say why it exists. The internet works because countless intermediaries forward traffic without having to inspect, verify, and legally underwrite every packet, every request, every website, every user, and every claim made against them. A strict-liability regime for transit would break normal connectivity, destroy privacy expectations, and produce overwhelming incentives to over-block.

That is the uncomfortable fairness of the doctrine. The same legal structure that lets a VPN, ISP, or backbone carry ordinary lawful traffic without fear of ruin also lets some ugly networks remain online longer than justice would prefer. The choice is not between pure safety and negligence. It is between different failure modes: under-enforcement with abuse persistence versus over-enforcement with network fragmentation and censorship-by-liability.

Seen this way, the shield is not a bug hidden in footnotes. It is one of the constitutional instincts of the European internet order.

13. What would have to change?

If policymakers wanted materially different outcomes, they would need to change one of two things. They could impose something close to strict liability for transit, which would be catastrophic for the open internet. Or they could lower the threshold for actual knowledge and collaboration, allowing repeated, substantiated abuse evidence to create stronger duties for intermediaries. That second option is more plausible, but it carries real risks of strategic complaint abuse and defensive over-blocking.

Another path would involve narrower, better-targeted obligations: stronger beneficial-owner verification for routing customers, auditable transparency duties for address lessors and transit sellers, and faster court mechanisms for well-substantiated recurring abuse clusters. None of these would eliminate the core tension. They would simply redistribute some of the burden away from victims and toward the layers currently best positioned to deny knowledge.

None of that is easy. But pretending the present balance is morally neutral is worse.

14. The uncomfortable truth

The same legal framework that protects your access provider, your VPN, your mail relay, and your ordinary web traffic also protects the carriers and routing intermediaries that keep some deeply abusive infrastructure reachable. That is not hypocrisy. It is architecture. It is the price of designing the network layer around neutrality first and intervention second.

For investigators, the lesson is severe. Abuse evidence, routing evidence, and reputational evidence are often enough to prove a pattern, enough to justify defensive blocking, and enough to condemn a market morally. They are often still not enough to pierce EU conduit immunity. To do that, one usually needs proof that the provider crossed from carriage into active facilitation. The law is built so that proving that crossing is hard.

That is why the phrase “mere conduit” is so powerful and so dangerous. It sounds descriptive, but in practice it often functions as a legal transformation machine. It turns a deeply consequential commercial role into a narrow doctrinal identity. It says: this actor carries, therefore this actor is shielded. And once that translation succeeds, the victim is left arguing not with packets but with architecture.

The architecture of impunity is not merely criminal ingenuity. It is also institutional design. Some of the dirtiest infrastructure corridors on the internet remain viable because European law is understandably reluctant to make carriers liable for traffic they move. That reluctance preserves freedom. It also preserves cover. Both things are true at once.

15. The five-jurisdiction problem

The investigation data behind this series repeatedly points to a five-jurisdiction split: the allocator in one country, the RDAP or corporate registration trail in another, the ASN in a third, the actual router or transit relationship in a fourth, and commercial geolocation in a fifth. That split is not always malicious. But when it becomes routine, it creates a legal mirage. Every participant can describe only its slice. Every regulator sees only part of the chain. Every abuse report arrives one layer too high or one layer too low to trigger decisive action.

This is why the mere-conduit doctrine feels more powerful in practice than on paper. Article 4 and Article 12 do not say “providers are immune even when the whole chain is obviously engineered for friction.” But the multi-jurisdiction architecture produces that outcome anyway. The conduit points to the host. The host points to the customer. The broker points to the lessor. The privacy team points to GDPR. The registry points to process. The victim is left with a complete picture of abuse and an incomplete legal path against any one node.

That is also why infrastructure intelligence matters even when it does not immediately win a case. Mapping the split across allocator, RDAP, ASN, router, and geolocation reveals the mechanism that law alone tends to flatten. It shows how neutrality is manufactured. Not by one magic statute, but by a sequence of partial truths distributed across borders. Each actor may be able to say something technically correct about its limited role. The total system still behaves like a protection machine for the route.