I am trying to understand how it is possible to filter all IP activity for such a (broad) search term. As opposed to say superbowl livestream.
They only looked at requests sent to YouTube? Doesn't YouTube use https by default?
Did they do a simple YouTube search for 'Tom and Jerry' note down the full URLs for first two pages of search results... and look for those in the ISP logs?
DNS lookups only show "www.youtube.com" but not the VideoID or full URL I presume. So ISPs must be logging all URLs being visited by all their users?
They only looked at requests sent to YouTube? Doesn't YouTube use https by default?
Did they do a simple YouTube search for 'Tom and Jerry' note down the full URLs for first two pages of search results... and look for those in the ISP logs?
DNS lookups only show "www.youtube.com" but not the VideoID or full URL I presume. So ISPs must be logging all URLs being visited by all their users?