Hacker News Reader

Comment by 20years | Hacker News Reader

Update: Digital Ocean sent a statement.

"We received notice on behalf of a trademark holder that a customer of DigitalOcean was hosting infringing content on our network. DigitalOcean immediately notified our customer of the infringement, and the customer was given a five day period to resolve the issue. The infringing content was not removed within the specified period even though several notifications were issued. Per DigitalOcean’s terms of service, a final reminder was issued to our customer and, when no action was taken, access to the content was disabled. The infringing content was subsequently removed by the customer and all services were restored in less than two hours."

5 days seems to be ample amount of time.

View on HN

I am DO customer, yesterday when I heard this story it felt scary step by DO with no regard for customers as original tweet said, "Nothing but radio silence from @digitalocean while 38k sites remain down. Demoralizing."

So It was not Radio Silence but 5 full days notice in advance with multiple notices. Thank you for updating us about the other side of the story.

Has Suge responded to this claim by Digital Ocean? I wonder if these e-mails just got flushed into an endless e-mail bucket.

That's the issue when you build a service hosted on a service (DO, AWS, Rackspace). You could have thousands of customers, but if you miss one complaint about one customer, the whole thing goes boom. It's more of an argument for content creators hosting on the platform controlled by the data centre owners.

For Surge, and other large hosting platforms, it's an argument for them hosting their own dedicated servers in a data centre (which of course, raises the barrier to entry and costs for these types of solutions).

we provide more specifics on timeline here https://news.ycombinator.com/item?id=12010521

When dedicated server providers don't react to complaints, complaints are instead sent to their upstream transit providers. Dutch based hosting provider Ecatel is an example that quickly comes to mind where their upstream providers simply stopped peering with them due to content issues. Hosting providers typically do not like the overhead that comes with handling DMCA and similar requests, servers that are very high risk should ideally operate with their own ASN and peering arrangements.

Most hosting providers I have dealt with expect abuse resolution within 24 hours, five days is a very long time for abuse issues to be handled.

We responded within 22 minutes of the original complaint and have been in frequent contact with Digital Ocean over the course of the 5 days including a phone call only hours before where they asked us to either remove the content or fill out a counter claim. They redacted the counterclaim request and shut us down 39minutes later followed by 1 hour of radio silence.

5 days had elapsed from the time the original takedown request came in until our network was disabled but there was plenty of correspondence in between and when we had last spoke to Digital Ocean it was still an open issue.

We provide more specifics on timeline here https://news.ycombinator.com/item?id=12010521

The content is not infringing. There is a fair use exception to trademark law to protect product criticism, works of art, irony, etc. You cannot use trademark law to silence all criticism of your organization.

Fair use is a defense. You can preemptively declare it as that, and hope that whoever you're parodying will see the light, but it doesn't give you immunity. Once a DMCA notice is served, and not obviously invalid, the content has to be taken down by the carrier. In exchange for having to do that, the carrier isn't liable. That is safe harbour. Simultaneously the content uploader can either get the supposed owner to retract their notice, or inform the carrier they'll hash it out in court. And only then, in front of a judge, does "fair use" come into play.

The article points out that this was likely not a DMCA notice.

Fair enough. Still, Fair Use remains a defense in court; and i expect that whatever kind of notice was actually sent has similar procedures that do not include steps like "completely ignore it".

Oh come on - just as fair use remains a defense in court, the NRAs claim must also be proven in court. Unlike a DCMA, the compliant does not require DO to take down the web site.

Clearly DO choked and hurt free speech in the process.

> Unlike a DCMA, the compliant does not require DO to take down the web site.

Does it? Please link to the legislation describing the specific complaint made.

That's not how law works, everything is permitted until it's forbidden. So given the absence of legislation they do not have to.

You're assuming it is a formless complaint, as opposed to a complaint conforming with specific legislation. If you know it is a formless complaint, can you please point to the source of your knowledge on that?

As far as I'm aware the complaint has not been made public. But unless you can point to a single piece of "formed" legislation for this, I'm certainly going to assume it is formless. Both because every trademark complaint I've seen has been formless, and it is impossible to disprove that a law exists in America, only the converse.

But Digital Ocean could be partly accountable in a libel / slander suit if they don't take action after being notified.

Taking down the content is the easiest way not to end up as co-defendants with the Yes Men.

No, they could not, that's prevented by this law: https://www.eff.org/issues/bloggers/legal/liability/230

(This is specific enough advice I feel I must say that I am not a lawyer, just a knowledge layperson)

The DMCA provides a safe harbour provision for hosts who take down content after a notice.

Libel / slander don't require a take down, but also don't provide any protection for the hosting company.

If this goes to court then the Yes Men won't be able to pay for the NRAs legal fees. Which means that the lawyers will be tempted to go after DO to get paid.

DO is a low cost hosting company. You can't expect them to ride or die.

Looking at the copies stored on the Wayback Machine: https://web.archive.org/web/*/http://www.ShareTheSafety.org they don't immediately look false, although they don't copy the NRA's current website graphic design very well.

Fair use is not an automatic thing, I'm not so confident this web site (no opinion on the video) would be protected by it, especially since, as I note elsewhere in this sub-thread, such a project is not entirely beyond the realm of possibility.

Did the NRA have a court order to take down the website? If not, then their takedown notice was just a letter saying 'please take this company offline because we believe it is infringing', which isn't enough.

It's enough if the target thinks it's enough, which in this case they apparently did.

There's nothing saying you have to obey a random cease-and-desist letter, but there's also nothing saying you can't obey it. If DO prefers to take action for letters like these, that's their right. And if they give their customer warning and a way to respond, I can't even say it would make me uncomfortable to be their customer.

No cease-and-desist was sent to Digital Ocean or Surge but there was one sent to CloudFlare. Digital Ocean acted on their own behalf.

There was no court order, no.

Fair use applies to copyright, not trademark. Trademark law is much stricter. And, as someone else said, it's just a defense that can only be used in court; tell it to the judge.

The video also said it was "Paid for in part by the National Rifle Association of America with additional support from Smith & Wesson Holding Corporation.", which is a blatant lie. They were hosting fraudulent content, and DO was right to take them down.

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech,* or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

*Except when it involves a lie or violation of a trademark.

Fraud has never been protected speech. If it was, Bernie Madoff would be a free man. Same with defamation.

You really think that these laws have never been challenged before?

When was that amendment passed?

The Supreme Court ruled in Gertz v. Robert Welch, Inc. that defamation is not protected speech, and the Supreme Court's word is final and absolute. No amendment is needed, as the Supreme Court has consistently ruled multiple times that freedom of speech is not absolute. Your arguments are the same kind of logic used by tax protesters who concoct arcane reasons that they don't have to pay income tax yet invariably find themselves convicted for tax evasion.

Fraud has been illegal for as long as the US has existed. It's not protected. If it was protected as free speech, fraud laws would have been overturned sometime in the last 225 years.

Further reading:

https://en.wikipedia.org/wiki/False_statements_of_fact

https://en.wikipedia.org/wiki/United_States_free_speech_exce...

> the Supreme Court's word is final and absolute.

In Dred Scott v. Sandford the court ruled that the bill of rights does not apply to African Americans. Are you a supporter of that decision or did you mistype? Where does it say that the court gets to supersede the constitution? I think you will find that it does not.

Furthermore there are limits to free speech in the US. For example: obscenity, treats of violence, military secrets, etc.

Australia has no bill of rights, yet judges have upheld individual right to protests (Victoria has a Charter of Rights, but that's it). China has free speech in their constitution. Germany has free speech, unless it has anything to do with the original Nazi party symbols.

So civil courts need not uphold the constitution? I understand the limits exist, but they are entirely unconstitutional. If you believe it would be a good idea to have such a law, go ahead and pass an amendment.

> Fair use applies to copyright, not trademark.

This is simply wrong. Here's a link for you:

https://en.wikipedia.org/wiki/Fair_use_(U.S._trademark_law)

".. the central issue in every trademark infringement case is the likelihood of consumer confusion" - https://apps.americanbar.org/litigation/committees/intellect...

The content could certainly be infringing and there's little safe harbour for an ISP.

> 5 days seems to be ample amount of time.

Ample amount of time for what? The underlying problem is that DigitalOcean should not be arbitrating trademark disputes between companies. They're not competent to decide who is right and who is wrong. They should not suspend someone's content purely because someone claims to be the owner of a trademark, and claims some content is infringing. (Unless we're talking about obvious abuse, intentional malice, etc.)

What exactly is the recourse for the site owner if the claims are unreasonable or outright wrong? With the DMCA, there is a clear process: the site owner can submit a counter-claim, and the content stays up. What should properly happen at that point is the rights-owner can take the site-owner to court to pursue their claim. Instead, DigitalOcean acted as judge, jury, and executioner on behalf of the NRA, taking down content outside any established DMCA-like process, and without leaving Surge any recourse to keep it up.

Wow, seriously?

No surprise there, 5 days is far longer than most providers will give you. You're lucky to get 24-48 hours to take down infringing content at most DCs in my experience.

Did the other guys even make an effort to respond?

We were in frequent communication with Digital Ocean and when we last spoke it was still an open issue. They had asked us to file a counterclaim but withdrew the request 39 minutes before shutting us down.

5 days total had elapsed from the original request which we responded to within 22 minutes.

https://news.ycombinator.com/item?id=12010521

Why wouldn't you simply forward the notice to the customer and tell them to respond within 48 hours? If the response doesn't satisfy DO, tell them sorry, upstream doesn't allow it, bye bye. It sucks, but that's how DCs operate sometimes.

It's pretty understandable for DO to not want to get involved in a legal dispute like that, buy your own IP range if you need to avoid this and take it to court yourself. You took on a huge risk yourself by allowing the content to stay on your network after you got the notice and may have implicated yourself should a trial be underway.

Seems insane that you let your entire service get nuked over one customer. And to publicly call this "radio silence"? They literally gave you a warning with an exact timeframe.

> Why wouldn't you simply forward the notice to the customer and tell them to respond within 48 hours?

We would have had we been sent a notice from the trademark holder but we weren't. Or even had DO been sent the request from the rights holder. This is the due-process we are asking for.

> It's pretty understandable for DO to not want to get involved in a legal dispute like that

To our knowledge Digital Ocean was at no time directed by the trademark owner to remove the content. This was DO acting on their own.

> They literally gave you a warning with an exact timeframe.

This is an exaggeration.

- We responded within 22 minutes of the original complaint. - The complaint did not request takedown. - We were not given timeline nor consequences until 24h before takedown. - When given 24h notice We immediately asked for a call which Digital Ocean wasn't available for until the DAY of the takedown. - We spoke on the phone with DO hours prior to the takedown which at their request was left with an action item to fill out a counterclaim. - Digital Ocean withdrew their request for a counterclaim (unknowingly to us) and disabled our network 39 minutes later.

So in truth we had an email we hadn't received yet that gave us only 39min to comply with. We were warned 24h prior but DO wasn't available to discuss until only hours before the takedown and the last correspondence with them they requested a counterclaim to be filed. Our request for counterclaim documents was the last message they received from us before shutting us off.

> Seems insane that you let your entire service get nuked over one customer. And to publicly call this "radio silence"? They literally gave you a warning with an exact timeframe.

We made it clear to them on the phone that we would rather take down the content then have all our customers taken offline. Digital Ocean disabled our network knowing full well it wasn't necessary to have the parody site removed and gave us only a 39 minute window to comply which we did not see in time.

Digital Ocean went completely dark for an hour after disabling the network and ignored our attempts to reach out.

See the comment by mattbee below.

It supports the idea that DO is not responsible for wholesale, nonspecific "content" - there must be details regarding which pages are infringing.

It's great that DO gave them 5 days, but as a person who's used DO a lot for projects, I'm really disappointed by their lack of sophistication in this area.

To pull the plug on thousands of pages and say "five days is enough!" isn't enough.

5 days is too much indeed, they could have come to the conclusion that it was satire in 5 minutes.

The problem is that there is no punishment for take-down notices filed in bad faith.

The "satire" sites gave no contest to the notifications, so no one looks at it even for 1 minute. If you get such notifications and disagree, with reasonable grounds, you should respond.

Yes, they should have responded. That was definitely not smart.

We responded within 22 minutes of the claim and was in frequent communication with DO over the 5 days.

Even sadder that they took it down.

What part of it was done in bad faith?

The part where the NRA filed a take-down request on something that used their logo in a way that was obviously satirical. Of course that would never stop an organization from getting rid of said satire if they thought they could get away with it and sadly DO proved them right in this respect.

From reading the other replies here, I don't know that it's a given that the NRA wouldn't prevail in court. In other words, they might have a case. So there's no bad faith for defending their trademarks if it's debatable, is there?

I'm not a judge, and I understand that it is very well possible to sue even if you know up front you have a lost case if you have deeper pockets than your opponent.

But let's look at what trade-mark law is all about: it's about avoiding confusion. Do you honestly believe that there is a ground for consumer confusion here, that consumers would believe that the NRA would actually put out these statements? Given the context of the publication as well as the content of the material itself?

Or could it be that the NRA figured out a way to shut down a viewpoint that clashes with their own through abuse of the law?

I think you may be underestimating the stupidity of some consumers.

He really is despite being right for I'd say most (maybe?) of the population. Especially considering that even news sites occasionally report on Onion News stories as real news. There's also examples like this scholarly study on misperceptions among people who mortgage homes:

http://www.satirewire.com/news/0106/dream.shtml

The statement contradicts the article's description of Surge's side:

>According to a series of tweets from the Surge twitter account, the NRA sent a legal complaint to Cloudflare, which then forwarded it to Digitalocean. Surge responded “within 22 minutes.” Digitalocean asked Surge to provide counterclaim documents. Some minutes later, Digitalocean shut down Surge.sh. According to Surge, 38,000 sites became unavailable.

If updating the main body of the article was too much trouble after the DO statement update, do you really think they are going to bother digging any further? The wrote the story they wanted to get the clicks.

Ah, it looks like my mistake was considering this a news site.

It'll be interesting to see Surge's response to having had 5 days notice.

https://news.ycombinator.com/item?id=12010521

Brock, Founder of surge.sh here.

1. Digital Ocean did NOT receive a complaint on behalf the trademark holder. CloudFlare was the company sent a complaint on behalf of the trademark holder, which was forwarded to DigitalOcean which was then forwarded to surge.sh. To our knowledge the NRA isn't even aware of DigitalOceans or surge.sh existence.

2. There was no known trademark infringement happening on surge.sh. There was a complaint sent to CloudFlare that such a thing was happening. Digital Ocean acted as if the alleged infringer was guilty even though there is nothing other than the complaint itself to suggest this is true.

3. Digital Ocean was aware that we were willing to remove the content with proper due process. We at surge do not have editorial control of the sites published to surge.sh therefore we wish to provide legal justification to our customers when their content is removed. This would provide our customer with a means of recourse if the takedown is in error.

4. All we asked for was due process and this was something promised to use in the past by Digital Ocean. https://medium.com/surge-sh/more-on-january-7th-downtime-the...

5. We spoke with DigitalOcean on the phone at 11:02am where things were they said we needed to file a counterclaim with the NRA. We thought this was odd since the NRA doesn't know we exist however we were willing to do it anyway.

Our last message to Digital Ocean was at 12:05pm after Digital Ocean sent us the following case study http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=...

``` Thanks for sending this over. I'll get through this as soon as possible.

Do you mind sending over the counter-claim you are asking us to fill out?

thanks, Brock ```

They responded at 12:47pm with the following...

``` I’ve shared the outcome of our phone call with our Trust and Safety team. Since this is not a DMCA complaint, a counterclaim does not apply here, contrary to my misunderstanding over the phone. I apologize for the incorrect information. [...] You have until 1:26pm EDT, a bit under an hour from now, to remove the content. Otherwise, we will need to disable networking to this Droplet. ```

We unfortunately didn't see that message until it was too late and at 1:26pm our network access was disabled followed by radio silence from Digital Ocean for the following hour.

So Digital Ocean communication to us went as such..

11:02am - "you need to remove the content or fill out a counter claim" 12:47pm - "we were wrong, no counter claim can be filed and you now have 39minutes to remove the content or we are disabling the network"

Since Digital Ocean realized they misrepresented themselves on the phone we would have preferred if Digital Ocean had picked the phone back up rather than shut us down with less than an hour warning.

Your timeline is a little confusing, the article states that you responded to contact from Digital Ocean "within 22 minutes" and "Some minutes later, Digitalocean shut down Surge.sh" however this comment seems to imply you had been aware of the issue and were discussing the issue with DO for approaching 5 days. Can you clarify the timeline with dates? Thank you.

Sure. 5 days ago we got forwarded a forward of a takedown request that was sent to CloudFlare from a representative of the trademark holder. We responded to that forward within 22 minutes of first receiving it and have been in communication with Digital Ocean ever since right up until about 1.5h prior to be shut down. The timeline I provided is the communication we had with DO on the last day leading up to the shutdown. Does that clarify things?

No offense, but your original statement on this matter was very misleading to say the least.

If that is true that is entirely unintentional and Im sorry. There is a lot going on all at once for us right now.

I'm willing to clarify to avoid further to confusion if you can provide more detail.

You've since clarified it, but neglecting to mention the fact that you've been working with Digital Ocean for 5 days prior to them turning off your droplet is not exactly transparency on your part.

Since the DMCA was not involved here, as far as I'm aware (IANAL) there's no obligation on DigitalOcean's part to take any action. DigitalOcean isn't an appropriate party to arbitrate a fair use dispute involving trademarks. Consequently, from my perspective, DigitalOcean shut a site down extra-judicially [1] purely because they received a request to do so from the NRA. DigitalOcean had no obligation to do so, and could have waited to receive a court order which the NRA could have sought.

It's frustrating and borderline absurd to me that hosting platforms get involved in dispute processes like this that properly should be handled by a court. What exactly is Surge's recourse here? Sue DigitalOcean to have their content put back up? That's ridiculous.

The DMCA provides a clear process: one party provides a claim asserting that some content infringes copyright. The owner can then provide a counter-claim asserting that it's not infringing. If they do, the content stays up, and if they don't, the content goes down. Providing a counter-claim, which requires asserting under penalty of perjury one's belief that the content is non-infringing, is the site owner's recourse to an unreasonable takedown request. Simple and clear. In this case, with no DMCA process, DigitalOcean is taking Surge down without any recourse for Surge to keep the content up in the event that the takedown request is unreasonable.

I don't know what the standards are for satire to be fair use. It wasn't very clear that the video was satire, but the nature of satire is that it's not always obvious to everyone. DigitalOcean should not have intervened in a trademark dispute between two different companies outside the DMCA. Or if they're going to make up a process, they should have at least followed the protocol DMCA established for Surge to assert non-infringement.

Surge should have been more transparent here. It seems like they were trying to obscure the actual timeline. I'd like to see Surge publish a full log of their communication with DigitalOcean and CloudFlare and related parties in the interest of full transparency, as validation that this is what has transpired. But on the other hand, Surge never should have been shut down in the first place, regardless of timeline. There was no counter-claim for Surge to file - what exactly were they supposed to do?

[1] OK fine, technically it's not extra-judicially because I'm sure DO's terms of service say they can do whatever they want. Nevertheless, it feels extra-judicial from a customer's point of view. Companies shouldn't get involved in arbitrating disputes between other companies - they are not a court and not competent to handle such disputes; they should simply participate in court processes as obligated by law.

Totally agreed about a simple nastygram requiring a takedown. But

> I don't know what the standards are for satire to be fair use. It wasn't very clear that the video was satire, but the nature of satire is that it's not always obvious to everyone. DigitalOcean should not have intervened in a trademark dispute between two different companies outside the DMCA.

The video itself doesn't have much of a leg to stand on. I personally think the approach of the Yes Men is brilliant, but they're obviously operating in a grey area where they can expect censorship via the legal system.

BUT that is irrelevant - it still is not DO's job to act as a judge and skip requiring a bona fide court order, especially when they're clearly dealing with a downstream service provider. If they want to be taken seriously as a platform provider, then they really need to apologize for this incident and fix their policies.

(Also what a horrible title. I guess the NRA stokes more rage with Vice's audience, but Digital Ocean seems to be primary party deserving blame here)

Yesterday, network access was taken down to sharethesafety.org which was hosted on our service by a customer, an intermediate platform provider. We want to let you know what happened.

On June 23rd, we received notice from the NRA's counsel that sharethesafety.org was infringing NRA’s trademarks. The NRA demanded that we remedy the problem by removing the material. In response, we followed our standard procedures for trademark infringement notices and informed the customer immediately of the NRA’s demands. We provided more than 5 days for the customer to respond to or resolve the issue. We also spoke to the customer on several occasions to inform them that we intended to take action on the trademark claim. They chose not to remove the violating material. Accordingly, our Trust & Safety team restricted network access to their Droplet, which caused an outage to all of their user’s websites hosted on that Droplet. In less than 2 hours of the outage, the customer was able to address the trademark notice, and network access was immediately restored.

DigitalOcean followed procedures that help protect us from having to resolve what can be complicated disputes between third party rights holders and our customers regarding IP issues. In this case we should have given greater care to the customer’s voice and their right to engage in parody. In retrospect, we believe that the website identified in the NRA’s takedown notice was not a trademark infringement but was instead protected by the First Amendment. We at DigitalOcean champion freedom of speech and the free and open web.

Going forward, we will be working closely with our legal counsel to review our Trust & Safety procedures so we can make better decisions. We are committed to providing our customers with the best level of service and supporting their rights and freedoms. That is our responsibility as an infrastructure service provider and one that I take very seriously.

Sincerely,

Ben Uretsky Co-Founder & CEO

That's definitely a reasonable amount of time (i've seen much shorter timelines at other places). Sounds like maybe Surge thought they were in the right (I think they are) and could ignore it, which was a bad call. Better to remove it and fight it using the process.

DO was unduly spooked by an empty legal threat. This was not a DMCA notice, this was a trademark notice. Parodies are protected under trademark law. Bad form taking down even a single page, and terrible form taking down an entire service.

https://cyber.law.harvard.edu/metaschool/fisher/domain/tm.ht...

Reply on news.ycombinator.com