How Bungie identified a mass sender of fake DMCA notices
torrentfreak.com
torrentfreak.com
They "solved" the problem by firewalling connections and a lame gateway asking you to admit to whatever.
A big corporation came asking for data on an individual GMail user, and Google told them, "we're not giving that to you without a proper subpoena." That's exactly what you want your email provider to do.
None of those things are necessary to hold copyright.
The fact that they harbored the jerk for so long, even in the face of credible evidence and actual harm, suggests that, as another headline on the frontpage right now says, "If your [platform] is full of assholes, it's your fault."
* Google Shut Down British Teen's YouTube Account, Kid Loses Access to GMail
* Google Giving Out User Information to Companies Without Court Order or Protest
* Google Is Sharing GMail User Information with Game Publishers Out For DMCA Revenge
Every step along the way, there'd be an article and 100 Hacker News comments talking about how evil Google is and talking up how Duck Duck Go really isn't so bad as long as you remember the shortcuts that make it use Google.
Resisting requests from big companies demanding that they give out user information is a good thing. Changing their mind when they had clear evidence that the user was up to no good is a good thing. Not immediately shutting down someone's GMail account because they're doing something that upsets YouTube is a good thing.
https://news.ycombinator.com/item?id=20826618
"Google can ban your Android app if they think you’ve clicked on your own ads"
https://danfabulich.medium.com/never-run-google-ads-if-you-h...
And here's a Facebook one because it's almost too good
"Facebook banned me for life because I help people use it less"
https://news.ycombinator.com/item?id=28788821
Now I don't know the details of those stories but I can tell you the comments are what you'd think. There's never context when someone feels wronged and wants to show the world.
Google like many companies doesn't comment in detail on these types of situations so what we would get is the kind of headlines the parent made up.
I think the best statement from Google would say:
"We have more information which gives additional context to our actions here. We have asked for permission from the account holder to publish this information, but so far that permission hasn't been granted".
Why don't they make statements like that?
Otherwise we’d be astonished at “Bungie sues long time gamer for 7.6m”. Obviously we can investigate further, it’s not that complicated a matter. I neither believe negative publicity would have occurred, nor that this is a justification for a cover-up. A trivial headline would be “Google suspends account of DMCA troll.” - I doubt it would even generate any clicks.
It just sounds like Google weren’t looking into the matter sufficiently (there are humans there afterall.)
But if Google is deciding that avoiding those potential headlines is of higher priority than protecting its users from getting abused by the unfair system they put in place, we are justified to attach a derogative label to the company.
And it's cumulative, with all the other ones. The labels, I mean.
I just hope people will not forget them in 20 years after they make a giant PR campaign to become the good guys again, like with Microsoft.
These comments are always the pièce de résistance of HN absolutism.
Google already had a policy of doxxing YT users, only DMCA abusers get protection by default.
And then there's this:
> Bungie had to devote significant internal resources to addressing it and helping its players restore their videos and channels – an effort complicated by the fact that while YouTube has a form that allows anyone to claim to represent a copyright holder and issue copyright strikes, it has no dedicated mechanism for copyright holders who are being impersonated to let YouTube know about the DMCA fraud
Small content creators have only been complaining about this for, oh, ten years or so?
> This meant that Bungie had to work through several layers of YouTube contacts over a period of several days before it could adequately communicate and begin addressing the problem.
Days? Several layers? Gasp! Fetch the vapors!
Now imagine you're not a billions-of-dollars-in-revenue worldwide-known gaming company - and thus you have zero ability to reach a human.
It's a high bar to pass, but literal thousands of fake claims might indeed pass it.
> On March 22, the Reynolds account logged out of Google and less than a second later, the Wiland account logged in, suggesting the same person was behind both accounts.
I've always wondered how often timing analysis is used in practice by surveillence big tech. I suspect that as people become more privacy aware, and start using VPNs, pseudonames, multiple accounts, etc, that big tech will start using timing analysis more and more to correlate traffic and identify users. Like if your friend sends you a Reddit link on WhatsApp, and you immediately open it in your browser, that Reddit session is now linked to you.
Another more complex example: let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing of when your Reddit account opened the discussion, and when the linked Youtube video was accessed. And not just that video, but now every Youtube video watched in the same browsing session, is now linked back to you (assuming you have first-party cookies enabled, which is basically required if you ever want to log into anything).
Seems a bit paranoid, but I actually suspect this happened to me a few months ago. I was using a FOSS reddit client and clicked a youtube link buried deep in a reddit thread, and opened it in Newpipe (a FOSS youtube client). I wasn't logged in, and was using a VPN, and yet the next day on my Youtube feed I started getting recommendations based on that video (and those recommendations were very different from my usual ones). Scary stuff.
Books written about the NSA, GCHQ, CSE etc talk about them using things like timestamp logs/traffic analysis/time of day analyzing commercial and government telecom links going back to the 1960s, so in the modern era even if your crypto is absolutely unbreakable, there's a huge amount of analysis and correlation that can be done based on timing analysis.
Then you combine your timing analysis with things like correlating geolocation of blocks of IP addresses, netflow and traffic analysis, metadata obtained from other adjacent/nearby users on same ISPs at either end, a whole fire hose of other data that's still useful even if the crypto is solid.
> let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing
Not just timing but also cookies, client device/browser fingerprinting, IP address/what ISP you're on, and the usage patterns and logged in activity (and app-collected telemetry data on android and ios devices) of all the other persons in your household and neighbors.
this alone can be used to correlate a huge number of things since very often you have one household with a whole assortment of people and tablets, phones, laptops, xboxes, playstations, smart speakers etc all behind one IP address and NAT.
just having an entity like google know that your ip address is coming from a /24 in a /19 sized IP block that's known to be a comcast dhcp pool in a particular city/metro area is a huge amount of info.
other things happen as well. you have other people in your household who installed the facebook app on their phone and left geolocation/GPS permissions set to on? now your IP address has been correlated with a very specific latitude/longitude and the usage patterns of your (spouse, roommate, child, etc) who is using that app.
> collected for specified, explicit and legitimate purposes
If a malicious person had access to your account you want to know for how long they had that access for example.
> Store it because nobody knows what to do with it?
I think the technique, itself, is decades old, but has been vastly improved, using AI and algorithms.
It can be used to match things like anonymous rants, to individuals.
But that is exactly how this works. From what I understand, the “enhanced” version of the technique is scarily accurate, able to match, using just a couple of sentences.
See:
https://resources.infosecinstitute.com/topic/timing-analysis...
Or the academic research on the domain https://scholar.google.com/scholar?hl=en&as_sdt=0%2C14&as_vi...
Temporal correlation is the difference between regular network analysis, and dynamic network analysis. Just search "dynamic network analysis" on Google Scholar, and look at who's writing the papers :)
But to back up a step — every SaaS company does this on some level. If you have an backend audit-log for e.g. user registrations, and you eyeball it every so often to notice event clusters of people trying to bulk-register accounts in order to block their IPs — well, that's timing analysis!
Within the first category, possibilities include that the phone logged into your Google account while using the VPN, that there was a Google tracking cookie on your phone and that phone wasn't always connected to the VPN so it related 2 ip addresses, and that your other device on same network shared a VPN session with your phone.
The 2nd category I'm including for posterity even if it's unlikely based off your stated usage of FOSS on your phone. That your phone isn't a degoogled OS or other device with Google integration. Smart devices with microphones aren't supposed to collect voice data when not explicitly activated, but it is a potentiality.
I think it was only doable in the end in the article because the data were released as part of a legal process.
Regarding your YouTube story, there are lots of examples of things like this (e.g. "I talked to someone about X in person then saw X in Facebook ads") but I haven't yet seen hard evidence. So far I've written it off as coincidence at scale.
As far as it being a coincidence, that's usually something I assume as well. But it really comes down to a game of probabilities. Is it more likely that it's a coincidence, or that Google is doing timing analysis? In this case, a coincidence just felt less likely. I check my youtube feed at least once a day, so I know what my recommendations look like. This recommendation was so out of the ordinary that it stood out to me in a sea of my usual recommendations. And it stood out so much that it prompted me to go back and check my Newpipe history and Reddit history, and spend like an hour investigating and trying to figure out what was most likely. I even wrote down notes about the incident. Also I should probably mention now that earlier I had said that I got those youtube recommendations the next day, but checking my notes now, it was actually within an hour. The video that was recommended to me was not some trending video, it was already a few months old. I also searched my Youtube history to see if I had watched anything else from the same channel, and I had only watched 2 videos from that channel total, and over a year prior.
I know that timing analysis seems very nefarious, more high-effort and nefarious that I would expect from even a company like Google. But my guess is that they aren't doing it intentionally, they instead just feed a bunch of analytics data (that they have user consent to collect) into some giant ML model, and that ML model has learned to use timing in its predictions.
[1]: https://blog.rsisecurity.com/what-is-considered-pii-under-gd...
1. Use a VPN create a gmail address.
2. Use that address to file a DMCA notice on each channel video.
3. Google auto-accepts; the channel challenges each notice.
4. You deny all challenges.
A lot of services that I don't want then to have my PII are starting to ask for phone verification.
Though I don't know if they are somehow blacklisted by Google. And the main service is just a one time verification rental but you can also rent a number for a few days.
Perhaps simplest of all, you could always sign up for the email on a semi/public wifi access point, or even from a shared computer, as from an internet cafe or even a friends phone.
The most likely option to use is residential proxies which are real IPs of devices, these are very hard to block but expensive.
Probably best to just go to a public wifi and used a burner phone if that’s what you want to do.
Instead of writing this comment you could've taken one of the nodes you run (since you seem to be so qualified) and simply install openvpn on it and connect to it. Then go and visit sites that would be restrictive, or visit any site that tells you more about your IP.
But sure, go off and question my qualifications because you haven't considered this, or tried it, or ran into the issue yourself.
Plus, the way Discord, for example, does phone numbers, is that they just block anything they arent quite sure about.
I know that I have difficulties using some services because I cannot afford faster internet, for example.
I definitely did that in past.
Yet another example of justice for me, but not for thee.
A smaller content creator might not have even overturned a false DMCA claim, let alone get information about the copyright troll submitting it.
In the YouTube DMCA process, they always, 100% restore your video if you submit a DMCA counterclaim. It'll only stay down if the claimant informs YouTube they are pursuing a lawsuit against you.
> let alone get information about the copyright troll submitting it.
You receive the full information of the copyright holder if you receive a DMCA takedown. You obviously don't get IP log information unless you subpoena Google, though.
That’s not exactly helpful if it’s a fraudulent claim.
> While Bungie’s legal department, management, and executives were attempting to negotiate the byzantine procedural labyrinth Google required before it would address the fraud Minor was committing, let alone identify him to Bungie, Minor was gloating, confessing, and threatening
I'm guessing there was something more going on here...
If you serve them with a subpoena your lawyer will get a prompt phone call from a real human. That’s the point.
You can pre-pay $50/hour (in 30 minute increments) for live human access that can fix your problem. The fee is paid no matter whose fault it is -- it's basically a "competent, in-your-country, rep fair wage fee". How much take up would there be? Would that fix the complaints with these free services not offering support?
The goal of the company charging for support (directly or indirectly through purchases) is to collect the support payment WITHOUT having to turn around and spend it on paying someone to solve problems.
It's very much in the company's financial best interest to not have problems.
On the steelmaning your argument side, there is definitely an argument for "common carrier" status for a lot of web technologies. This would guarantee universal access, fixed prices (either dollars or amount of data collected), and due process for disconnects. Governments could also mandate real ids with each account (therefore drastically reducing fraud and abuse in the first case).
I dare you to try and contact them when you have an issue with your Google account.
> The clickable emblem link was sent to PerfectNazo1@gmail.com and during the chaos of fake notice campaign, a YouTuber called ‘Lord Nazo’ was hit with fraudulent DMCA notice, sent by the Wiland Google account.
> Apparently angered by this injustice, Lord Nazo fired a DMCA counternotice back at YouTube in which he criticized the wave of fake notices and claimed his video was not infringing since it was a “transformative case of fair use.”
I have mixed feelings about this however: pretty sure that if they inverted the roles, that is, it was the big company that sent bogus DMCA take down requests, the outcome wouldn't change: the small fish would still be eaten.
Thankfully, we don't have explicit (although there's plenty of incarcerated folks who wouldn't spend a day in jail if they had enough money to fight whatever bullshit charges are brought against them) debtor's prisons, so probably not.
Edit: Okay, the filing requires asserting "under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly in-fringed." But I'm not sure whether anyone has ever been prosecuted for perjury for something like this. It's seemingly generally resolved only by suing for damages.
According to this site[0]: "...if someone files a fraudulent DMCA takedown notice, they can be sued for the damages caused, along with the costs and attorneys’ fees that were incurred in pursuing those damages. In many cases, the costs of attorneys’ fees can far outweigh the actual damages."
Apparently, there is standing for civil action against someone filing a fake DMCA claim, but no criminal penalties.
But YMMV. The above was just the first relevant link in a search for 'criminal fake dmca claims'.
[0] http://smithlawtlh.com/false-fraudulent-bad-faith-dmca-take-...
The relevant Federal laws[0] do appear to support your assertions.
That said, it's apparently a bit more complicated to prosecute someone in the context of a false DMCA takedown requests.
Even more, you can't put a corporate entity in jail (limited liability, the corporate veil, etc.), only people.
As such, I imagine that unless there's something really egregious (and this situation might be an example of that -- ask a US Attorney -- I'm not one of those), I suppose Federal prosecutors could charge someone with perjury over such false claims.
[0] https://www.justice.gov/archives/jm/criminal-resource-manual...
Depending on his total assets, a judge will either allow Chapter 7 or Chapter 13. Chapter 13 happens when you negotiate with your creditors based on your income. In Chapter 7, you discharge the entirety of the debt. If he does not file Bankruptcy, then Bungie can reinstate the judgement every 10 years (time depends on the state) and continue collecting until his death.
After Bankruptcy, the debt will follow him for 7 years (possibly more as unscrupulous debt buyers will give him a taste of his own medicine filing invalid, but hard to prove, claims on his credit report). The size of the debt may make seeking employment difficult. Having a judgement of any size will limit his ability to rent houses or getting any sort of credit. And good luck getting any kind of government clearance. This is the real debtor's prison which will regulate him to living under sleazy landlords likely in questionable locations, getting loans with insanely high APRs, and having to use his own money to generate credit (secured credit cards). Even though judgements last for 7 years, after bankruptcy you are usually out of this prison in 3-4 years. FWIW, many loan officers may look at that judgement as a clerical error (someone pressed 0 too many times) but once they ask for clarity all bets are off. But I've heard many stories of people climbing into a $50K car loan a year after bankruptcy so his mileage may vary
EDIT: Bungie and this gentleman could settle out of court with no judgement as well. The filed civil suit will still be a public record but that is much lower weight on one's credit score. The out of court settlement could stipulate no more bungie content being uploaded or posted on the internet for a period of time. There are many different directions, what I outlined is if this person does not respond or otherwise loses the civil suit
EDIT: the government agency has a method to discharge the debt, which is why the courts will not intervene except under extraordinary circumstances
There's a number of things overseas that a reasonably well educated American can try to get hired for, and a US domestic civil judgment won't show up on a criminal background check if one is run.
> My channel even got terminated because of all these fake takedowns. Is there anything you can do about this?
His bright idea was to get his account unbanned by hoping Bungie would think it was part of the fake notices.
https://www.canlii.org/en/ab/abqb/doc/2012/2012abqb571/2012a...
I think that the analogy holds.
We have been the recipient of many invalid notices to Google. Google publishes the details via Lumen but makes it impossible to reasonably analyze the data. 1) They hide the sender info. 2) They make you validate, via email, for EACH DMCA you want to view. In other words, they claim transparency, but practical use isn't possible. They also don’t publish DMCA’s against sites like YouTube.
I'd really hope this might shed a light on YouTube's ludicrous policies, but no, it will not do anything towards that.
Many content creators have fallen back to playing NO music at all in their videos, and they still get hit by it. YouTube has been silent on the matter, not to mention on how that's even possible.
The algorithm is so effective that police have taken to playing loud copyrighted music when engaging in actions that they don't want spread via social media.
At this point, it's getting hard to ascribe the awfulness of the fingerprint-driven auto-takedowns as mere incompetence.
https://en.wikipedia.org/wiki/Viacom_International_Inc._v._Y....
Despite this, everything mentioned in the torrentfreak article was handled under the official DMCA process, and they handled it as they should have, as they disabled access to all videos immediately until the counter-notice was posted by the claimee. Eventually they started asking the user for proof of identity after they suspected he didn't represent Bungie, but that's not a requirement in the DMCA process.
Separately, YT does often go to bat for its creators if/when they suspect supposedly infringing content is actually protected under fair use, eg. recently when "Vantage Media" was trying to take down all footage of the trailers for Kevin Spacey's new movie, Peter Five-Eight[1]. This is still only wrt DMCA, as Content ID is designed to allow rights management companies to control their content on YT entirely (with no regard for fair use, on purpose) as YouTube doesn't want to get on the bad side of their partners in the Music (YouTube Music[2][3]) and TV/Sports (YouTube TV) space.
1: https://youtu.be/aY1CYF3MKec?t=27
2: https://variety.com/2017/biz/news/warner-music-extends-youtu...
3: https://www.theverge.com/2017/12/19/16796058/youtube-univers...
Doing it from your home internet connection, less creative...
If I release a video about election results during an election and it takes weeks - hell let’s be generous and say 72 hours - to go out because of a bogus DMCA claim, that’s a huge financial loss for me.
90 days? No way. In the world of online content creation that’s a death sentence. That’s not even remotely a solution.
I got a notice that I used licensed music and they took my video down, I appealed and my video immediately went back up during the appeal process. This all took place within about half an hour of my posting it. I sent them the email showing the artist gave me permission, and a few days later the notice was lifted. All through this process my video was only down for about 15min.
For YouTube: Freeze the transfer of the revenue on that one video until it’s resolved but keep the video up and let it still collect revenue. It’s not great if you depend on the income but it’s a hell of a lot better than losing the income entirely. This solution is much better, if still imperfect.
I think it’s working exactly as intended.
Which, unsurprisingly, is terrifically easily to abuse.
> (f)Misrepresentations.—Any person who knowingly materially misrepresents under this section— (1)that material or activity is infringing, or (2)that material or activity was removed or disabled by mistake or misidentification, shall be liable for any damages, including costs and attorneys’ fees, incurred by the alleged infringer, by any copyright owner or copyright owner’s authorized licensee...
In practice, as far as I know nobody has ever been prosecuted or civilly sued under this section of the DMCA. Maybe this will be the first case to do so.
Google is making content you own available online and monetizing it through subscription fees and ads.
Then when you ask them to stop, they require you to start with law suit before doing anything. That costs money and takes time. Meanwhile there might be already couple more channels with the content, requiring more lawsuits.
And yes, I'm aware that Google doesn't currently seek to be in a position where they could lock you out of your own records, but the octopus's tentacles only grow. I'm also aware that Google Health is quite old... it was around back when I worked on Google's indexing system a decade ago.
Edit: This month, expiration of Google's legacy free tier of whatever they now call Apps For Your Domain is forcing me to get off of my butt and migrate my vanity domain away, and start moving the keys to my digital life off of Google's "free" services. It'd be rather painful if I got locked out of GMail today, and I don't have any financial leverage to get back in.
They made the change fairly late in the process, and supposedly there was a way to undo the paid migrations by opening a support ticket, but I saw lots of posts about people being unable to migrate back and get refunded.
Google needs to err on the side of caution with DMCA because it's the immediate response to the requests that provides the safe harbor to Google under the law.
You had Disney (et al) lobbying like crazy decades ago to get the most insane laws passed when it came to digital IP.
Now we live in a world where those lobbying efforts were successful, which of course sucks for everyone that didn't have millions of dollars to spend on lobbying their interests and far outnumber those that did.
Minority rule through corruption causing a pseudo-oligarchy is sucking more and more every day, and DMCA takedowns are simply a small part of that larger sucking.
One of the great ironies about the rise of corporate fascism in the US is that the democracy does function on a technical level. If enough people worked together to do the right things, ballots could be cast and there is no dictator to prevent the will of the people from being heard.
Of course, that does not happen. The people have proven ineffective at self-governance.
At this point I'm wondering if we should just hand all governance over to a consortium of industry leaders that are accountable to shareholders. If we're going to do an oligarchy, let's at least be efficient about it.
That seems better to me than the current system of an easily brainwashed public electing whoever has the best disinformation campaign.
Do you think we'd have all these crazy IP laws if the big IP holders and big tech companies had to get in a room together and actually figure out what the law should be?
They might at least make the trains run on time.
All the fascist stuff is pretty bad -- nationalism, strongman leaders, isolating an "other" with violence, grifters selling out the people's interests to corporations -- I'm not down with any of that.
But maybe we could have some kind of system where corporations are forced to vote on governance that applies to all other corporations for the collective good of capitalist progress?
There needs to be some kind of unified governing principle to make everyone's lives better.
We can't go on with BIG_CO hiring lobbying firms to most efficiently snake their legislation through the system unchecked.
In my thought experiment here, most corporations would want to enact policy responsibly for the public good. Cooperation between corporations would happen, but the default position would be for more happy consumers.
So far we've tried letting representative democracy work out hard issues and that hasn't gone well. We've also tried deferring governance entirely to the courts with poor results.
I'm open to suggestions.
The takedown notice should come with a verifiable address. Google has a business directory for crying out loud! Just make it mandatory you have a business listing account.
¹ defining what is a cost vs benefit (and how much) is probably the hardest part, maybe after acquiring the necessary data.
I see this more as a political protest than anything else. But if you rock the boat you're going to get hit.
There isn't really a story here. YouTube just kind of blindly accepts any and all DMCAs regardless of whether the claimant has legitimate ownership or not.
Here's an excerpt from the court filing:
> Ninety-six separate times, Minor used his fake “CSC” Gmail addresses to exploit the hole in YouTube’s DMCA-process security that allows anyone at all to claim to be representing a rights holder for purposes of issuing a takedown, with no real safeguards against fraud.
I'd note that they refer to it as "the" hole
https://www.pcworld.co.nz/article/483729/google_submission_h...
> In its submission, Google notes that more than half (57%) of the takedown notices it has received under the US Digital Millennium Copyright Act 1998, were sent by business targeting competitors and over one third (37%) of notices were not valid copyright claims.
Sounds like a compelling story to me.
There are no ID requirements, either.