The epidemic of fraudulent DMCA takedowns
taxpolicy.org.uk
taxpolicy.org.uk
The DMCA takedown process assumes that nobody would make false declarations under the assumption that there would be consequences to doing so.
For a while, this worked - the consequences (or the mere possibility of them) - kept everyone more or less honest.
The problem nowadays is that bad actors are starting to see through the illusion.
This is not limited to DMCA takedowns either - corporation-against-consumer fraud has also been normalized.
Perjury does not have any meaningful penalty because you can always claim "I honestly believed this claim was correct, but now I see how I was wrong" - e.g the numerous takedowns against material that is clearly fair use. Then even the blatantly incorrect claims have to be responded to with an immediate takedown because the DMCA not only doesn't allow the processing organization to confirm the claimant owns the IP, or represents the firm that owns the IP, it doesn't even provide the option to confirm the claimant is a real legal entity that exists. If the claimant doesn't even legally exist, then even if they are committing perjury there's no one to bring the claim against.
It's also again kind of moot, because making these complaints realistically requires getting a lawyer, but the DMCA again does not provide any mechanism to recover legal fees arising from incorrect or fraudulent claims.
When the DMCA was passed everyone with half a brain was saying that it was clearly trivial to abuse.
Let's say you are affiliated with the <insert dictatorship here> government and want to censor memes critical of <insert dictator>. You can pretend you're John Appleseed, living at 123 Church Street in Maine, and that the memes are copies of your own work, posted without attribution.
If anybody dares to file a counterclaim, they have to provide all their personal details. If they post <insert dictator here> memes, it's likely they have some connection to your country, either by straight up living there or having family members. You can exploit those connections and do whatever dictators like to do with people who like to post memes critical of them.
If you find an actual American with no connection to your country who isn't afraid to disclose their personal details to you, they can sue. They can probably even win, possibly in a default judgment, as you're not from the US and therefore unlikely to show up in an American court. That, however, doesn't matter much, as there's no way the US can do anything to you. Even if they figure out who you are, they can't forcibly take money out of a bank account in <insert dictatorship here>.
This isn't a correct way of understanding things. The DMCA is silent about what the hosting provider is "allowed" to do. It simply says that IF you take it down following a DMCA claim THEN you cannot be held liable for any infringement that occurred while you hosted it.
If the claimant doesn't hold the copyright, then there can't have been any such infringement anyway. But yes: if you do your own due diligence about the IP ownership and get it wrong, then you can be found liable for copyright infringement. So most providers are trigger happy out of an abundance of caution.
That is dubious, given the DMCA does not define any consequences for false declarations. It does mention penalty of perjury but that's not even for accuracy of claim, it's only for the complaining party being "authorized to act on behalf of the owner of an exclusive right that is allegedly infringed."
DMCA abuse took off almost immediately, here's a 2005 study:
> Examining the characteristics of the targets of the notices—the alleged infringers—we found that 41% of all Google notice targets can be classed as competitors of the complainants. Fig. ES-4. This is particularly significant for Google 512(d) complaints regarding links in the index, where 55% of all notices relate to competitors. A significant percentage of the 512(c) and (d) notices sent to Google 21%—target hobbyists, critics, and educational users.
I don't think total control is possible in such an environment, DMCA or not.
I do not see why a corporations scale of intellectual property protection should have its burden foisted upon everyone else.
It makes to sense to provide a modicum of protection that can apply to individuals, but just as individuals can't require a policeman to stand guard outside their home 24/7, corporations must hire security guards if they want extra protection from the undesirable elements their commercial activity attracts.
If I had the time, I would love to aggregate listings from Lumen that use sites like uniontimes and thetribunepost to instigate false takedowns, and list them all so that they would come up in a Google search showing that someone had (fraudulently) tried to have the stories removed. I’m not sure how much of a deterrent it would be, but I imagine that sort of thing would at least prevent people from recommending the fake-takedown approach to others.
There should be "know your customer" for claimaints for laws requiring companies to follow up on legal claims like DMCA reports. KYC is obviously socially accepted and easily implemented since it's being required for so many other things. The whole basis of an adversarial legal system is that you need two legal persons on either side. This is a context in which you have to wonder why it isn't already like that.
Once false reports from fake companies and people are infeasible there will be much less of a problem. All without changing the penalties.
No, really. We live in a post-scarcity world when it comes to information, but artificially keep pretending it is scarce. Of course that will cause problems.
Keeping copyright in a post-scarcity world is like forcing every individual to jump through financial regulation hoops intended for corporations each time they buy their morning coffee.
If you abolish copyright, then open source licenses cease mattering.
The GPL only works because a corporation can only use GPL software if it agrees to the license, but if there is no copyright then there is nothing for the license to gate access to. Alternatively if you take the more recent argument that "the GPL is a contract not a license", then the contract also does not work because a core component of contract law is that a contract must have some kind of reasonable exchange and if there's no copyright the source software has no value (IANAL but the gist as I understand it is you can't have a contract that exchanges something for nothing).
If you think software is bad now, wait until every piece of software, even the non-game ones, basically operates in the cloud so you never get direct access to any of the actual software because if you can download and run it locally you can give it to anyone.
You also ensure that authors of music and books cannot make money, because they have no ownership of the work they produce.
What your copyright-free world does is give a huge advantage to corporations with huge amounts of cash over pretty much everyone else.
At worst maintaining the status quo, in other words.
Plenty of individual developers currently earn their living writing single apps.
In the lack of copyright, a corporation can just directly include that developer's software in the products they sell. The only way for such a developer to make a living is to go and work directly for those corporations.
You may say "well I can just copy their software", except of course the large corporations are able to afford the server infrastructure for licensing servers, DRM nonsense, and the gradual movement of all software onto their infrastructure.
People pirate MS office because it's possible, they don't pirate google docs because they literally can't.
If you're a developer trying to make a living selling software without working for a corporation, you would now need to be able to afford enough always online hardware to support all your customers. You can't sell your product and move on, now you have ongoing costs, so it even becomes a question as to whether you can have single purchase price or you have to switch to subscription software. The other alternative you have is to switch to the google advertising+spying business model, but that requires scale, so you're going to have to be selling your customer information to google, etc now.
Copyright exists so that you can create something, and earn a living from selling it. If you cannot earn a living from it, your only option is to work for a person or company who has the capital to support either not charging or running services to ensure people have to pay for it, or that are subsidizing your work from selling other products.
If you remove copyright, you roll back the ability of many people to make income directly by a few centuries. Basically you're saying "if you aren't constructing something that physically exists it has no value, so you better find an employer or patron".
Copyright exists in order that creative works are sold for more than their marginal cost of reproduction, and the profits from that are directed towards the author. Having the exclusive right to produce the copies, copyright, enabled creativity to be rewarded.
Making distribution cheaper and easier makes copyright perhaps make more sense, not less, but didn't change the underlying logic of trying needing to sell creative works for more than their marginal reproduction cost, even if you figure that cost is zero.
Except for scientific publishing. Burn that all down. Because the authors aren't getting any money (and actually want distribution, not payment) so copyright of scientific works isn't achieving anything positive for society at all.
A significant amount of the spend on creative works goes to overhead pretty much only enabled by copyright. No copyright means a massive reduction in legal and accounting complexity. I'd suspect copyright also tends to encourage a "short tail" of highly successful works. We only have one official source for Oppenheimer or Stairway to Heaven, rather than thousands of tweaked and extended versions sharing the same market.
Relying on market forces to bankroll creativity also optimizes for a weird niche-- familiar enough to be easily saleable, but distinct enough to avoid legal hassle. Does it incentivize pushing the envelope?
We could take the $28 bazillion a year we spend on content as a society, pipe it into endowments and grants, and increase the number of professional creatives. Yes, this might have to be administered as a tax-and-spend by the state, but it's certainly an alternative to consider.
Publishers yes have an outsized voice, however the solution is not to abolish copyright but to make repercussions for publishers much more onerous.
DMCA needs to be immediately abolished in its current form and instead replaced with a law that a) requires proof of ownership b) proof of identity c) provides comparatively heavy cost for fabrication (submit a false claim, be liable for 1-10k in damages, just for the claim).
Further, repeating truth should not be criminalized. If both myself and another entity want to accurately submit the sky is blue, one of us should not be able to sue the other. So then a takedown becomes strictly a matter of enforceable copyright rather than the current complete nonsense that it is now.
This makes takedown mills and fake take downs economically unfeasible and is reasonable for claimants in that it awards some money for dealing with fraudulent and mistaken claims.
It's not necessary to register a work with the US Copyright Office to have copyright protection, but registration is necessary to file an infringement claim in court.
Registering takes time and money, and the registration database is public. Simply requiring a URL that points to the work's registration as part of the DMCA notice should take care of the problem.
You can register post-infringement and sue anyway.
> Simply requiring a URL that points to the work's registration as part of the DMCA notice should take care of the problem.
I don't think an amateur photographer should have to pay a registration fee on every photo.
Never said otherwise. But if the copyright holder is serious about stopping the infringement, then registration will have to be done if the infringer files a counterclaim, in order to go to the next step.
> I don't think an amateur photographer should have to pay a registration fee on every photo.
They wouldn't, just the ones that are infringed.
To perform a crackdown on those 7 million listings, you're proposing that Disney would need to make a $700 million dollar deposit with Etsy and wait for hopefully most of it to trickle back in. If the infringer is somewhere on the other side of the globe that Disney can't easily reach legally, they can't get their deposit back until they spend thousands filing a federal lawsuit that'll go unanswered, so the deposit is more than forfeit in many of these cases. That's for a single company to defend a single franchise on a single website.
I don't think this is a "simple" solution.
Good, don't make the claim. Maybe multi-billion dollar companies shouldn't be enforcing copyright in such a draconian way in the first place.
First, let's not use IP here. Let's be specific and say copyright since that is what DMCA covers.
> Etsy.com
This is an awful example as etsy would be the company that the DMCA takedown would be against. Etsy certainly is worth suing or profiting from selling unlicensed goods.
> $700 million dollar deposit
The amount of the deposit you use is the high end of the range. Even so, you didn't account that each deposit covers up to 100 URLs, so the deposit would be $70M which I think the mouse can afford, easily.
> they can't get their deposit back until they spend thousands filing a federal lawsuit that'll go unanswered,
The deposit would go back if the takedown does not get a counterclaim. Legitimate claims would result in the deposit being returned. Not every claim will have a counterclaim. If there is a counterclaim, the next step is a Federal lawsuit anyway. And if they don't answer you get a default judgement that can be collected in many countries around the world, and even on contingency.
> I don't think this is a "simple" solution.
You gave very little consideration to the people that are badly affected by fake counterclaims, and are assuming that every actor is a bad faith factory.
Etsy is a marketplace that connects independent buyers and sellers, like eBay but only for handmade and vintage goods. Every item on their site is listed, sold and shipped by a third party. Every listing image and description is "user generated content". They are a service provider with no liability for copyright infringement on their platform so long as they follow the DMCA process.
Like any major UGC host, they have an IP reporting portal for companies like Disney to make large-scale sweeps of the whole marketplace for infringing listings and file complaints en masse. They do so somewhat regularly. I remember all the noise when they issued mass claims against all the "Baby Yoda" merchandise on Etsy.
Etsy is not a major "UGC" host, they are a marketplace taking a cut of sales for product.
Google lying to the public like this should be considered false advertising. They don't even require takedowns to be fully filled out.
The DMCA essentially prohibits companies from applying any judgement as to the validity of the complaint, so all google can do is try to identify fraudulent filers, but if a new entity makes a complaint it doesn't seem like there's a huge amount of signal available at that point to indicate whether that entity is legit.
The issue with the DMCA is it says something like "if you try to decide whether or not claims are valid, you also accept liability for infringement", which means there's near unbounded cost if you try to reject claims because the claims themselves are invalid, e.g. the DMCA "allows" a corporation to do that filtering but only in a way that no one would ever do.
Imagine you were running a forum, and you got a DMCA takedown notice for something someone posted. Let's say it's clearly obvious that the claim is invalid, and you reply with "hell no, that's clearly a BS claim". Later on someone posts something that is obviously copyright infringing. As I understood what people were complaining about (some 20 years ago sorry), because you rejected the earlier takedown you may now be liable for that infringing post. Hence, the only safe option available is to always start the two week takedown.
For many of these fraudulent claims that's the goal - they just want to censor the content. It doesn't matter if they ignore any future contact attempts, it doesn't matter if the person who got hit provides you evidence the claim is false, the DMCA basically requires that you keep the content down for two weeks to allow the original claimant to respond (which in these fraudulent cases they won't).
Google obviously does stop bring stuff back early now if it gets major publicity, but my guess is they have more lawyers than most companies can afford, and that they believe that if they were to go to court they could say they did their best to comply with the DMCA but the pressure (often incl. politicians) made them feel it was in the public interest or something to revert the takedown or whatever, and that that argument would hold up in court.
The problem is not Google here, the problem is a trivially abusable law that has no penalties for fraud.
My guess is they got enough shitty/badly done forms from real entities filing real reports and got threatened with lawsuits when they were rejected instead of the filers just going "oh, we'll fill out what we agreed to fill out"
Sigh.
> Google lying to the public like this should be considered false advertising.
To which you responded with:
> No, google is doing what it can within the extremely tight confines of what the DMCA allows.
So lying is okay as long as the law makes it potentially expensive to do what you claimed you did? That doesn't seem ethical to me.
The fact that the law encodes legal abuse that cannot be blocked, doesn't mean google is lying because it doesn't block things it's not allowed to block. The position you're taking is "if a law allows any kind abuse you're not able to stop, you can't claim you're trying to prevent abuse".
The law is stupid and terrible, the lack of penalties for incorrect and fraudulent claims, the mandatory multi-week takedown even when there are multiple methods to demonstrate a claim is invalid, the lack of compensation for recipients legal costs (meaning that the majority of targets can't afford a lawyer to respond and just has to accept it), the restrictive and coercive terms that essentially force hosting providers to blanket accept every takedown demand and limit what anti-abuse steps they can take.
That said, u/kevingadd said that they're accepting incomplete submissions as valid, which would seems like a thing they should be trivially blocking - my guess based on prior experience in corporate America, they kept getting incomplete/erroneously filled out demands that were otherwise legitimate, and the companies sending them threatened them for not accepting the demands anyway - but I feel at this point they should adopt malicious compliance and require perfect fill and perfect info, and just respond to threats with "we get millions of bogus requests, and those requests may also target content that you have intentionally published, and we're trying to minimize the impact to you".
These days, if was going to publish anything critical on my own website about any company, I'd put it on NearlyFreeSpeech.
> while we aren't lawyers, neither are we idiots. We can tell the difference between people harassing our members via the DMCA and cases where our service is genuinely being misused, and we can adjust our attitude accordingly.
There could be mandatory identity verification for filing DMCA complaints as well, but I'm not sure whether that would gel well with the current regime which penalizes not acting on infringement notices. Further, as someone whose application assets were copied without my permission by small time firms and had to go the DMCA route, I'd probably want to avoid giving out my ID to every hosting company under the sun.
> From a technical perspective, Google could compare whois domain registration details and snapshots at the Internet Archive with the allegedly infringing URL.
No to Google abusing the Internet Archive’s servers. If they want to host a mirror of their own and hit that, fine, but you know what they could be using instead? Their very own Google Cache.
You mean the thing they recently announced they were shutting down, and suggest you use the Internet archive instead?
[1]: https://arstechnica.com/gadgets/2024/02/google-search-kills-... [2]: https://searchengineland.com/google-search-officially-retire... [3]: https://news.ycombinator.com/item?id=39234246
My response here applies as well: https://news.ycombinator.com/item?id=39413967
They permanently disabled that recently.
FAANG and other huge companies always do risk assessment and don't blink if it's cheaper to ignore some law if the benefits outweigh the litigation costs.. does that mean DMCA takedowns could have huge financial impact for them?
The general fabric of society is slowly crumbling, a crap ton of generally dishonest things are happening at a faster and faster pace.. for example what is happening with restaurant reservations. People just make a 5 reservations and then decide in the moment which to go to or not, and don’t bother to cancel because people don’t have … honor… anymore
I took my wife out for Valentines dinner. They asked if I had a reservation and I did not, they said no problem they were just hoping to clear off one of the 5 couples ahead of me on the “reservation” list. We were there almost 3 hours and no one with a reservation showed… (we sat near the front window and could hear every interaction with the hostess)… I normally wouldn’t care but I was attuned to the situation from an article I had read and wow is it ever playing out all over North America.
They're literally doing what the DMCA requires, and everyone at the time it was passed said would be abused: Companies are essentially required to assume claims are legitimate or they become liable for infringement, add to that no penalties for incorrect claims, no cost for making the complaint, the requirement for the claimed material to be kept offline for two weeks iirc even if the recipient proves ownership, and this is expected.
There are many reasons to not like google, but this is not googles fault.
This is the DMCA operating exactly as it was designed and written.
If people want to stop DMCA abuse, the solution is:
* Incorrect claims have an increasing penalty for every incorrect claim involving the same companies or people. e.g. overlapping boards, overlapping lawyers, overlapping claimants, etc. Incorrect meaning it's fair use, etc
* False claims - the claimant does not own the IP, the IP is out of copyright or similar - are treated as criminal perjury, and in addition to the penalties for incorrect claims the fair and reasonable copyright penalties of 10k for individuals or 100k for corporations for every blocked viewing based on average views leading up to the DMCA hit
* The person making the claim must cover the full legal costs of the recipient in the even the claim is rejected (currently recipients can't afford a lawyer to respond to even the most blatant fraud)
* If the recipient can provide - under the standard perjury penalties that currently don't appear to apply to claimants - demonstration that they are the owner/creator of the IP the content goes back up, and the legal representatives of the parties can be put in contact with each other (either to argue over ownership, or to arrange for the entity making the claim to pay the legal fees and penalties)
* The processor handling DMCA requests can require that the entity making DMCA claims provide full contact information for the IP holder as well as the claiming entity as well (because large companies outsource IP enforcement to legal firms with no assets to recover, again why G and co should be able to require ahead of time funds to cover recipient legal expenses). The processor is permitted to ignore claims from any organization where it cannot confirm all contact and identity information, and it is permitted to charge a reasonable fee for those identity and background checks. Recall that the DMCA takedown system is a shortcut and convenience to circumvent the legal system, so a company can also just engage the legal system normally if they don't want these fees.
* If a company or organization that makes repeated incorrect claims, the minimum period before a takedown increases to two weeks. The processor can require the claimant demonstrate that they have the funds to cover the recipient's legal fees in the event the claim is rejected and if any recipients of invalid claims are unable to have their legal fees and the penalties repaid in a timely manner, the processor can require an escrow to cover those fees ahead of time and not service any request without such - per claim - escrow set up.
* The various restrictions on repeat claimants, etc apply to the actual holder of the IP, the legal firms representing them, and the individual legal representatives signing documents. e.g. you can't be a hansmaier type firm where the same lawyers keep re-incorporating as new legal entities to circumvent the restriction, and similarly if you are a legal representative that keeps filing incorrect or fraudulent paperwork then if you move to a new company you would poison that companies claims as well.