Parody site ClownStrike refused to bow to CrowdStrike's bogus DMCA takedown
arstechnica.com
arstechnica.com
Edit: I set up the site on bifidusdigestivum.com after getting too irritated by adverts where they talked about their amazing bacteria "Bifidus Digesivum", which was just so ridiculous I found out as much as I could about it and wrote about it in as SEO-friendly a way as possible so anyone searching for it found my site. It's had something like 1.5m views since then, and still gets 400-500 visits a month. Not huge in the grand scheme of things, but it still gives me a chuckle every now and then when I remember it.
Edit: Although the negative comments stop too. Maybe people were just more passionate about yoghurt a decade ago.
I am generally a fan of Cloudflare and I think they are good players and good people, but this is something they really need to fix. The DMCA system is already heavily stacked against the little guy. The least Cloudflare (or any host) can do is listen to both parties. Ideally they should be a neutral arbiter.
I use Cloudflare extensively and spend a lot per month with them, but this really gives me pause about whether I want to have CF hosting my actual content. I've never had a DMCA takedown claim against me, but I know people who have been abused by that process. It can really happen to anyone.
Cloudflare, please don't be part of the problem. You've long been a champion of a more open web, one in which little people can operate. You've done more to enable creators like that than just about anyone I can think of. Please, don't be a facilitator or enabler for the DMCA bullies.
But I can't.
Because my hosting will process those by default and shut my sites down unless I just comply to the take down, no matter how legitimate it is.
It can be even a bogus take down from a US point of view, or even a take down for a non existing content.
Doesn't matter. I have to show that I comply, or 48h later, my server is shut down.
That's seriously messed up.
I have selected my hosting specifically for this.
I tried several different hostings as well.
It's unfortunately a prevalent strat in the industry: if the client is too small, one should spend minimum money on it, so they default to that.
This is the entire point of DMCA: exempt service providers from indirect liability for content on their network (at the cost of taking action for that content upon receiving notice).
If DMCA applied to them but not to you, how could that possibly work? A US company could host content that no one is responsible for?
In other words: this is not about you but about your hosting company. They are the ones the DMCA apply to, and was written for. This is true no matter where you live, if your hosting company is US.
It looks like clownstrike.com has been redirected to crowdstrike.com. (Likely purchased by them or a friend.)
Edit: I see it's clownstrike.lol and is at this time up. clownflare.lol has "recently been registered."
Now we all know that any given Cloudflare customer is vulnerable to a fraudulent takedown request, because Cloudflare doesn't do their due diligence. That's entirely on CloudFlare.
In the case, if they had ignored the notification and CloudStrike sued anyway they could be stuck as a defendant on that lawsuit.
Even with the safe harbor they can still find themself a defendant, it may just be easier and faster to get themselves dismissed from the case.
This two tier system of handling is part of how the procedural flaws in the DMCA are able to persist as long as they have. If major institutions and brands were finding their content forced offline for 15 days at a time we'd see revisions quite quickly.
How exactly? Cloudflare has been a threat to the open web for as long as I've been paying attention to them
The dream of a free and equal Internet died on the day shitheads could rent 0wned devices for ddos attacks for 10$ an hour in bitcoin. There would have been a tiny window where governments could have stepped in and demanded that ISPs follow up and act on abuse reports, but Obama on his last legs didn't have the power any more and Trump didn't care.
Ideally, there would be an FCC regulation requiring ISPs above 500 customers have a time frame of two hours between getting notified of an attack originating from their network, investigate it, and cut off the other party unless they had shown evidence of effort to be a better netizen. That would also have led to economic pressure on Microsoft and other vendors (looking at you Java) to actually make their products more secure.
Also what's to prevent attackers from sending tons of bogus alerts to ISPs to muddy the waters and undermine the entire system?
However, swift shutdowns not involving a court would be the wrong way to do it - as wrong as the DMCA is. All that is needed is appropriate consequences for bad behavior, including those shielding bad actors.
I agree that courts have their place, in this case to provide an appeals solution if someone remains blocked by their ISP despite provably not being a bad netizen. But they cannot shoulder the load of policing - in the meatspace, that's done by police, in the digital space the ISPs are the closest equivalent.
Kick off all ISPs which refuse to do good ingress/egress filtering. Kick off all customers which absolutely positively need to be completely exempt from the filtering because of their ultra special snowflake networks, when creating source spoofed abuse a couple times. So now you have an internet with reliable source IPs. Allow ISPs for their customers to push firewall rules blocking abusive traffic to the originating ISP, subject to some fair use rules. If an ISP's firewall slows down because they are overloaded with rules for obvious abuse from their customers ... well that's working as intended then.
More political activism they do, more damage for them!
Gmail initially did not had delete button for "technical difficulties".
It was pretty simple really - all they had to do was not lie about Cloudflare endorsing them (per the contract that had extremely standard boilerplate language about such things).
People seem to get really upset when Nazis are held to the same basic contract law standard anyone else would be held to. Just because the politics of promoting hate makes it hard to find vendors, it doesn't mean that vendors need to make a special TOS just to coddle those that do.
Here's an article from the time describing what happened: https://gizmodo.com/cloudflare-ceo-on-terminating-service-to...
Importantly:
“I realized there was no way we were going to have that conversation with people calling us Nazis,” [CloudFlare CEO Matthew] Prince said. “The Daily Stormer site was bragging on their bulletin boards about how Cloudflare was one of them and that is the opposite of everything we believe. That was the tipping point for me.”
There is no neutral and apolitical option on this issue.
That’s neutral. You host sites, regardless of their content.
In this case, they broke ToS and got removed from CF.
Also: I don’t really agree. Enforcement of ToS is inherently political too.
If you really want to argue on this, then go with "ToS are complicated for mortals to understand".
> Isn’t the operative question here, what should the ToS include in the first place?
No? It's a private company. You can choose to agree or not to agree with ToS and therefore make a choice of using or not using service because of its ToS.
Another thing that you can complain about: CF clearly wanted to boot them off the service (see CEO's interview) and found a clause in their ToS to do so.
Granted, that is a political stance.
What if Kamala Harris used cloudflare in front of her website? Is cloudflare now supporting the Democratic party? What if Trump did? Same thing?
By your logic, it seems like cloudflare would have to review the content of every page on every site and only host it if they agree with it. That's going to mean a pretty big chunk of websites don't get hosted.
You really don't think a neutral position would be to just not care what the content is, and just host everybody regardless who they are, what they believe, etc?
> It was pretty simple really - all they had to do was not lie about Cloudflare endorsing them
If Kamala Harris used Cloudflare, not an issue. If Kamala Harris went on to very publicly falsely state on her website that Cloudflare supported her and the Democratic Party to the hilt .. then that's another thing and something that breaks the Terms of Service .. apparently that was what tripped The Daily Stormer .. claiming they had Cloudflare "in their corner".
Hosting content isn't the same as endorsing every word of it. Newspapers print op-eds that run counter to what the editorial board believes. But providing a platform to someone is still a choice, yes.
> By your logic, it seems like cloudflare would have to review the content of every page on every site and only host it if they agree with it.
Nah, what is allowed vs how you enforce it are two different things. Believe it or not, the decision of how to enforce the rules is political too. Nothing about having a ToS that bans certain content necessarily requires pre-review of content any more than the rule that bans phishing sites or pirated movies does.
> You really don't think a neutral position would be to just not care what the content is, and just host everybody regardless who they are, what they believe, etc?
Absolutely it isn't. Declaring that you don't care about offensive hate speech and will not remove it when made aware of it is a choice. It's a deeply political choice. (Also, this is a bit of a straw man: surely you can't "not care what the content is" when something potentially illegal)
I agree that there's always at least some politics in choice/policy/enforcement because for any given value there are going to be people that oppose that value, but I don't think that means we should just embrace the political nature of it all and not try to be as "neutral" as possible. (To be clear I'm not suggesting that you are advocating for this, but I think it is the logical conclusion of accepting that everything is equally political). Some people's politics include free speech absolutism, and others include significant speech limitations, so a largely "we allow all legal speech" is a political stance when viewed that way, though it also strikes me as also the most "neutral" a platform can be, and I think that is mostly coincidental. There are plenty of political parties that disagree on many things for example, yet mostly agree that free speech and ability to express oneself is a good thing.
To be clear, I despise hate speech and I hate when people say offensive things. But trying to define hate speech is a recipe for sadness. The Israel/Palestine conflict has really shown that recently where some people consider it "hate speech" to criticize the government of either side. When it's a company or a newspaper or something, the cost of getting it wrong (either too tight or too loose) is much lower than when it's a platform that controls vast swathes of the public square.
Also, at what level does/should this matter? For example, should ISPs be pulling the plug if the customer has or shares content that they deem to be hate speech? Should power companies cut off electricity to those people?
I fully agree btw that Daily Stormer really messed up by claiming that CF supported them, but CF could have left their website in place and C&D'ed or sued for libel. I don't know what I would have done in their position though. There's a pretty good chance I would have done the same thing they did. It's hard to really know when you aren't in the soup.
(* Though of course that's not really the policy anyway. You probably mean more like, "speech that, in our opinion, is likely to be ruled illegal" right? You're not waiting for someone to bring charges and a court to issue a final ruling. Making that determination isn't so easy. Whose laws are we following on a global internet anyway? Content moderation has no easy answers)
The user might very well lie about their situation, but also their contact info, and can easily create many accounts to avoid genuine DMCA requests.
I get that cloudflare, just like every big tech company nowadays, doesn't want to pay for customer service. They want to automate everything and let the code handle the issues. Unfortunately, that general approach is turning our lives into a dystopian hellscape.
In this case, it's a parody site so it's not that big of a deal, but in cases that I'm sure happen regularly that we never hear about, it can be people's livelihoods being destroyed. I think we should expect more from these companies.
It's definitely true though, that if they had to spend on this sort of thing for free accounts, they may just take away the free accounts. That would obviously not be in our interest. I also think that's a very reasonable deal.
I would personally be satisfied if they would make a policy explicit, that for free accounts they will not review the DMCA request, rather they will just forward it and take automated action. For paid accounts though, I expect more.
The biggest thing I think, is to just be transparent and explicit about what their policy and procedure will be and for which account. Having mystery behind it is what bothers me the most and gives me pause when I think about hosting my assets with them.
That's fair. I wish EVERY service was clear about this tbh.
"Presumed legal, until it isn't" should be the same as presumed innocence"
Moreover, the constant CAPTCHA prompts by Cloudflare are incredibly frustrating. This practice is a form of abuse and needs to be called out for being so.
I despise Cloudflare with a burning passion. Currently they're blocking access to the danish parliament website (ft.dk) by putting up a CAPTCHA wall. Of course it's wrong of the admins to put essential danish infrastructure in the hands of a shitty american tech giant, but as you say this crap is everywhere. I refuse to interact with any CAPTCHA unless I absolutely have to.
Companies generally don't have immutable characteristics like "good" or "bad". They have lifecycles. Today's scrappy startup fighting for the people becomes tomorrow's hated big tech oligarch.
It would be nice to turn the tables and say to N 'ok, we can do this all day, enjoy burning a mountain of cash with your legal team'
But if your dox is already out there, there's really no downside once you learn the process.
Doesn't sound something that would hold up since you can't just sign away your rights in sane jurisdictions.
https://www.law.cornell.edu/uscode/text/17/512
"Contents of counter notification [...] The subscriber’s name, address, and telephone number, and a statement that the subscriber consents to the jurisdiction of Federal District Court for the judicial district in which the address is located, or if the subscriber’s address is outside of the United States, for any judicial district in which the service provider may be found, and that the subscriber will accept service of process from the person who provided notification [...]"
The law inherently favors corporations because every Tom Dick and Harry in the US of A doesn't have a lawyer, let alone an entire legal department. Yeah they might be wrong but they have basically infinite resources to drag out the process of you proving that until you call it quits for your own sanity, or simply run out of money to fight back.
Like the author of the post says, most of America's legal system is set up pretty explicitly to serve corporations.
I mean, other than my time, if I'm well informed enough to fight just these lawsuits, what are the costs?
If ClownStrike had not made the news, maybe CrowdStrike would continue to try the same DMCA trick with Hetzner.
> (3) Contents of counter notification.—To be effective under this subsection, a counter notification must be a written communication provided to the service provider’s designated agent that includes substantially the following:
> (A) A physical or electronic signature of the subscriber.
> (B) Identification of the material that has been removed or to which access has been disabled and the location at which the material appeared before it was removed or access to it was disabled.
> (C) A statement under penalty of perjury that the subscriber has a good faith belief that the material was removed or disabled as a result of mistake or misidentification of the material to be removed or disabled.
> (D) The subscriber’s name, address, and telephone number, and a statement that the subscriber consents to the jurisdiction of Federal District Court for the judicial district in which the address is located, or if the subscriber’s address is outside of the United States, for any judicial district in which the service provider may be found, and that the subscriber will accept service of process from the person who provided notification under subsection (c)(1)(C) or an agent of such person.
However, if your service provider wants to be under the DMCA safe harbor, they must keep your content down for at least 10 days and no more than 14 days after they receive the counter notice (unless they receive a further notice from the originator of the DMCA that they have filed a case regarding the alleged infringement --- in that case the content will remain down until the case is resolved).
In a lot of cases, having the content down for 10-14 days is kind of too long. Also, you may not want to provide your identity information to the originator of the complaint or your provider. You may also not be willing to state your good faith belief under penalty of perjury.
If the originator is willing to take their complaint to court, that's going to be an adventure --- but if they just send out mass DMCA complaints and don't follow up, you might be fine. If you actually want to take them to court over their complaints, even though they don't want to, that's an adventure too.
You may also try to convince your provider that the originators complaints aren't structurally valid DMCA complaints if they aren't, although that requires a sympathetic provider. I've only read summaries, but this case is a potential example of an invalid complaint, as the summary says it's a DMCA complaint about trademark infringement; the DMCA doesn't cover trademark, so the complaint is not structurally valid --- the provider has no duty to process it, and receives no safe harbor from doing so. They may or may not have a duty to take action on trademark complaints, but it doesn't arise from the DMCA.
[1] https://www.law.cornell.edu/uscode/text/17/512 section (g)(3)
Yeah, no. (Re: Reddit DMCA takedown.)
Ignoring that, there doesn't seem to be any provision for punishing a false DMCA claim.
And that said, I don't think you need to be a lawyer to submit a DMCA claim. You or I could and I'm not a lawyer at least.
Otherwise lawyers would just pay lackeys to do all their dirty work for them.
In this case: cloudflare claims they never received any counter-notices from the parody guy (he sent two), and sent a weak "we would've helped you" after he moved the site off their services and they started getting negative attention. They screwed up royally.
I hate that companies have seen how places react to DMCA takedown requests and have responded by trying to force everything into a DMCA takedown request. Using it to avoid the necessary steps for a circumvention bypass was bad enough, trademark is covered by a whole range of unrelated laws.
https://law.stackexchange.com/questions/51541/has-anyone-bee...
I own copyright to my Iron Man and I can't be blamed for being misunderstood, right?
Or maybe I could name my drawing Iron Men? Blame mistargetting the DMCA on overzealous AI bot?
Marvel might have a case against you for copyright or trademark infringement, and pleading ignorance probably won't fly there.
I would never have known about this low-effort parody site, and even if I did learn about it is of poor enough quality that I would never have shared it.
But now I am 100% behind this site, and interested in spreading the word, since it apparently touches a nerve.
sounds funny when talking about a guy who hosted their site on Cloudflare.
In this case, I think he could be forgiven for (a) wanting to use his existing skillset to get his site online quickly and reliably and/or (b) actually believing that Cloudflare—based on previous actions—would robustly defend his site.
Also, complete 100% bullshit on it being unintentional. I'd imagine some executive in their organization found that and had a right tizzy about it. It's exactly the sort of completely meaningless deck-chair rearranging that the C-suites LOVE to send urgent-marked emails about, speaking from both anecdote and personal experience.
Edit: I did some searching and it looks like it might be hetzner.com hosting it now?
Nice job ClownStrike legal. I wouldn’t have heard of the site otherwise.
yea, right. They got caught and said "oops, sorry". Too bad Senk cannot charge them for the cost of moving his site elsewhere.
It's only because it costs them exactly zero dollars and cents that they feel they can get away with bullying anyone they want.
I'm more surprised by how CF is handling this. They seemed like the "good guys" (for the Big Tech anyway) so this is not how I would expect them to handle the situation.
There was a time when Google was seen as the tech heroes of the Internet.
Stop this. Stop letting companies you like off the hook by compartmentalizing the things you don't like to "the guys in the legal department".
So it's really amazing, then, that they somehow remain profitable and in business. It's interesting that their "largeness" only seems to create problems for their customers and never for themselves.
Meanwhile if you have a company that's too large to reasonably coordinate, then you shouldn't be allowed to exist, as you're effectively admitting you don't actually exercise any authority over the business.
Some companies are just disfunctional, yeah.
Too big to care?