Terrorists used false DMCA claims to get personal data of anti-islamic YouTuber | Hacker News Reader

Terrorists used false DMCA claims to get personal data of anti-islamic YouTuber

beta.slashdot.org

150 pointsamalag23 comments

This can be meta-gamed. Suppose you create a Youtube account and use a fake identity: that of someone you would like to be targetted as terrorists. Then post videos which make them upset, and so it goes.

Some kind of honeypot?

Aha, meta-meta; goad the terrorists into coming out to some staked-out location where they are ambushed.

This was done to some extent/similarity by people honeypotting the standard your standard email scammers, having the scammers run around the country to "pick up the check", go through hilarious hoops, etc, so it's certainly not without precedent.

I shouldn't find this as entertaining an idea as I do, already don't have nearly enough free time...

Seems to me that, if anything happens to the author of the video, YouTube is likely to have some serious financial liability issues. That consideration may give some incentive to people like YouTube to be less trigger-happy when they receive a DCMA request.

It's a shame if someone has to die for people to learn that lesson, though...

It's been pointed out that it's Youtube's policy and not the DMCA that allowed this leak of personal info.

Also: it's the stupidity of giving your personal info to Youtube in the first place that allows it to leak personal info.

"Are you super triple double-dog sure you don't want to use Google with your real name from G+? Your choices are:

- I'm sure, but please ask me every single time I log in going forward - no, please use my real name"

Maybe I misunderstood but Youtube asked for its identity if he wanted the channel back online because of the false DMCA notices. And it is Youtube, most people will trust the website to do not disclose their identity like that. They may be wrong, but it is not that stupid if you are not fully informed of the risks.

Youtube is a safe-harbor under the DMCA because they facilitate this transaction. Here is the workflow:

1) You put something online.

2) They come and submit a DMCA takedown.

Little or no verification is required at this point, because the penalties for filing a false DMCA takedown are very limited and the penalties for not responding appropriately to a DMCA takedown are huge (eg. youtube can lose their safe-harbor status and become directly liable for your infringement.) The appropriate response to a DMCA takedown for a safe-harbor is in almost every case to take it down.

3) (Two?) weeks pass. You file an appeal or "counter-notice." YouTube can accept your appeal if it contains the necessary information, with no court oversight, at the end of the two weeks. They put your content back up, they forward your information to the DMCA claimant, and they are thus absolved of any direct liability and retain their safe-harbor status.

4) If the entity from (2) believes that you are indeed infringing, they now have your information and can file in a court of law, or as it was shown here, firebomb your house.

This is actually the way the process of DMCA law is written in my understanding.

With YouTube integrated into Google single sign-in and Google+, there really may not be much choice.

Yes there is; you can create a Google account under the name "Walter Fiddler" (or whatever) and then that is your "real name" as far as Google Plus and YouTube are concerned. Just say "Yes" when asked whether you want to use it.

You still have to remember not to use YouTube while signed into Google as yourself.

That so, Youtube's policies would be vastly different in a world with a different DMCA.

This is not true. It is the DMCA which requires disclosing name, address, and telephone number in order to fight a takedown notice.

  If the work was not infringing and the notice was either
  in error or malicious, the client can then file what is
  known as a counter-notice. That notice must contain the
  following elements:
  ...
  4. The subscriber's name, address, and telephone number,
  and a statement that the subscriber consents to the
  jurisdiction of Federal District Court for the judicial
  district in which the address is located, or if the
  subscriber's address is outside of the United States, for
  any judicial district in which the service provider may be
  found, and that the subscriber will accept service of
  process from the person who provided notification.

http://brainz.org/dmca-takedown-101/

That doesn't have to be their personal home address - the intent of the law is to provide claimants with a method of establishing contact that will allow them to serve notice of legal action directly if the matter is not resolved negotiations break down. A PO box would be sufficient.

Suppose you think I infringed your copyright with something I uploaded to YouTube, so you file a takedown notice. I think I'm well within the fair use exemption so I file a counter-notice. You don't agree with my reasoning so you decide to sue me. If you don't have any way to contact me, how would you go about it? You can't get a lawsuit going without proof of having given notice to the other party.

It's obvious what it's supposed to be for, the problem is that it can be so easily abused for other purposes. And listing a PO box does a fat lot of good when you still have to provide your name.

True, but you could say that about anything. Look how much information you can dig up from property tax records or court filings. The alternative is to invest YouTube with the function of legal arbitrator, in which case it would probably just default to supporting the original claimant.

Surely that's the claimant's problem, not Youtube's?

YouTube could waive their safe harbor provisions on a case by case basis if they cared. If the takedown is egregiously false, YouTube can just say "fuck it, sue us if you still think it's infringement."

By who, where?

Broadcasting on YouTube is very public. Someone needs to stand behind each piece of content. When it's not safe for an individual to do it, someone stronger needs to step in. This is why Edward Snowden needed The Guardian to publish his revelations, instead of posting them on YouTube or SlideShare himself.

Has Google forwarded the original complainants' personal information to the FBI and DoD for follow-up?

Reply on news.ycombinator.com