MPAA Stretches DMCA To Breaking Point With Questionable Take Down Request For Popcorn Time Repositories

from the stretch-stretch-stretching-the-law dept

Torrentfreak has a story about how the MPAA has pulled various Popcorn Time repositories off of Github via a fairly incredible takedown notice. As you likely know, Popcorn Time is the open source project that some anonymous programmers put together a while back, which puts an apparently amazingly user-friendly interface on a program allowing users to watch all kinds of video online. Of course, many of the videos available via Popcorn Time are not online as authorized versions, but rather unauthorized versions, meaning that the use of Popcorn Time to watch those videos is often infringing someone's copyright. I've never used Popcorn Time, but I've heard from a few people who say it's so good that they find it much more convenient and easy to use than things like Netflix.

The original developers gave up the project after it got lots of attention (both the good and bad kinds), but as an open source project, others have picked it up. The MPAA has basically been playing a big game of whac-a-mole every time a new group picks up the Popcorn Time code. Frequently, those targeted by the MPAA have been scared off and abandoned whatever version they were working on, but there were always more to step in and try again. However, this latest strategy goes a bit further: going to Github to take down the repositories. Reading the MPAA's actual letter is worthwhile. It's a borderline DMCA notice, because they probably realize they can't file a true DMCA notice here, because they have no copyright over the code, which would be required for a DMCA takedown notice. Instead, it seems to be acting like a DMCA notice to try to either trick GitHub into taking down the works anyway, or to hope that it can just convince GitHub to side with them. At worst, it could be argued that the MPAA is reinterpreting the DMCA to try to make it an even more dangerous weapon to flat out censor technology rather than infringement.

Dear GitHub Inc:

The Motion Picture Association of America, Inc. (“MPAA”) represents each of the major motion picture studios in the United States, specifically, Paramount Pictures Corporation, Sony Pictures Entertainment Inc., Twentieth Century Fox Film Corporation, Universal City Studios LLC, Warner Bros. Entertainment Inc., Walt Disney Studios Motion Pictures, and their respective affiliates (collectively, the “MPAA Member Studios”), which own or control exclusive rights under copyright in and to a vast number of motion pictures and television shows worldwide.

We are writing to notify you of, and request your assistance in addressing the extensive copyright infringement of motion pictures and television shows that is occurring by virtue of the operation and further development of the GitHub projects Popcorn Time, and Time4Popcorn (the “Projects”).

See the "notify you of, and request your assistance in addressing the extensive copyright infringement of motion pictures and television shows..." It's not a direct takedown notice. Rather it's requesting assistance. That same sort of language continues throughout:

Attached as Exhibit A is a series of screenshots taken from within the applications of each Project that includes images of copyrighted works available through the Projects. The representative titles shown in Exhibit A consist of only some of the motion pictures and television programs that are owned or controlled by the MPAA Member Studios and that are being infringed via the Projects. Exhibit A is provided as a representative sample of the infringements being committed as a result of the operation of the Projects and to demonstrate the readily apparent nature of the massive infringement occurring via the Projects. The list is not intended to suggest that the identified infringements are the only ones occurring via the Projects. Having been informed, through the representative examples, of the nature and scope of infringements occurring through the Projects, we hope that you will act appropriately to address all infringement by the Projects, not merely the identified representative examples.

Exhibit A, moreover, merely provides concrete examples of what is obvious from even a cursory review of the Projects. The Projects blatantly infringe the MPAA Member Studios’ copyrights and countless other copyrights. Indeed, copyright infringement is so prevalent within the Projects that infringement plainly is their predominant use and purpose.

Of course, all of that same content is equally available in any browser, but I don't see the MPAA asking Github to remove repositories of regular every day web browsers. From there, the MPAA sort of makes it a DMCA takedown notice with the following paragraph:

By this notification, we are asking for your immediate assistance in stopping your users’ unauthorized activity. Specifically, we request that you remove or disable access to the infringing Projects’ repositories and all related forks in accordance with either 17 U.S.C. § 512(c)(3)(A)(ii) (DMCA “representative list” provision), 17 U.S.C. § 512(i)(1)(A) (DMCA “repeat infringer” provision), and/or GitHub’s Terms of Service, which prohibits use of your facilities for copyright infringement, see https://help.github.com/articles/github-terms-of-service. Moreover, the Projects in question host software that is distributed and used to infringe on the MPAA Member Studios’ copyrights. See Metro-Goldwyn-Mayer Studios, Inc. v. Grokster Ltd., 545 U.S. 913, 940 n.13 (2005) (“the distribution of a product can itself give rise to liability where evidence shows that the distributor intended and encouraged the product to be used to infringe”).

We are providing this notice based on our good faith belief that the use of motion pictures and television programs owned by the MPAA Member Studios in the manner occurring via the Projects is not authorized by the copyright owners, their agents, or the law. The information in this notification is accurate and, under penalty of perjury, we are authorized to act on behalf of the MPAA Member Studios, which own or control exclusive rights under copyright that are being infringed in the manner described herein. This letter is without prejudice to the rights and remedies of the MPAA Member Studios and their affiliates, all of which are expressly reserved.

So, yes, there they do cite the DMCA, and try to make it seem like a DMCA notice, but it's not clear they can really legitimately make those claims. Again, they're not claiming that there's any direct infringement going on here, which is really necessary. Instead, they're trying to stretch the DMCA to mean that a third party hosting company could be forced to take down a third party bit of software that might be used (or even is often used) to infringe. That's... a stretch. It's basically implying that GitHub itself might face liability by adding a tertiary level of liability to the Popcorn Time app under the Grokster inducement theory. It's a unique interpretation of the law, which some are already pointing out would make a fascinating law school question.

In short, the MPAA is effectively implying that rather than using the DMCA to take down infringement, it might be able to use the DMCA to take down projects that might be used to infringe. That's a big stretch, but expect to see more of that.

Of course, it's doubtful that any of that would actually do anything to, you know, slow down the continued growth and development of Popcorn Time, but the MPAA is never above continually trying to stretch copyright law to do its bidding. That it could spend some more time understanding why so many people like the Popcorn Time app and figuring out ways to help create better overall experiences for end users apparently never occurs to the lawyers at the MPAA.

Filed Under: dmca, intermediary liability, liability, popcorn time, takedown
Companies: github, mpaa

Clueless Lawyer Sues Tor Project Because Revenge Porn Site Made Use Of Tor

from the meanest-lawyer-in-texas? dept

Jason Lee Van Dyke is a lawyer in Texas whose own website describes himself as the "meanest lawyer in Texas" (technically it says "meanest lawyers" but the "attorneys" tab on his website only lists him.) Either way, his site promises "a highly practical 'no bullshit' approach to the practice of law." It also notes that the Van Dyke law firm is "unafraid of using novel arguments and tactics if we think that our clients may benefit from them." Novel arguments and tactics can be a good thing... but it kinda goes the other way when you're making a clearly bogus argument, ignoring basic existing safe harbor laws, potentially dragging all sorts of totally unrelated parties into court, while seeking a broad injunction that clearly violates the First Amendment. And that, it seems, is exactly what Jason Lee Van Dyke has done in filing a lawsuit against the Tor Project and Pinkmeth.com.

It should be noted, first of all, that Pinkmeth is yet another revenge porn site. We've written a bunch about revenge porn over the last few years, and hopefully most of us can agree that the folks who run these sites are horrible people, encouraging others to upload naked photos of unwitting folks, while often running a related extortion-like scam to get people to pay up to have their photos removed. We've been happy to see some of the folks who run these sites arrested -- when it appears there are legitimate charges against them -- but have been fearful about how others are trying to stretch the law to go after them.

Jason Van Dyke didn't just stretch the law, he seems to have decided to jump on a bulldozer and plow it right through the law with a legal filing so bad it makes you wonder how Van Dyke ever passed the bar. As nice as it would be to get Pinkmeth to shut down, abusing the law is no way to do it. Let's start with the most problematic aspects of the lawsuit, though, and that's lumping Tor into the lawsuit with Pinkmeth. First, it appears that a year and a half ago, Van Dyke was somehow able to get a judge to order the Pinkmeth.com domain put on hold by VeriSign. In response, the folks behind Pinkmeth set up the site as a Tor Hidden Service, like many other such hidden services (like the Silk Road).

Van Dyke, who does not seem to understand how Tor functions, or to have ever come across Section 230 of the CDA, is trying to claim that the Tor project is liable as part of a "conspiracy" with Pinkmeth:

Pinkmeth and TOR conspired to and had a meeting of the minds regarding the commission certain torts against Plaintiff more adequately described in paragraphs 5.1 - 5.15 above, as well as certain felony offense described in paragraph 4.8 and 4.9 above. The specific object to be accomplished by the conspiracy was the publication pornographic images of Plaintiff (and other women) on the Pinkmeth website in such a manner so as to prevent its operators and users from being held civilly and criminally accountable for this unlawful behavior.

Of course, Tor is just a tool, and claiming there was any "meeting of the minds," let alone any possible liability here, is ridiculous. In fact, many of the direct claims against Pinkmeth itself are likely protected under Section 230 as well, but we'll get to that. After the internet started trying to explain to Van Dyke how Tor worked, he first shrugged that he could dismiss the Tor Project later if he wants, and then issued a hilarious press release in which he tries to both back up his attack on the Tor Project and prime himself to back down against them at the same time. It has to be read to be believed. Here are some choice quotes:

The TOR Project Inc., ("TOR") is a slightly different story. They were named as a conspirator in the lawsuit based upon our belief that they were hosting PinkMeth or providing it with services that have allowed its operators to continue to escape justice.

First off, Tor doesn't host anything. I mean, a 5 second Google search should teach you that. I don't care if you're the meanest lawyer in Texas, you should be able to do a basic Google search. Second, "providing it with services that have allowed its operators to continue to escape justice" is a fascinating legal standard. Once again, Van Dyke would be well served to look up Section 230, or hell, just about anything concerning how basic liability works.

This was not an unprecedented action by our office.

Yes, actually, it was.

Claims brought against hosting companies such as GoDaddy have survived dismissal in similar lawsuits.

First, Tor isn't a hosting company, so you got that wrong. Second, while he's sorta kinda correct that a similar lawsuit against GoDaddy survived past the dismissal stage, he conveniently leaves out that that decision was decisively overturned once a real court looked at it and pointed out that the lower court somehow totally ignored Section 230, meaning the lawsuit against GoDaddy was dismissed, contrary to what Van Dyke implies.

Just today it was reported that a TOR exit node operator in Austria was convicted of abetting the spread of child pornography.

First off, that wasn't today, it was last week and we wrote about it here, with the point being that it was a ridiculous ruling that almost everyone finds problematic. Second, a tor exit node is not run by the Tor project, so the comparison is meaningless. Third, it's Austria, not the US, where any such claim would get laughed out of court just as fast as Van Dyke's lawsuit here will be.

It is our position that, if TOR provided goods or services of any nature to PinkMeth, that they are liable to Ms. Conklin. A review of the TOR website further confirmed by belief that, although it may have been originally designed for legitimate uses, is now used almost solely to aid and abet criminal conduct.

Yeah, I'll just leave that one there for people to laugh at. He then goes on to blame Pinkmeth for making him file against Tor, because Pinkmeth mentions that they're a Tor hidden service. Then the backtrack begins:

Since the filing of our lawsuit and service of legal process on PinkMeth, evidence has emerged that TOR may not have provided any goods or services to PinkMeth. We are still working to determine what degree of control, if any, TOR has over those who use TOR hidden services and to what extent they may be able to provide us information regarding those responsible for publishing PinkMeth. Naturally, if TOR has played no role in PinkMeth's re-emergence, has not provided PinkMeth with goods or services of any kind, and is unable even to assist in identifying those responsible for publishing PinkMeth, they will be dismissed from our lawsuit.

Uh, think you could have done that research before filing a lawsuit, sparky? Anyway, Van Dyke is not done with Tor yet. He's pretty sure that even if they didn't break the law here, it's a bad thing and should be outlawed:

This is not so [sic] say that we endorse the types of service that TOR is providing. We believe condemn [sic] them in the strongest possible terms and strongly disagree with their assertion that there is any "right" for the publishers of online content to remain anonymous.

For a guy who describes himself as "the most right wing lawyer in Texas" you'd think he'd be at least marginally familiar with the First Amendment, and things like the Supreme Court's decision in McIntyre v. Ohio Elections Commission, which pretty clearly states:

Protections for anonymous speech are vital to democratic discourse. Allowing dissenters to shield their identities frees them to express critical minority views . . . Anonymity is a shield from the tyranny of the majority. . . . It thus exemplifies the purpose behind the Bill of Rights and of the First Amendment in particular: to protect unpopular individuals from retaliation . . . at the hand of an intolerant society.

At the very least, you'd think he'd be familiar with things like the Federalist Papers and the importance of anonymous speech in the history of our democracy. But, no. Apparently not. He goes on to suggest that the legislature should ban Tor. Good luck with that.

Oh, and while most of the focus is on his lawsuit against the Tor Project, the other parts of his lawsuit against Pinkmeth seem fairly problematic as well. Nearly all of the claims are likely precluded by Section 230, because Van Dyke seems to pin the blame for what a user of Pinkmeth did on Pinkmeth itself. That's not how the law works, no matter how "mean" you might be. I'd be happy if there were a way to legally take Pinkmeth down, but this isn't it. Next, he makes a bizarre mention of how there isn't a fair use defense here, despite never actually making a copyright claim in the lawsuit:

Pinkmeth cannot claim "fair use" of any of the images they have misappropriated on its website because the illegal publication of child pornography and adult pornography (in violation of 18 U.S.C. § 2257) can never be lawful. In the specific case of the Plaintiff, she owns all the copyrights to the images stolen by Defendant. She has never given Defendant, or any other person, permission to access or distribute her photographs.

Given that, you'd think there would actually be a copyright claim somewhere in the filing. But there isn't. And I won't even bother getting into the question of why he's jumping back and forth between copyright law and child porn and a law about keeping records in porn production. Fair use has nothing to do with any of that. And, while it may be true that the Plaintiff holds the copyright on it, given Van Dyke's other problems understanding the law, it seems like there should be a bit more evidence to support that.

Then, the lawsuit goes even further, demanding "an all-encompassing order" which would impact a huge number of non-parties to the lawsuit, demanding a massive amount of prior restraint, all because of photos of one person. In particular, he demands that:

(a) All top level domain name providers and companies, including Verisign Inc. and ICAAN, cause "pinkmeth.com" and other websites containing the "pinkmeth" verbage to be obliterated or otherwise rendered permanently inaccessible;
(b) All domain name registrars and hosting companies, including TOR, be enjoined and restricted from providing, or continuing to provide, any Internet-related services to the Pinkmeth;
(c) All search engines companies (e.g. Google and Yahoo) be enjoined from (i) including any pornographic photographs of Plaintiff in their search engine results; and (ii) including Pinkmeth in their search engine results;
(d) All social media websites (e.g. Facebook, Twitter) be enjoined from permitting Defendant to utilize their services.

He further requests that, without any hearing, the court issue a temporary restraining order granting all of the above. I recognize that he doesn't understand Tor, doesn't understand the internet, doesn't seem to know about Section 230 and is a bit weak in his understanding of the First Amendment, but really, does he not understand the nature of prior restraint? The idea that this entity should be wiped off the face of the internet entirely, prior to any sort of hearing, flies in the face of basically all First Amendment law.

You can be the meanest lawyer in Texas, but it might help to have some clue about the law and the technology you're suing. Unfortunately, Jason Lee Van Dyke seems to fail at most of that.

Filed Under: first amendment, free speech, jason lee van dyke, jason van dyke, liability, meanest lawyer in texas, revenge porn, section 230, shelby conklin, tor
Companies: pinkmeth, the tor project

Labels Decide Not To Appeal Spanish Court Ruling That Found P2P File Sharing Software Perfectly Legal

from the but-expect-political-pressure dept

In April, we wrote about an important court ruling in Spain that found that Pablo Soto's P2P file sharing software, Blubster, was "perfectly legal", because the software was "neutral" and a part of "free enterprise within the framework of a market economy." In that post, we went through the entire history of earlier court rulings that had similarly suggested that file sharing software shouldn't be blamed for how people used it, and the US's aggressive pressure that forced Spain to pass multiple new copyright laws to try to reverse such rulings. All of that appeared to be for nothing, as the courts still recognized the silliness of blaming software for how people use it.

Francisco George alerts us to the news that the major labels who were the plaintiffs in the case have -- somewhat surprisingly -- chosen not to appeal the ruling, giving Soto a somewhat definitive win. Of course, the recording industry isn't exactly known for giving up in fights like these, so expect some other shoe to drop in the near future. If the labels feel that the courts still won't twist the law towards their own views, it seems likely that we'll soon see yet another attempt to change copyright laws in Spain.

Filed Under: copyright, file sharing, liability, pablo soto, secondary liability, spain
Companies: blubster

Google Appeals Moronic Court Order Demanding It Hunt Down Third Party Sites And 'Take' Offending Content 'Back'

from the the-googlenet dept

Search engines own the internet. The rest of us are just renting space. At least, that's what a Texas court seems to believe. Google is in court fighting a gag order telling it to chase down and remove certain mentions of a certain lawyer from the internet. (via WaCon)

[I]n a stunning and all-encompassing gag order signed over a year ago and now being appealed to Houston's 1st Court of Appeals, attorney Calvin C. Jackson, who was accused of forging attorney signatures on court records, demands Google erase all mention of those accusations from the entire Internet including other websites.

Jackson, who settled over these allegations (details also under a gag order), now wants it all to just go away. And he's gotten a Texas court to agree with him. Not only does he want the past erased, he's also seeking to bar "Google" from ever mentioning this unpleasantness again. So, we have both prior restraint and an impossibility, all wrapped up in a terrible gag order.

The requests Google is fighting play right to the edges of the "ridiculousness' envelope. Cleaning the internet isn't like expunging a criminal record, but this Texas court apparently feels Google (and other search engines) should be able to just go around deleting stuff, even stuff they doesn't own (which would be pretty much all of it).

The gag order, signed by visiting San Antonio Judge Richard Price in February 2013, forces Google and other search engines to wipe out all record of the allegations from the Internet. It also compels the search engine to find third parties who posted the information to get it back and destroy it.

"Get it back?" The hell? Does this judge really believe Google can just knock on the door of other sites and demand they hand over the "hard copy?" Once again, we have someone with power mistaking his home page for "The Internet." Google and other search engines index the web. They are not in charge of the web.

Judge Price doesn't seem to have any idea how Google is supposed to prevent future discussions of this case from appearing anywhere on the web. He just seems to feel a big company like this should be able to do anything he imagines it can. If he ever decides to leave the judicial racket, I'm sure the MPAA can set him up with an office, if UK Prime Minister David Cameron doesn't snatch him up first.

Let's not worry about that First Amendment. Let's just let Calvin Jackson control his past and future via court orders. Except that's not working out very well for him. The order may be sealed but the gag order doesn't cover this sort of discussion, or Google's arguments against prior restraint and impossibility. All he's done (with the court's blessing) is ensure more discussion of past allegations. And until this order gets reversed, every site discussing this (like us) will apparently be waiting for Google to knock on the door and ask that we turn over our "originals."

Filed Under: calvin c. jackson, deleting history, gag orders, internet, liability, search, texas
Companies: google

Court Rightly Finds That GoDaddy Isn't Liable For Revenge Porn Site

from the for-now... dept

In the ongoing attempts to deal with the (very real and serious) issue of "revenge porn" websites, various parties have been trying desperately to blame third parties, rather than figuring out ways to go after those actually responsible. In one such case, victims of the site had gone after the host and registrar of the revenge porn site Texxxan.com, which happened to be GoDaddy. A Texas trial court totally ignored Section 230 in finding GoDaddy liable. Thankfully, an appeals court has now reversed that, highlighting the importance of Section 230, and the lengths to which many will go to in an attempt to get around it, in order to blame third parties for the actions of others. Basically, the plaintiffs here tried to find a way around Section 230 by arguing that it "didn’t apply to intentional torts, obscene material that isn’t constitutionally protected, and civil lawsuits based on criminal statutes." However, the court rejected all of that:

All of plaintiffs’ claims against GoDaddy stem from GoDaddy’s publication of the contested content, its failure to remove the content, or its alleged violation of the Texas Penal Code for the same conduct. Allowing plaintiffs’ to assert any cause of action against GoDaddy for publishing content created by a third party, or for refusing to remove content created by a third party would be squarely inconsistent with section 230.

As Andrew McDiarmid at CDT points out, this is important:

Last week’s opinion reads like a greatest-hits record of Section 230 case law, and makes it clear that because GoDaddy had nothing to do with the creation of the content at issue it cannot be held liable. This is the right answer; hosts like GoDaddy must be protected from liability for their users’ (and their users’ users’) speech so that the Internet remains a vibrant platform for free expression and access to information. Otherwise, who would be willing to take the risk of opening up their servers for public hosting?

The plaintiffs attempted to argue that Section 230 doesn’t apply when the content at issue is illegal – an argument the judges rightly rejected. Shielding hosts from liability when their users upload illegal content is precisely the point of Section 230: those who post such content – not those who host it – should be legally responsible for it. Thankfully, the court recognized as much, writing that such a reading of the statute “would undermine its purpose.”

Of course, this is not the final word on this. The attorney for the plaintiffs has said that they will appeal to the Texas Supreme Court. And of course (once again) we have the issue that the person who has been credited with helping to draft the upcoming federal revenge porn law has flat out said that it's her intention to make companies like GoDaddy liable.

"The impact [of a federal law] for victims would be immediate," Franks said. "If it became a federal criminal law that you can't engage in this type of behavior, potentially Google, any website, Verizon, any of these entities might have to face liability for violations."

Indeed, this would target the GoDaddy's of the world as well. I recognize that there are serious issues involved in revenge porn, but targeting third parties like web hosts and search engines is idiotic. It will have tremendous unintended First Amendment consequences.

Filed Under: liability, revenge porn, section 230, texas
Companies: godaddy, texxxan.com

Court Says FTC Can Go After Companies Who Get Hacked For Their Weak Security Practices

from the a-bit-of-a-slippery-slope dept

Almost exactly a decade ago (man, time flies...), we first discussed the question of whether or not it should be against the law to get hacked. The FTC had gone after Tower Records (remember them?) for its weak data security practices. That resulted in a series of questions about where the liability should fall. Many people, quite reasonably, say that there should be incentives for companies to better manage data security and (especially) to protect their users. But, it's also true that sooner or later, if you're a target, you're going to get hacked. Ten years later and this is still an issue. The FTC went after Wyndham hotels for its egregiously bad data security (which made it easy for hackers to get hotel guests' information, including credit cards), but Wyndham fought back, saying the FTC had no authority over such matters, especially without having first issued specific rules.

However, a court has shot down that argument and will allow the FTC's case against Wyndham to move forward.

Again, Wyndham's security here was egregiously bad. It didn't encrypt payment data, and also used default logins and passwords for its systems. So there's an argument here that some kind of line can be drawn between purely negligent behavior, such as Wyndham's (lack of) data security, and companies who actually do follow some rather basic security practices, and yet still fall prey to hacks. What makes things tricky is that pretty large gray area in between the two extremes.

Filed Under: breach, ftc, liability, privacy, security
Companies: wyndham

Federal Revenge Porn Bill Will Look To Criminalize Websites

from the dangerous-step dept

My own representative in Congress, Jackie Speier, has apparently decided to introduce a federal "revenge porn" bill, which is being drafted, in part, by Prof. Mary Anne Franks, who has flat out admitted that her goal is to undermine Section 230 protections for websites (protecting them from liability of actions by third parties) to make them liable for others' actions. Now, I've never written about Franks before, but the last time I linked to a story about her in a different post, she went ballistic on Twitter, attacking me in all sorts of misleading ways. So, let me just be very clear about this. Here's what she has said:

"The impact [of a federal law] for victims would be immediate," Franks said. "If it became a federal criminal law that you can't engage in this type of behavior, potentially Google, any website, Verizon, any of these entities might have to face liability for violations."

That makes it clear her intent is to undermine Section 230 and make third parties -- like "Google, any website, Verizon... face liability."

Now, her retort to all of this is likely that she's not seeking to undermine Section 230 in any way. Rather, she's attempting to do something of an end-run around it. Section 230 has never protected sites from liability of federal crimes -- just civil infractions and state crimes. So her goal is to make the amorphous concept of "revenge porn" a "federal crime" thereby suddenly making third-party websites liable. She will argue that does nothing to undermine Section 230. A more reasoned and thoughtful look at the issue, however, shows how this effort is fraught with dangerous consequences and potential First Amendment problems.

Taking a step back, though, let's be clear: revenge porn -- the practice of posting naked pictures of someone (who likely took those photos for an individual or themselves, rather than the public) along with that person's identifying information -- is odious. Those who are involved in the practice are morally repugnant individuals. And yet, what we've seen is that there do appear to be ways to deal with them. One of the most well-known creators of revenge porn, Hunter Moore, was recently arrested on charges that he conspired with another person to hack into email accounts to get more photos. Often, those engaged in revenge porn are also engaged in extortion over those images or other crimes on which they can be charged. Some revenge porn sites have been hit with lawsuits for copyright infringement -- though that creates a whole different set of problems.

Meanwhile, amazing folks like Adam Steinbaugh have been diligently tracking down and exposing the details of people who operate revenge porn sites, which can sometimes be an effective (if slightly ironic) way to get them to go away. But that's an example where more speech is often a better result than censoring speech by increasing liability.

Still, you can see why there's a temptation to create a new anti-revenge porn statute. The whole concept of revenge porn is itself repugnant, so it's tempting (especially as a lawmaker) to pull out that old hammer and create some regulations. But the dangers of regulating based on reacting to the odiousness of those sites may obscure the way such laws will inevitably -- as Prof. Franks herself admits -- impact companies that are clearly not engaged in revenge porn.

In the article about the legislation, EFF's Matt Zimmerman (who, actually, just left EFF) points out that using criminal law here is "dangerous" because it would likely lead lots of companies to reflexively delete all sorts of content, including plenty of perfectly legal and legitimate content, to avoid the sort of liability Franks describes. And that's the huge problem here. By spreading liability, you guarantee over-censorship. It's easy for people who are narrowly focused on a single issue to not recognize the wider impact that issue may have. Trying to accurately describe what "revenge porn" is for the sake of criminalizing its posting, will almost certainly have chilling effects on third parties and undermine the very intent of the CDA's Section 230.

People who don't think through the details seem to assume that it must be easy to define what is "revenge porn," but the deeper you go, the more difficult it becomes to define -- and the more risks there are of both over-criminalizing and creating serious First Amendment issues. For example, you could say that sites should be forced to take down photos of individuals where those individuals insist that the photos are problematic. But then you'd have to deal with situations, like with Ranaan Katz, where he went after a blogger and Google (using civil copyright law) for posting an "unflattering" photo. Do we really want to bring criminal law into that arena?

And the First Amendment issue is not easy to get around. At all. As lawyer Mark Bennett discussed in trying to create a First Amendment-compliant anti-revenge-porn statute, it's not an easy challenge:

The First Amendment problem we face is that “posting nude or explicit images of former lovers online” is speech; a statute focused on such posting is a content-based regulation of speech; content-based regulations of speech are presumed to be invalid (that is, speech is presumed to be protected); and the Supreme Court in U.S. v. Stevens expressly rejected a balancing test for content-based criminal laws, instead applying a categorical test.

At best, Bennett tries, as an exercise, to see if it would be possible to extend obscenity laws to cover "revenge porn," but that would massively expand obscenity laws, again in potentially dangerous ways. The problem here is that pretty much everyone agrees that revenge porn is a really horrible thing -- but any attempt to criminalize it will have serious implications way beyond the targeted issue.

Instead of following Franks down that dangerous road, it would be wise to focus on ways to use existing laws to go after those who are clearly engaged in related questionable behaviors. Changing the laws to put the burden on third parties is only going to create significant new problems. I'm disappointed that my own Representative in Congress, Jackie Speier, appears to not realize this, and I will be contacting her office to express my concerns about the bill.

Filed Under: cda, first amendment, jackie speier, liability, mark bennett, mary anne franks, revenge porn, section 230, speech

EU Court Of Justice Makes Life Difficult For ISPs: Demand 'Balance' In Blocking Websites, But Incomplete Blocking May Lead To Liability

from the figure-that-one-out dept

While in the past, the EU Court of Justice has been more concerned about attempts to order ISPs to block access to entire websites over claims of infringement, late last year, we noted that the EUCJ's Advocate General Pedro Cruz Villalon had suggested that it was okay to issue an injunction against an ISP -- with some specific restrictions to try to limit the serious issue of overblocking. While the court will often follow the lead of the Advocate General, and the newly issued ruling does appear to reach the same final conclusions, it appears to have done so slightly different reasoning.

Either way, the key part is this:

The fundamental rights recognised by EU law must be interpreted as not precluding a court injunction prohibiting an internet service provider from allowing its customers access to a website placing protected subject-matter online without the agreement of the rightholders when that injunction does not specify the measures which that access provider must take and when that access provider can avoid incurring coercive penalties for breach of that injunction by showing that it has taken all reasonable measures, provided that (i) the measures taken do not unnecessarily deprive internet users of the possibility of lawfully accessing the information available and (ii) that those measures have the effect of preventing unauthorised access to the protected subject-matter or, at least, of making it difficult to achieve and of seriously discouraging internet users who are using the services of the addressee of that injunction from accessing the subject-matter that has been made available to them in breach of the intellectual property right, that being a matter for the national authorities and courts to establish.

In other words, it appears that broader injunctions, which do not specify exactly what an ISP must do to block access, are allowed. However, ISPs themselves will then be responsible for "taking all reasonable measures" to block access, as long as those measures don't block lawful content. That seems like kind of a huge mess for ISPs who will now have to deal with injunctions asking them to block stuff, where they'll be required to show "reasonable measures" but will also need to balance that against blocking access to legitimate content. This decision seems to try to thread a needle, where the result is likely to be many new lawsuits as censorship injunctions are issued, and ISPs have to figure out how to balance the order without blocking access to legitimate content. It seems likely that many ISPs will opt for limiting their own liability by defaulting towards overblocking to avoid having to face challenges suggesting they didn't take enough "reasonable measures."

Filed Under: balance, blocking access, eu court of justice, injunctions, isps, liability

Frenchman Fined For 'Theft' And 'Fraudulent Retention' For Finding Health Docs Via A Google Search

from the le-cluelessness dept

The basic downloading tool Wget is much in the news at the moment, and here's another story where it plays a central role. The French blogger and activist Olivier Laurelli, also known by his Twitter name Bluetouff, was searching on Google for something else when he spotted an interesting link that turned out to lead to several gigabytes of internal documents held on the French National Agency for Food Safety, Environment, and Labor's extranet (ANSES in French). Ars Technica explains what happened next:

Laurelli merely used the Linux Wget tool to download all of the contents of the Web directory that he found. He left the files on his drive for a few days and then transferred them to his desktop for more convenient reading (which the French government would later spin as "the accused made backup copies of the documents he had stolen"). A few days later, Laurelli searched through the documents he downloaded and sent some to a fellow … writer [on the activist news site Reflets.info], Yovan Menkevick. About two weeks later, a few interesting scientific slides pertaining to nano-substances from the cache were published on Laurelli's site.

When ANSES discovered this, it reported what it called "potential intrusion" and "data theft" to the police. Then France's Central Directorate of Interior Intelligence (DCRI in French) became involved. The lower court that heard the case decided Laurelli should not be punished for accessing data that was not secure; ANSES was happy to let it go at that, but DCRI appealed.

It was clear that things would not go well in the appeals court when the presiding judge seemed not to know even how to pronounce "Google " or "login" -- he said "Googluh" and "lojin" (original in French.) The prosecutor was just as bad: he started off his speech by admitting "I didn't even understand half the terms I heard today." Ars Technica reports the denouement of this high-tech French farce as follows:

The appeals court acquitted Laurelli of fraudulently accessing an information system but saw fit to convict Bluetouff of theft of documents and fraudulent retention of information. The court wrote: "It is well demonstrated that he was conscious of his irregular retention in automated data processing, accessed where he downloaded protected evidence; and that investigations have shown that these data had been downloaded before being... disseminated to others; that it is, in any event, established that Olivier Laurelli made copies of computer files inaccessible to the public for personal use without the knowledge and against the will of its owner"

Leaving aside the fact that the appeals court was clearly ill-equipped to understand the technical issues involved, and that the original files were completely unprotected and found by Google's crawler, not Laurelli, there is another disquieting aspect to this affair. Alongside his writing and activism, Laurelli also runs a small computer security company. One of the services it offers is a standard VPN. He was using this VPN service when he accessed the ANSES site, and the fact that his connection was routed via Panama -- the VPN's exit node -- counted heavily against him, he believes:

"This VPN (in fact above all this Panamanian IP address) is probably one of the strongest elements which had driven the prosecution to pursue a criminal case," he wrote.

VPNs represent one of the few tools available to ordinary Internet users to help them bolster their security and privacy against global surveillance. It's deeply troubling that the mere fact of using a VPN to access a Web site was apparently viewed by the court as evidence of criminal intent, rather than simply good online practice in the post-Snowden world.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: anses, bluetouff, documents, france, liability, olivier laurelli, retention, search, security, theft, wget

Scumbag Revenge Porn Site Operator Arrested... But Many Of The Charges Are Very Problematic

from the bad-cases-make-bad-laws dept

A fair amount of attention has been paid to the announcement from Kamala Harris, the attorney general for California, that Kevin Bollaert, the operator of a revenge porn site, and corresponding "pay me to take down the revenge porn" site, has been arrested and charged with a variety of crimes, including extortion. Make no mistake about it: Bollaert is a scumbag and these revenge porn sites -- especially those with the extortionate concept of "pay us to take down those nude photos you never wanted posted in the first place" -- are highly problematic. But... as with all kinds of "highly problematic" activities, it all too often happens that law enforcement's zeal to take down the bad guy means they twist laws in dangerous ways that could have significant consequences for plenty of good sites. That appears to be the case here.

Again, Bollaert is a despicable person. A year ago, Adam Steinbaugh was one of the first to detail the nasty practices of "YouGotPosted" (or "UGotPosted") and the companion site "ChangeMyReputation." However, as Eric Goldman details, there are a bunch of dangerous problems with the charges that Harris filed against Bollaert, mainly in that many of them seem to blame him for the way users use the site -- something that the site is protected from under Section 230:

The other two asserted unlawful purposes are (1) online harassment per Penal Code 653m(b) (criminalizing “repeated contact by means of an electronic communication device”), and (2) the civil tort of public disclosure of private facts (citing a troubling precedent, In Re Rolando S.). Unlike the extortion claim, both allegations depend on the behavior of the website’s users. The complaint doesn’t allege that Bollaert himself made repeated contacts with victims using an electronic communication device, or that Bollaert himself disclosed anyone’s private facts. Instead, the complaint alleges that Bollaert ran a UGC website where users performed unlawful activities. But that’s exactly what UGC websites do: they let users publish content online for both good and evil. If we hold UGC website operators responsible for the fact that their users sometimes commit crimes, then all UGC website operators are criminals.

Fortunately, that’s not the law. In 1996, in 47 USC 230 (Section 230), Congress said that websites aren’t liable for third party content, even if the third party violates state criminal law. From my perspective, based on the allegations in the complaint and arrest warrant, the identity theft charges predicated on harassment and privacy violations appear to be preempted by Section 230

It's no secret that the various state attorneys general, including Harris, would love to wipe out Section 230. So perhaps she sees this as a chance to take a case so emotionally charged that she can get a favorable ruling. That's dangerous, since as Goldman notes, this would effectively wipe out Section 230 for many, many sites that allow user contributed content.

A second problem with the complaint is that it relies on an identity theft law used against Bollaert. But anyone looking at the situation would know right away that this isn't any kind of identity theft. Again, Goldman explains:

The crime asserted here, Penal Code 530.5(a), has two elements. First, the defendant must willfully obtain personal identifying information. Second, the defendant must use that information for an unlawful purpose.

When applied to actual identity theft, these elements make sense. If I steal your social security number and use it to obtain a credit card that I use to run up fraudulent charges, the two elements are clearly satisfied.

As applied to Bollaert, in contrast, the elements are confusing. (The criminal complaint, as typical for the genre, doesn’t explain how the law applies to the facts). How did Bollaert willfully obtain personal identifying information? He allegedly ran a UGC website where users could submit photos and personal information structured into standardized categories. It seems like this allegation would equally describe how all UGC websites “willfully” obtain content from their users.

The one area where the claim may actually make some sense is the extortion claim -- as that definitely seems questionable. However, once again, this can run into some problems. For example, you can see a perfectly legitimate service that charges some sort of processing fee to take down content that had been previously posted. Merely charging to remove content, by itself, shouldn't be seen as extortion. Hell, we've recently had comment spammers who apparently got punished by Google's search rankings email us about removing the comment spam they were able to sneak through our spam filters. When I mentioned how silly this was on Twitter, many people suggested that we should charge the spammers to remove their spam comments. That actually seems like a reasonable (if amusing) idea. But would that be extortion? Under the claims against Bollaert, it's possible that such an action would be considered the same thing -- but I doubt most people would think the request to spammers would be extortion (not that we've done it either way).

And that leaves this whole case in a tricky spot. Bollaert's site was a problem. What he was doing was despicable in so many ways it's almost difficult to keep track of them all. But, if the case is allowed against him, it's quite possible that very bad precedents will be set that lead to significant problems for tons of legitimate sites. As Goldman notes, however, there's a good chance it will never get this far. Bollaert almost certainly will take a plea deal, and Harris will get yet another headline about how she's protecting the citizens of California, even if her legal theories might undermine its economy -- and many of the sites that people around the globe enjoy.

Filed Under: california, extortion, identity theft, kamala harris, kevin bollaert, liability, revenge porn, section 230
Companies: changemyreputation, yougotposted