Running a site with user-generated content, such as comments or Wiki pages, poses challenges beyond the ordinary takedown letters for alleged copyright infringement. An attorney explains the DMCA’s confusing “circumvention device” restrictions as it applies to Webmasters of community sites.
In mid-April, a number of bloggers got word from Google of copyright complaints against recent posts. Each of the posts in question included a 128-bit number, written in hexadecimal. A poster to the Doom9 forum had earlier identified the number as a processing key in the AACS restriction scheme for high-definition DVDs. The cease-and-desist orders came from lawyers representing the Advanced Access Content System Licensing Administrator (AACS-LA), and intoned in heavy legalese: “It is our understanding that you are providing to the public the above-identified tools and services at the above referenced URL, and are thereby providing and offering to the public a technology, product, service, device, component, or part thereof that is primarily designed, produced, or marketed for the purpose of circumventing the technological protection measures afforded by AACS.”
In response to the AACS-LA letter, Google asked its bloggers to remove the posts. Author and U.S.C. Fulbright Chair Cory Doctorow felt compelled to censor the class blog for his U.S.C. course, where the key had cropped up in a discussion of the digital rights management technology. But as he did so, he chronicled the incident on BoingBoing.
Lawyer letters can be fans to an Internet blaze, and as the letters rolled in, interest in the 128-bit integer soared. Digg users Dugg it; Wikipedians added encyclopedia entries; others registered it in the domain name system, screened it on t-shirts and set it to music. Digg initially removed posts in response to complaints from AACS-LA, but within a day, Digg founders embraced the community frustration: “You’d rather see Digg go down fighting than bow down to a bigger company. We hear you, and effective immediately we won’t delete stories or comments containing the code and will deal with whatever the consequences might be.”
So, was Digg taking a risk? Were Wikipedia editors being rightly cautious in removing entries or deeming the number unnecessary to the encyclopedia’s coverage? What should you do if, as a Web host or a blogger with comment space, you get a similar complaint?
First, it’s worth looking quickly at what this complaint was not. It was not a complaint of copyright infringement. Although sufficiently large numbers (think of a computer program binary) can be protected by copyright, AACS-LA was not claiming such protection for 09-F9. That means this wasn’t a standard DMCA section 512 notice of claimed copyright infringement. For those, you probably already have a DMCA policy of “expeditious” takedown, to earn the safe harbor protection from risks of indirect liability. (If you don’t, see Chilling Effects for more information on DMCA 512.) Copyright claimants like section 512, because it means new complaints get quick takedown action, while service providers like its relative clarity.
In the case of 09-F9, however, AACS-LA took care not to use the inapplicable section 512 takedown. Instead, they asserted that the number was a component of a circumvention device, prohibited by a different part of the DMCA: section 1201’s anticircumvention.
A bit of background: Anticircumvention law gives legal enforcement to technological measures, such as encryption, used to lock up a copyrighted work. Section 1201 was the issue when Universal Studios sued 2600 Magazine for several years back for posting DeCSS code and links, and won because DeCSS could be used to decrypt DVDs. The law prohibits both circumvention of technological measures to gain unauthorized access to copyrighted works, and the provision of tools to be used to circumvent. Specifically, technologies are prohibited if they are primarily designed or produced for circumvention, have no commercially significant non-circumvention purpose or are marketed for circumvention.
AACS-LA doesn’t hold any movie copyrights, but it licenses the AACS scheme, “an integrated set of technological protection measures that controls access to and prevents unauthorized copying of copyrighted motion pictures embodied on high definition DVDs.” It claims that the blog-posted keys are parts of circumvention tools, violating section 1201 because they work with other code to decrypt high-def DVDs.
So the complaints to Google, Digg and others did not trigger the DMCA safe harbor. That means they don’t fit into the relatively automated process that has grown up around notices claiming infringement, but need to be evaluated individually: Would hosts be held liable for permitting (or failing to prevent) users posting the alleged processor key?
The first question in any liability analysis is whether someone is breaking the law, even before that someone is identified. In the mold of DVDs’ CSS, AACS would likely be deemed a technological protection measure. If the posts on Doom9 are accurate, then this number is one input to successful decryption of a high-definition DVD. Does that make posting the number “traffick[ing] in any technology, product, service, device, component, or part thereof” of a circumvention tool? AACS-LA would draw analogy to a physical key, duplicated without authorization, while its opponents might invoke the Supreme Court’s recent decision in Microsoft vs. AT&T, that intangible software is not a “component” capable of inducing patent infringement overseas. Until a court rules, we won’t know for sure.
But assuming that the number can be a circumvention component, it must next meet one of the statutory criteria: that it be primarily designed or produced for circumvention, have only limited non-circumvention commercial significance, or be marketed for use in circumvention. Arguments that the primary purpose and significance was speech, not circumvention, failed in the Universal vs. Corley DeCSS case and might face the same hurdles here. The key posters might be found liable on similar grounds.
Finally, can this potential liability be tied to you, the inadvertent host of user-submitted materials? Again, the legal analysis takes several steps. We have to ask whether hosts are liable for the trafficking, directly, or whether you can be indirectly liable for contributing to the trafficking in components of circumvention tools. AACS-LA might argue that hosts such as Blogger were directly liable for provision of circumvention tools, but borrowing from analysis in the copyright infringement context, however, courts would likely find that mere automatic reproduction of user-posted material was not a direct trafficking. If it didn’t give up then, the complainant would invoke theories of indirect liability, saying hosts contributed to users’ unlawful trafficking by “knowingly materially assisting” in provision of the number.
Note that this claimed contribution to circumvention is a degree further removed from underlying copyright harm than a contributory infringement. The claim is not that hosts assisted in unlawful copying, but that they assisted in distribution of a component of a tool with which others might circumvent technological measures and thereby access copyrighted works or infringe copyright. That’s a lot of layers of indirection, and courts have never yet adopted a “contributory circumvention” claim.
In the early DeCSS case, the court held 2600 Magazine liable for trafficking in circumvention tools for both posting and linking to DeCSS. But it barred the hyperlinks only after 2600 posted them in defiance of an order to remove the code itself. The court found 2600 had posted links with “a desire to bring about the dissemination” of the forbidden code. But noting the First Amendment’s speech protections, the court limited its anti-linking injunction to cases of clear knowing intent to provide circumvention tools. Does leaving a link in place after receiving a demand letter rise to that level of intent? Probably not, but again the outcome is murky.
What if the letter further demands the identities of those who visited the Web site and accessed the alleged contraband? The request creates no obligation to provide this information — and it would disserve users to send it. If you have a privacy policy, you have probably left yourself an out for disclosure “in response to legal obligations,” but make the requester come back with a subpoena, a real legal demand, and notify users so they have a chance to object for themselves. Better yet, don’t keep such logs in the first place. If you don’t have the information, you can’t be compelled to turn it over, and we don’t (yet) have a data retention law requiring storage of any activity logs.
On balance, the legal analysis of host liability for access keys is inconclusive. Hosts wishing to avoid legal risk, or the costs of litigation even if they believe they will ultimately prevail, may choose to remove keys rather than press the issue. Yet there are hazards to sending the lawyer letters as well. As Cory Doctorow has said, more people now know how to break AACS than own high-definition DVD players — thanks to the lawyer-fueled key-spreading. Abundant hosts outside U.S. jurisdiction make it impossible to wipe the code from the Internet, and cease-and-desist letters merely validate the circumvention. Lawyers must consider whether that serves their clients’ best interests. We’re always happy to host their letters on Chilling Effects.
Tips for Web hosts:
1. Not all cease-and-desist letters are alike. Read carefully and compare with examples on ChillingEffects.org (ideally, consult an attorney) before responding. Don’t assume it’s a DMCA notice just because it mentions copyright.
2. Consider sending any lawyer letters you receive to Chilling Effects, where we can annotate them and add to general knowledge and understanding of the threat level.
3. Keep the privacy of your users in mind as well: If you don’t have information, you can’t turn it over, saving yourself the hassle of discovery requests. Don’t log more than you need to, don’t keep it longer than needed — and check the log configuration to see that it’s doing only what you need.
4. Keep your users in the loop. If you’re asked to take down user-posted materials, let the posters know if they have a chance to challenge the request.
5. If you’ve got a truly vexing problem, Chilling Effects or EFF may be able to help you find counsel.
Seltzer is a lawyer, but this is not legal advice. The author is a fellow of the Berkman Center for Internet & Society at Harvard Law School and a visiting fellow at the Oxford Internet Institute. Her e-mail address is wendy@seltzer.org
