11 ms·

IANAL, but as far as I recall, a site receiving a DMCA notice must immediately remove the stated content. The person who put the content up may then file a coun

by Bjartr 6y ago

IANAL, but as far as I recall, a site receiving a DMCA notice must immediately remove the stated content. The person who put the content up may then file a counter-notice, which, if uncontested may then be followed by reinstating the content. If contested, the process moves into the courtroom.

deelowe 6y ago
Correct. A company cannot not comply with a dmca takedown. When the law was written, the supposed safeguard against copyright holders filing tons of frivolous claims is that a counter claim can be pretty serious. Of course history has shown that this didn't work out as planned.
- TheDesolate0 6y ago
  They can not comply if they wish, M$ just doesn't wish it. Plus this is clearly out of scope.
- bawolff 6y ago
  A company is under no obligation to comply with an invalid notice. Wikipedia ignores invalid DMCA requests all the time. It is risky though, as the company opens itself up to a lot of liability if its wrong.
  - mschuster91 6y ago
    wikipedia has the advantage that they can deploy a banner informing people about stuff in an instant. From some googling, back in 2015 Wikipedia had half a billion monthly users - that is massive reachout capability. Anyone daring to put up a fight with Wikipedia risks being flattened by outrage.
sneak 6y ago
What was sent was not a DMCA notice in the standard sense; I encourage you to read it. It’s designed to look like one, but lacks critical elements (such as identifying an infringing URL). The infringement described in their notice is hypothetical, not an actual instance of infringement, which is one of the required things in a DMCA notice. GitHub can indeed leave the repo up, as this notice is insufficient to trigger the part of the DMCA that forces them to remove it. More info from Parker Higgins in a tweet thread: https://twitter.com/xor/status/1319755776043384838 https://twitter.com/xor/status/1319755776043384838
WhyNotHugo 6y ago
That's pretty much it though. In all honesty, we need a GH alternative hosted outside the US, in any place where absurd laws like DMCA don't exist.
- djeiasbsbo 6y ago
  What we really need is a decentralised git forge using something like ActivityPub. We cannot keep relying on companies to host open content for us.
  - fabianhjr 6y ago
    ActivityPub is federated like git is distributed. You can add several remotes from different servers (or peers in case of single user instances hosted at home) Even though other sites like GitLab exist that GitHub remains a near-monopoly default doesn't bode well for attempting to migrate to a completely decentralized system as default. There are decentralized extensions of git (like git-ssb). Addenda: Git is also not well suited for a lot of decentralization due to how branches are modeled. Patch-theory based systems like darcs and pijul would need more adoption before code repositories could be decentralized.
    - djeiasbsbo 6y ago
      I understand that but there is a difference between just git and the forge, which is GitHub in this case. If I fork a project on GitHub it has a fork relationship on the platform itself. This makes it very easy to interact with the original project. However, without an actual GitHub account I can't contribute back to the project at all. If I have for example my own Gitlab server I have the ability to clone a project from GitHub and maintain my fork on my server. However, to contribute back, I will still need to bring my changes back to GitHub first. What a federated implementation of such a "git hosting/collaboration platform" would allow me to do would be to fork a project from another instance to my self-hosted instance. It would benefit every open-source project that would be willing to host their own instance. I could then easily contribute back into the main project without needing an account on their instance. It would also make it much harder to take down a project with a DMCA like this because forks of it would exist across instances, meaning claims would have to be sent to each maintainer of these instances. In this case, they were simply able to list all of the forks on GitHub and because GitHub is one website, all of them were taken down, seemingly without any further inspection wether the claim covers these forks as well. I realise that this is difficult to implement but I think mastodon is a great example of how such federation can work in practice.
fabianhjr 6y ago
This is not a DMCA notice; A DMCA notice requires the identification of claimed copyrighted content and this document does no such thing. The document claims that youtube-dl is illegal for being able to download video and audio from YouTube but not for hosting copyrighted material in the repo or binary distributions. The RIAA is claiming youtube-dl is "circumventing DRM".
- sssarel 6y ago
  They do actually mention 3 specific copyrighted songs used as examples in the tests. Seems to me that was on oversight, and they should have only used open videos as tests in the repo. Similar to how Kodi can't use copyrighted material in app store screenshots or videos.
  - thristian 6y ago
    The tests are testing that youtube-dl can successfully see through three specific varieties of obfuscation as used by those videos. Testing open videos would not work, since Google doesn't obfuscate those in the same way. Uploading special videos with the right configuration wouldn't work, those particular obfuscation methods are only available to specific YouTube partners, not to the youtube-dl authors.
    - bitwize 6y ago
      That just proves that Youtube-dl is intended to circumvent copyright protection measures. Those obfuscation measures count as "effective" for the purposes of the DMCA. Trafficking in software to circumvent them is a felony. GitHub and Microsoft could find themselves criminally liable if they do not take it down.
      - noxer 6y ago
        Take down chrome then its "intended to circumvent copyright protection measures" as you can clearly watch these youtube videos with chrome.
dredmorbius 6y ago
False in this case. The 17 USC (2)(c)(1)(C) safe-harbour protections apply only to hosting of infringing works, and neither youtube-dl nor its test suites infringe on any RIAA or member copyrights as averred in RIAA's notice. https://www.law.cornell.edu/uscode/text/17/512 https://www.law.cornell.edu/uscode/text/17/512 The RIAA's letter does not claim infringement within the text of youtube-dl source or test suites, though it tries hard to appear so, but rather anti-circumvention of a "copyright protection mechanism", under §1201. That is also part of the DMCA, but falls outside the safe-harbour. At best, youtube-dl's test suite may be infringing works when run, in which case infringement would accrue to the operator, presumably a tester or Github's CI/CD process. Even that argument is specious. Given output is discarded, no permanent copy is retained, and the action is for research and development, and numerous Fair Use affirmative defence claims exist under §107, notably (1) and (4), test suite execution falls outside exclusive rights. Any one fair-use test is sufficient, or none at all. Test suite execution could be argued non-infinging under numerous theories, including reverse engineering, research, interoperability, all under §1201, or under general limitations on exclusive rights in §112, §117, or elsewhere. This is where ... things get interesting.... - The "copyright protection scheme" in question, if it even is one, was written by and is provided by Google/Youtube, not the RIAA. - It is not even clear to me the RIAA has standing to sue under §1203: "Any person injured by a violation of section 1201 or 1202 may bring a civil action in an appropriate United States district court for such violation." RIAA are not injured due to utilisation of a non-member's mechanism. - Does not pass the 17 USC 1201 (a)(2)(B) test: "has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title". - Yes, Microsoft / Github may have liability under 17 USC 1201 (a)(2), "offer to the public, provide, or otherwise traffic" the code, subject to the same test above. However there is no safe-harbour provision for such violations. - Microsoft (owner of Github) is listed on the RIAA's members page. Neither Google LLC, its Youtube subsidiary, nor parent Alphabet Inc. are. The RIAA are threatening a member for a §1201 violation against a nonmember. That's ... weird. https://www.riaa.com/about-riaa/riaa-members/ https://www.riaa.com/about-riaa/riaa-members/ - There's an exception in §1201(f)(2) "a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs". - Youtube-dl is executing code as a World Wide Web user agent, provided by Google/YouTube, and meant to be accessed and run by user agents in order to access YouTube content. That is, youtube-dl's operation is entirely within YouTube's technical design and intent. - Any potential copyright infringement which might occur through use of youtube-dl is at the volition of users, not the software's authors, actions would properly be directed at such users for individual acts of infringement, and much of this is subject to the same and other defences listed above. The remaining question is whether or not this claim should be contested. I argue that it should, on numerous grounds; 1. Though the claim is made under US law, similar anti-circ provisions exist in international law, which is highly standardised in large part thanks to the RIAA, MPAA (video), SIIA (software), WIPO, and other copyright monopoly cartels' special-interest deep-pockets lobbying. Offshore legal safe havens are limited and vulnerable. Defence within DMCA /anti-circ / WIPO / Berne regions is unfortunately necessary. Simply hosting the repository outside US jurisdiction is not sufficient, though a valid immediate response. 2. Such claims are specious at best, carry heavy chilling efects, may be entirely fraudulent, and should carry considerable risk. A countersuit agaist RIAA may help make this cartel, or others, think twice about repeating such attempts, as well as establish precedent agaist future such attemps. 3. The future of software, to which Microsoft claims to have harnessed its own wagon, is open, collaborative, Free Software. As such, the software and information services industry's interests diverge from those of regressive copyright maximalists. TL;DR: This is not a 17 USC 512 infringement/safe-harbour, RIAA's standing is highly questionable, it is threatening a member for an averred nonmember's §1201 injury, any actual works duplication is not performed by youtube-dl's developers directly, nor is the work itself or its test suite an infringement of RIAA / members copyrights, and numerous defences exist for routine use or incidental transmission or copies made by others. Further, youtube-dl, digital and information liberties groups, Microsoft, and Google/Youtube should fight the RIAA's claim.
toyg 6y ago
The law says “expeditiously”, not immediately. This gives a degree of flexibility to judge the basic elements of the claim, which they clearly did not do here (as others have pointed out, this does not look like a valid request).
nullc 6y ago
> notice must immediately No, at most-- they lose a safe harbour if the notice was well formed and properly delivered, and they don't follow the procedure. But the vast majority of notices are not well formed or properly delivered. And loss of the safe harbour isn't particularly important if the complaint is bogus to begin with. Sure, it does mean a slightly increased risk of legal costs-- though anyone can sue github at any time regardless-- but ultimately those sorts of risks are business decisions that have to be weighed against other business costs and benefits. Github has historically been pretty unusual in its degree of following the DMCA takedown requirements, a lot of other places are a LOT more willing to ignore apparently spurious DMCA complaints than Github has been. I had hoped that this would change with the Microsoft acquisition, because maybe before their position was just that they couldn't afford any legal fights... but it doesn't seem to have been.

by Bjartr 6y ago

deelowe 6y ago

Correct. A company cannot not comply with a dmca takedown. When the law was written, the supposed safeguard against copyright holders filing tons of frivolous claims is that a counter claim can be pretty serious. Of course history has shown that this didn't work out as planned.

TheDesolate0 6y ago
They can not comply if they wish, M$ just doesn't wish it. Plus this is clearly out of scope.
bawolff 6y ago
A company is under no obligation to comply with an invalid notice. Wikipedia ignores invalid DMCA requests all the time. It is risky though, as the company opens itself up to a lot of liability if its wrong.
- mschuster91 6y ago
  wikipedia has the advantage that they can deploy a banner informing people about stuff in an instant. From some googling, back in 2015 Wikipedia had half a billion monthly users - that is massive reachout capability. Anyone daring to put up a fight with Wikipedia risks being flattened by outrage.

sneak 6y ago

What was sent was not a DMCA notice in the standard sense; I encourage you to read it. It’s designed to look like one, but lacks critical elements (such as identifying an infringing URL). The infringement described in their notice is hypothetical, not an actual instance of infringement, which is one of the required things in a DMCA notice. GitHub can indeed leave the repo up, as this notice is insufficient to trigger the part of the DMCA that forces them to remove it. More info from Parker Higgins in a tweet thread: https://twitter.com/xor/status/1319755776043384838 https://twitter.com/xor/status/1319755776043384838

WhyNotHugo 6y ago

That's pretty much it though. In all honesty, we need a GH alternative hosted outside the US, in any place where absurd laws like DMCA don't exist.

djeiasbsbo 6y ago
What we really need is a decentralised git forge using something like ActivityPub. We cannot keep relying on companies to host open content for us.
- fabianhjr 6y ago
  ActivityPub is federated like git is distributed. You can add several remotes from different servers (or peers in case of single user instances hosted at home) Even though other sites like GitLab exist that GitHub remains a near-monopoly default doesn't bode well for attempting to migrate to a completely decentralized system as default. There are decentralized extensions of git (like git-ssb). Addenda: Git is also not well suited for a lot of decentralization due to how branches are modeled. Patch-theory based systems like darcs and pijul would need more adoption before code repositories could be decentralized.
  - djeiasbsbo 6y ago
    I understand that but there is a difference between just git and the forge, which is GitHub in this case. If I fork a project on GitHub it has a fork relationship on the platform itself. This makes it very easy to interact with the original project. However, without an actual GitHub account I can't contribute back to the project at all. If I have for example my own Gitlab server I have the ability to clone a project from GitHub and maintain my fork on my server. However, to contribute back, I will still need to bring my changes back to GitHub first. What a federated implementation of such a "git hosting/collaboration platform" would allow me to do would be to fork a project from another instance to my self-hosted instance. It would benefit every open-source project that would be willing to host their own instance. I could then easily contribute back into the main project without needing an account on their instance. It would also make it much harder to take down a project with a DMCA like this because forks of it would exist across instances, meaning claims would have to be sent to each maintainer of these instances. In this case, they were simply able to list all of the forks on GitHub and because GitHub is one website, all of them were taken down, seemingly without any further inspection wether the claim covers these forks as well. I realise that this is difficult to implement but I think mastodon is a great example of how such federation can work in practice.

fabianhjr 6y ago

This is not a DMCA notice; A DMCA notice requires the identification of claimed copyrighted content and this document does no such thing. The document claims that youtube-dl is illegal for being able to download video and audio from YouTube but not for hosting copyrighted material in the repo or binary distributions. The RIAA is claiming youtube-dl is "circumventing DRM".

sssarel 6y ago
They do actually mention 3 specific copyrighted songs used as examples in the tests. Seems to me that was on oversight, and they should have only used open videos as tests in the repo. Similar to how Kodi can't use copyrighted material in app store screenshots or videos.
- thristian 6y ago
  The tests are testing that youtube-dl can successfully see through three specific varieties of obfuscation as used by those videos. Testing open videos would not work, since Google doesn't obfuscate those in the same way. Uploading special videos with the right configuration wouldn't work, those particular obfuscation methods are only available to specific YouTube partners, not to the youtube-dl authors.
  - bitwize 6y ago
    That just proves that Youtube-dl is intended to circumvent copyright protection measures. Those obfuscation measures count as "effective" for the purposes of the DMCA. Trafficking in software to circumvent them is a felony. GitHub and Microsoft could find themselves criminally liable if they do not take it down.
    - noxer 6y ago
      Take down chrome then its "intended to circumvent copyright protection measures" as you can clearly watch these youtube videos with chrome.

dredmorbius 6y ago

False in this case. The 17 USC (2)(c)(1)(C) safe-harbour protections apply only to hosting of infringing works, and neither youtube-dl nor its test suites infringe on any RIAA or member copyrights as averred in RIAA's notice. https://www.law.cornell.edu/uscode/text/17/512 https://www.law.cornell.edu/uscode/text/17/512 The RIAA's letter does not claim infringement within the text of youtube-dl source or test suites, though it tries hard to appear so, but rather anti-circumvention of a "copyright protection mechanism", under §1201. That is also part of the DMCA, but falls outside the safe-harbour. At best, youtube-dl's test suite may be infringing works when run, in which case infringement would accrue to the operator, presumably a tester or Github's CI/CD process. Even that argument is specious. Given output is discarded, no permanent copy is retained, and the action is for research and development, and numerous Fair Use affirmative defence claims exist under §107, notably (1) and (4), test suite execution falls outside exclusive rights. Any one fair-use test is sufficient, or none at all. Test suite execution could be argued non-infinging under numerous theories, including reverse engineering, research, interoperability, all under §1201, or under general limitations on exclusive rights in §112, §117, or elsewhere. This is where ... things get interesting.... - The "copyright protection scheme" in question, if it even is one, was written by and is provided by Google/Youtube, not the RIAA. - It is not even clear to me the RIAA has standing to sue under §1203: "Any person injured by a violation of section 1201 or 1202 may bring a civil action in an appropriate United States district court for such violation." RIAA are not injured due to utilisation of a non-member's mechanism. - Does not pass the 17 USC 1201 (a)(2)(B) test: "has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title". - Yes, Microsoft / Github may have liability under 17 USC 1201 (a)(2), "offer to the public, provide, or otherwise traffic" the code, subject to the same test above. However there is no safe-harbour provision for such violations. - Microsoft (owner of Github) is listed on the RIAA's members page. Neither Google LLC, its Youtube subsidiary, nor parent Alphabet Inc. are. The RIAA are threatening a member for a §1201 violation against a nonmember. That's ... weird. https://www.riaa.com/about-riaa/riaa-members/ https://www.riaa.com/about-riaa/riaa-members/ - There's an exception in §1201(f)(2) "a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs". - Youtube-dl is executing code as a World Wide Web user agent, provided by Google/YouTube, and meant to be accessed and run by user agents in order to access YouTube content. That is, youtube-dl's operation is entirely within YouTube's technical design and intent. - Any potential copyright infringement which might occur through use of youtube-dl is at the volition of users, not the software's authors, actions would properly be directed at such users for individual acts of infringement, and much of this is subject to the same and other defences listed above. The remaining question is whether or not this claim should be contested. I argue that it should, on numerous grounds; 1. Though the claim is made under US law, similar anti-circ provisions exist in international law, which is highly standardised in large part thanks to the RIAA, MPAA (video), SIIA (software), WIPO, and other copyright monopoly cartels' special-interest deep-pockets lobbying. Offshore legal safe havens are limited and vulnerable. Defence within DMCA /anti-circ / WIPO / Berne regions is unfortunately necessary. Simply hosting the repository outside US jurisdiction is not sufficient, though a valid immediate response. 2. Such claims are specious at best, carry heavy chilling efects, may be entirely fraudulent, and should carry considerable risk. A countersuit agaist RIAA may help make this cartel, or others, think twice about repeating such attempts, as well as establish precedent agaist future such attemps. 3. The future of software, to which Microsoft claims to have harnessed its own wagon, is open, collaborative, Free Software. As such, the software and information services industry's interests diverge from those of regressive copyright maximalists. TL;DR: This is not a 17 USC 512 infringement/safe-harbour, RIAA's standing is highly questionable, it is threatening a member for an averred nonmember's §1201 injury, any actual works duplication is not performed by youtube-dl's developers directly, nor is the work itself or its test suite an infringement of RIAA / members copyrights, and numerous defences exist for routine use or incidental transmission or copies made by others. Further, youtube-dl, digital and information liberties groups, Microsoft, and Google/Youtube should fight the RIAA's claim.

toyg 6y ago

The law says “expeditiously”, not immediately. This gives a degree of flexibility to judge the basic elements of the claim, which they clearly did not do here (as others have pointed out, this does not look like a valid request).

nullc 6y ago

> notice must immediately No, at most-- they lose a safe harbour if the notice was well formed and properly delivered, and they don't follow the procedure. But the vast majority of notices are not well formed or properly delivered. And loss of the safe harbour isn't particularly important if the complaint is bogus to begin with. Sure, it does mean a slightly increased risk of legal costs-- though anyone can sue github at any time regardless-- but ultimately those sorts of risks are business decisions that have to be weighed against other business costs and benefits. Github has historically been pretty unusual in its degree of following the DMCA takedown requirements, a lot of other places are a LOT more willing to ignore apparently spurious DMCA complaints than Github has been. I had hoped that this would change with the Microsoft acquisition, because maybe before their position was just that they couldn't afford any legal fights... but it doesn't seem to have been.