12 ms·

How Bungie identified a mass sender of fake DMCA notices

417 points by perihelions 4y ago

dylan604 4y ago
Gotta love stupid criminals. "Nope, nobody will ever figure out my anonymity shield of multiple GMail accounts" I'd really hope this might shed a light on YouTube's ludicrous policies, but no, it will not do anything towards that.
- judge2020 4y ago
  All claims in this process dealt with the DMCA system, not the Content ID system, and YT handled it in the only way they legally can throughout the entire process.
  - dangrossman 4y ago
    The safe harbor provisions of the DMCA are a carrot, not a stick. They do not impose any responsibilities upon YT, they only provide benefits should YT voluntarily respond to complaints in a specific way. YT does not accept every DMCA complaint at face value, and they aren't required to.
    - bityard 4y ago
      YouTube goes FAR beyond what the DMCA requires, they actively filter EVERY video through a data lake of fingerprints for copyrighted music/video and this process biases HEAVILY toward false positives. It not only takes down videos cases of accidental infringement (e.g. a vlogger walking past a radio in public) but also suffers from well-documented cases of just plain getting it wrong. Musicians often get their own music taken down, even when it contains no samples. Many content creators have fallen back to playing NO music at all in their videos, and they still get hit by it. YouTube has been silent on the matter, not to mention on how that's even possible. The algorithm is so effective that police have taken to playing loud copyrighted music when engaging in actions that they don't want spread via social media. At this point, it's getting hard to ascribe the awfulness of the fingerprint-driven auto-takedowns as mere incompetence.
      - judge2020 4y ago
        That's called Content ID and was created in response to Viacom dragging YT through court for not preemptively stopping people from uploading episodes of Spongebob. Viacom was planning to take it further up the appeal process until a settlement was reached, almost certainly with the goal being "you upload your copyrighted material and we'll automatically scan every video upload to remove it". Of course, other copyright holders weren't going to let Viacom have all the fun, so YT expanded it to allow any big-name rights management firm or copyright holder to use the system. https://en.wikipedia.org/wiki/Viacom_International_Inc._v._YouTube,_Inc https://en.wikipedia.org/wiki/Viacom_International_Inc._v._Y.... Despite this, everything mentioned in the torrentfreak article was handled under the official DMCA process, and they handled it as they should have, as they disabled access to all videos immediately until the counter-notice was posted by the claimee. Eventually they started asking the user for proof of identity after they suspected he didn't represent Bungie, but that's not a requirement in the DMCA process. Separately, YT does often go to bat for its creators if/when they suspect supposedly infringing content is actually protected under fair use, eg. recently when "Vantage Media" was trying to take down all footage of the trailers for Kevin Spacey's new movie, Peter Five-Eight[1]. This is still only wrt DMCA, as Content ID is designed to allow rights management companies to control their content on YT entirely (with no regard for fair use, on purpose) as YouTube doesn't want to get on the bad side of their partners in the Music (YouTube Music[2][3]) and TV/Sports (YouTube TV) space. 1: https://youtu.be/aY1CYF3MKec?t=27 https://youtu.be/aY1CYF3MKec?t=27 2: https://variety.com/2017/biz/news/warner-music-extends-youtube-1202410931/ https://variety.com/2017/biz/news/warner-music-extends-youtu... 3: https://www.theverge.com/2017/12/19/16796058/youtube-universal-music-group-sony-agreement-royalties https://www.theverge.com/2017/12/19/16796058/youtube-univers...
- aliswe 4y ago
  I would class him as a lone possibly mentally unstable sad individual rather than a criminal.
prox 4y ago
I know this forum is about curious conversation, but in this case, fuck Google and the system it uses. It’s overreaching and again the classic “you don’t talk to humans Google, unless you are a rich or famous company/person.”
- kevinh 4y ago
  The system YouTube uses backs up onto the DMCA. If you submit a copyright counter notice, the claimant needs to engage in legal action within a certain amount of time or YT will reinstate the video. https://support.google.com/youtube/answer/2807684 https://support.google.com/youtube/answer/2807684
  - Forgeties79 4y ago
    During which the content creator misses out on revenue, much of which they often can’t recoup because the content may not be evergreen. If I release a video about election results during an election and it takes weeks - hell let’s be generous and say 72 hours - to go out because of a bogus DMCA claim, that’s a huge financial loss for me. 90 days? No way. In the world of online content creation that’s a death sentence. That’s not even remotely a solution.
    - tyingq 4y ago
      And the entity filing the false claims is free to spawn a few extra corporate identities if they like and keep your videos in limbo.
      - Forgeties79 4y ago
        This is one of the few things Vimeo (at least used to, it’s been a while since it happened to me) does right. I got a notice that I used licensed music and they took my video down, I appealed and my video immediately went back up during the appeal process. This all took place within about half an hour of my posting it. I sent them the email showing the artist gave me permission, and a few days later the notice was lifted. All through this process my video was only down for about 15min. For YouTube: Freeze the transfer of the revenue on that one video until it’s resolved but keep the video up and let it still collect revenue. It’s not great if you depend on the income but it’s a hell of a lot better than losing the income entirely. This solution is much better, if still imperfect.
danuker 4y ago
> Google initially refused to comply but after some work, Bungie started getting the information it was looking for earlier this month. Yet another example of justice for me, but not for thee. A smaller content creator might not have even overturned a false DMCA claim, let alone get information about the copyright troll submitting it.
- judge2020 4y ago
  > A smaller content creator might not have even overturned a false DMCA claim In the YouTube DMCA process, they always, 100% restore your video if you submit a DMCA counterclaim. It'll only stay down if the claimant informs YouTube they are pursuing a lawsuit against you. > let alone get information about the copyright troll submitting it. You receive the full information of the copyright holder if you receive a DMCA takedown. You obviously don't get IP log information unless you subpoena Google, though.
  - deleted 4y ago
    [deleted]
  - devrand 4y ago
    > You receive the full information of the copyright holder if you receive a DMCA takedown. That’s not exactly helpful if it’s a fraudulent claim.
- vageli 4y ago
  What is "after some work" here alluding to (I know it's verbatim from the article but very cryptic)? Can Google arbitrarily share account details with anyone who asks without a subpoena? Does that not violate even their own ToS?
  - waiwai933 4y ago
    The First Amended Complaint linked in the article indicates that Google required a subpoena (paragraphs 112-114) and were unwilling/unable to provide information informally.
sorokod 4y ago
So like swatting with Google in the role of incompetent and heavily armed police?
- rahNae7o 4y ago
  Can't accuse them of being incompetent if the law requires them to behave this way.
  - mehlmao 4y ago
    The law doesn't require them to behave this way. They have implemented their own system that is more draconian than the DMCA so they don't have to deal with entertainment industry lawyers.
    - KennyBlanken 4y ago
      It's not so they have to deal with entertainment industry lawyers, it's to minimize the labor costs of compliance.
      - noptd 4y ago
        Or more likely - all of the above.
  - sorokod 4y ago
    Well, law enforcement agencies are required to take reports of violent crimes seriously. I think that the analogy holds.
silisili 4y ago
Can anyone explain the below? Did he DMCA strike himself, and then get angry about it? Or am I reading something wrong... > The clickable emblem link was sent to PerfectNazo1@gmail.com and during the chaos of fake notice campaign, a YouTuber called ‘Lord Nazo’ was hit with fraudulent DMCA notice, sent by the Wiland Google account. > Apparently angered by this injustice, Lord Nazo fired a DMCA counternotice back at YouTube in which he criticized the wave of fake notices and claimed his video was not infringing since it was a “transformative case of fair use.”
- AceJohnny2 4y ago
  He got legitimately DMCA stricken, then he manufactured a campaign of illegitimate DMCA strikes and hoped he could get his own strike overturned as part of the reversal of illegitimate strikes.
  - squarefoot 4y ago
    And that idiot revenge campaign served him with over $7M in damages. Assuming he can't pay even a fraction of that amount, what is going to happen to this genius? Will he land in jail for some time? I have mixed feelings about this however: pretty sure that if they inverted the roles, that is, it was the big company that sent bogus DMCA take down requests, the outcome wouldn't change: the small fish would still be eaten.
    - nobody9999 4y ago
      >And that idiot revenge campaign served him with over $7M in damages. Assuming he can't pay even a fraction of that amount, what is going to happen to this genius? Will he land in jail for some time? Thankfully, we don't have explicit (although there's plenty of incarcerated folks who wouldn't spend a day in jail if they had enough money to fight whatever bullshit charges are brought against them) debtor's prisons, so probably not.
      - thfuran 4y ago
        But isn't filing a false DMCA takedown in and of itself illegal, beyond any civil damages caused? Edit: Okay, the filing requires asserting "under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly in-fringed." But I'm not sure whether anyone has ever been prosecuted for perjury for something like this. It's seemingly generally resolved only by suing for damages.
pyrolistical 4y ago
Is part of the story missing on how google eventually accepted the fake dmca requests? Seems like at some point google slipped up or else this wouldn’t have gotten so out of hand
- spondyl 4y ago
  > Is part of the story missing on how google eventually accepted the fake dmca requests? There isn't really a story here. YouTube just kind of blindly accepts any and all DMCAs regardless of whether the claimant has legitimate ownership or not. Here's an excerpt from the court filing: > Ninety-six separate times, Minor used his fake “CSC” Gmail addresses to exploit the hole in YouTube’s DMCA-process security that allows anyone at all to claim to be representing a rights holder for purposes of issuing a takedown, with no real safeguards against fraud. I'd note that they refer to it as "the" hole https://www.pcworld.co.nz/article/483729/google_submission_hammers_section_92a/ https://www.pcworld.co.nz/article/483729/google_submission_h... > In its submission, Google notes that more than half (57%) of the takedown notices it has received under the US Digital Millennium Copyright Act 1998, were sent by business targeting competitors and over one third (37%) of notices were not valid copyright claims.
  - cowvin 4y ago
    wow 57% and 37% are awful. it's almost as if the system shouldn't be automated.
  - tadfisher 4y ago
    That is what is required under the DMCA, though. YouTube must remove content immediately after receiving a notice, under penalty of losing safe-harbor privileges. In turn, the claimant must represent themselves as the copyright holder or their agent, and the content must be infringing, under penalty of liability for the accused's costs and attorney fees. The law does not make a provision for YouTube to reject bogus claims.
    - Dylan16807 4y ago
      If it's a bogus claim then they don't need safe harbor for it...
spondyl 4y ago
Does anyone else have any other interesting court case filings to share, off the top of their head, that documents the evidence trail used to unmask litigants?
- ajsfoux234 4y ago
  This doesn't have much of an 'evidence trail' but I thought last year's court filing about the Maryland nuclear engineer was interesting: https://www.justice.gov/opa/pr/maryland-nuclear-engineer-and-spouse-arrested-espionage-related-charges https://www.justice.gov/opa/pr/maryland-nuclear-engineer-and... (click on the "Download Toebbe Complaint" link to see the full PDF)
- walrus01 4y ago
  not on the topic of unmasking anyone, but the judgment on Meads v. Meads is required reading on the topic of what's going on now with "sovereign citizens / freeman on the land", an increasingly common thing. https://www.canlii.org/en/ab/abqb/doc/2012/2012abqb571/2012abqb571.html https://www.canlii.org/en/ab/abqb/doc/2012/2012abqb571/2012a...
system2 4y ago
You have to be a true imbecile to pull this type of stuff without spoofing your IP and keep using the same email addresses created by the same address. This person must be a kid.
- colinmhayes 4y ago
  His name is even nick minor
onlyusername 4y ago
Here is a long-ish Tom Scott video related to YouTube's (or rather the Internet's) broken copyright system: https://www.youtube.com/watch?v=1Jwo5qc78QU https://www.youtube.com/watch?v=1Jwo5qc78QU
bzzli 4y ago
Here's a link to the complaint: https://storage.courtlistener.com/recap/gov.uscourts.wawd.308508/gov.uscourts.wawd.308508.19.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.wawd.30...
woojoo666 4y ago
A side note that I found particularly interesting > On March 22, the Reynolds account logged out of Google and less than a second later, the Wiland account logged in, suggesting the same person was behind both accounts. I've always wondered how often timing analysis is used in practice by surveillence big tech. I suspect that as people become more privacy aware, and start using VPNs, pseudonames, multiple accounts, etc, that big tech will start using timing analysis more and more to correlate traffic and identify users. Like if your friend sends you a Reddit link on WhatsApp, and you immediately open it in your browser, that Reddit session is now linked to you. Another more complex example: let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing of when your Reddit account opened the discussion, and when the linked Youtube video was accessed. And not just that video, but now every Youtube video watched in the same browsing session, is now linked back to you (assuming you have first-party cookies enabled, which is basically required if you ever want to log into anything). Seems a bit paranoid, but I actually suspect this happened to me a few months ago. I was using a FOSS reddit client and clicked a youtube link buried deep in a reddit thread, and opened it in Newpipe (a FOSS youtube client). I wasn't logged in, and was using a VPN, and yet the next day on my Youtube feed I started getting recommendations based on that video (and those recommendations were very different from my usual ones). Scary stuff.
- walrus01 4y ago
  > I've always wondered how often timing analysis is used in practice by surveillence big tech Books written about the NSA, GCHQ, CSE etc talk about them using things like timestamp logs/traffic analysis/time of day analyzing commercial and government telecom links going back to the 1960s, so in the modern era even if your crypto is absolutely unbreakable, there's a huge amount of analysis and correlation that can be done based on timing analysis. Then you combine your timing analysis with things like correlating geolocation of blocks of IP addresses, netflow and traffic analysis, metadata obtained from other adjacent/nearby users on same ISPs at either end, a whole fire hose of other data that's still useful even if the crypto is solid. > let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing Not just timing but also cookies, client device/browser fingerprinting, IP address/what ISP you're on, and the usage patterns and logged in activity (and app-collected telemetry data on android and ios devices) of all the other persons in your household and neighbors.
unyttigfjelltol 4y ago
The article buried the lede, which I think is this-- Google as email provider had information all along that DMCA notices it was sending to its YouTube property were not legitimate. Google even went so far as to flag and reject some of those notices because of false personalities, but instead of going to the root cause to stop abuse of its systems it allowed the same user to plug along long enough to manipulate YouTube in a way that caused Bungie an alleged $7.6m in damages. Then the icing is that when Bungie came knocking Google initially resisted a court-related request to allow Bungie to identify the user and stop the abuse. Wow.
- cyanydeez 4y ago
  Back a decade ago, century link kept disabling my isdn line based of spammed dmca takedowns. I wrote them several letters demanding proof, even pointing that their abuse form was entirely open to anyone and asking for any substantive proof. It took them a third time to actually send some printouts which amounted to again random spammer on their dmca form. They "solved" the problem by firewalling connections and a lame gateway asking you to admit to whatever.
- jonas21 4y ago
  > Then the icing is that when Bungie came knocking Google initially resisted a court-related request to allow Bungie to identify the user and stop the abuse. Wow. A big corporation came asking for data on an individual GMail user, and Google told them, "we're not giving that to you without a proper subpoena." That's exactly what you want your email provider to do.
  - tinco 4y ago
    Maybe, but that's not the point. It's not about the owner of the Gmail account, it's about the identity of whoever sent the DMCA request. Google should have had more than just an email, should have verified at least a registered company or domain or trademark, and should have willingly gave up the verified contact information to anyone who asks.
    - 4y ago
hueyluey 4y ago
Maybe this is a way to do anti DMCA activism? You send thousands of takedown notices to big companies until they realize that's it a stupid system?
- jeroenhd 4y ago
  This seems like an excellent way to respond to companies abusing the DMCA, like Nintendo and Hackerrank.
javajosh 4y ago
My understanding is that if you wanted to hurt a YouTube channel, you could do so like this 1. Use a VPN create a gmail address. 2. Use that address to file a DMCA notice on each channel video. 3. Google auto-accepts; the channel challenges each notice. 4. You deny all challenges. And just like that, you can destroy any YouTube channel, without any accountability. Is this correct?
- lifeformed 4y ago
  You also have to provide some personal information to file a request, like phone number, name, address.
  - javajosh 4y ago
    But it isn't verified by Google. Is it given to the channel? Do they have any recourse if they determine it's fake?
    - jimmydorry 4y ago
      I'm not sure about Google in particular, but typically the service provider will pass along the information and tell the parties to settle in court. They will also keep the reported material down until either party forwards them the outcome of the court case.
      - javajosh 4y ago
        Sure, but doesn't Google assume the DMCA notice is valid unless proven otherwise? If that is the case, time is on the attackers side, and won't affect the attack too much.
- smotched 4y ago
  failed at 1, you cannot create a gmail account with a VPN (unless you want to verify by phone)
  - 4y ago
nikolqy 4y ago
That's actually wildly hilarious in a way. Pretty creative way of attacking businesses. Probably more creative than something I could come up with. Copyright is way too strict though. It's ridiculous that this is even possible, to an extent.
- KennyBlanken 4y ago
  Weaponizing Google's lack of customer service is in fact pretty creative. The "exploit" here is that Google really doesn't care in the slightest about fraudulent DMCA takedowns - it's expensive labor-wise to handle it. Doing it from your home internet connection, less creative...
xbmcuser 4y ago
Its funny how people are siding with Bungie that Google should have given them the details but these same people complain about google knowing too much about them and its privacy implications. From the looks of it Google did the right thing where it comes to siloing data of different departments. Youtube dmca should not know the ip address of someone that send the email using gmail that is the correct way to go about it.
Chio 4y ago
This is an interesting lawsuit as it is a *company* seeking damages due to DMCA abuse by a third party, and my understanding is that this is very widespread (no source sorry). Is anyone aware of any studies done on the total cost¹ (vs benefit¹) of the DMCA due to malicious actors? ¹ defining what is a cost vs benefit (and how much) is probably the hardest part, maybe after acquiring the necessary data.
redm 4y ago
This is highly overlooked “The company tried to subpoena Google using the DMCA but the chosen mechanism only allowed Bungie to identify an alleged copyright infringer, not the sender of allegedly abusive DMCA notices.” We have been the recipient of many invalid notices to Google. Google publishes the details via Lumen but makes it impossible to reasonably analyze the data. 1) They hide the sender info. 2) They make you validate, via email, for EACH DMCA you want to view. In other words, they claim transparency, but practical use isn't possible. They also don’t publish DMCA’s against sites like YouTube.
mola 4y ago
This should've been a story that shows how dangerous and ridiculous DMCA is. Instead we see copyright owners double-down on the legal bullying. Bah
superkuh 4y ago
What stands out most here is that the youtube video creator behind the "fake" DMCA notices was himself hit by a fraudulent DMCA notice. It seems like he was only trying to bring attention to the completely broken system. I see this more as a political protest than anything else. But if you rock the boat you're going to get hit.
- s28l 4y ago
  My understanding of the article was that the perpetrator was hit with a genuine DMCA notice that he was upset about. It seemed his plan was to generate these fake notices with the hope that they'd be noticed and rolled back, and in the confusion, he could get his notice rescinded as well.
  - superkuh 4y ago
    It was from a company with the legal right to do so but it was still abusive and not an appropriate or legal use of the DMCA. The only difference from his 'fake' DMCA claims was having a legal connection to the rightsholders. But the DMCA claim he experienced and the ones he sent out were all fake and abusive.

417 points by perihelions 4y ago

Gotta love stupid criminals. "Nope, nobody will ever figure out my anonymity shield of multiple GMail accounts" I'd really hope this might shed a light on YouTube's ludicrous policies, but no, it will not do anything towards that.

judge2020 4y ago
All claims in this process dealt with the DMCA system, not the Content ID system, and YT handled it in the only way they legally can throughout the entire process.
- dangrossman 4y ago
  The safe harbor provisions of the DMCA are a carrot, not a stick. They do not impose any responsibilities upon YT, they only provide benefits should YT voluntarily respond to complaints in a specific way. YT does not accept every DMCA complaint at face value, and they aren't required to.
  - bityard 4y ago
    YouTube goes FAR beyond what the DMCA requires, they actively filter EVERY video through a data lake of fingerprints for copyrighted music/video and this process biases HEAVILY toward false positives. It not only takes down videos cases of accidental infringement (e.g. a vlogger walking past a radio in public) but also suffers from well-documented cases of just plain getting it wrong. Musicians often get their own music taken down, even when it contains no samples. Many content creators have fallen back to playing NO music at all in their videos, and they still get hit by it. YouTube has been silent on the matter, not to mention on how that's even possible. The algorithm is so effective that police have taken to playing loud copyrighted music when engaging in actions that they don't want spread via social media. At this point, it's getting hard to ascribe the awfulness of the fingerprint-driven auto-takedowns as mere incompetence.
    - judge2020 4y ago
      That's called Content ID and was created in response to Viacom dragging YT through court for not preemptively stopping people from uploading episodes of Spongebob. Viacom was planning to take it further up the appeal process until a settlement was reached, almost certainly with the goal being "you upload your copyrighted material and we'll automatically scan every video upload to remove it". Of course, other copyright holders weren't going to let Viacom have all the fun, so YT expanded it to allow any big-name rights management firm or copyright holder to use the system. https://en.wikipedia.org/wiki/Viacom_International_Inc._v._YouTube,_Inc https://en.wikipedia.org/wiki/Viacom_International_Inc._v._Y.... Despite this, everything mentioned in the torrentfreak article was handled under the official DMCA process, and they handled it as they should have, as they disabled access to all videos immediately until the counter-notice was posted by the claimee. Eventually they started asking the user for proof of identity after they suspected he didn't represent Bungie, but that's not a requirement in the DMCA process. Separately, YT does often go to bat for its creators if/when they suspect supposedly infringing content is actually protected under fair use, eg. recently when "Vantage Media" was trying to take down all footage of the trailers for Kevin Spacey's new movie, Peter Five-Eight[1]. This is still only wrt DMCA, as Content ID is designed to allow rights management companies to control their content on YT entirely (with no regard for fair use, on purpose) as YouTube doesn't want to get on the bad side of their partners in the Music (YouTube Music[2][3]) and TV/Sports (YouTube TV) space. 1: https://youtu.be/aY1CYF3MKec?t=27 https://youtu.be/aY1CYF3MKec?t=27 2: https://variety.com/2017/biz/news/warner-music-extends-youtube-1202410931/ https://variety.com/2017/biz/news/warner-music-extends-youtu... 3: https://www.theverge.com/2017/12/19/16796058/youtube-universal-music-group-sony-agreement-royalties https://www.theverge.com/2017/12/19/16796058/youtube-univers...
aliswe 4y ago
I would class him as a lone possibly mentally unstable sad individual rather than a criminal.

prox 4y ago

I know this forum is about curious conversation, but in this case, fuck Google and the system it uses. It’s overreaching and again the classic “you don’t talk to humans Google, unless you are a rich or famous company/person.”

kevinh 4y ago
The system YouTube uses backs up onto the DMCA. If you submit a copyright counter notice, the claimant needs to engage in legal action within a certain amount of time or YT will reinstate the video. https://support.google.com/youtube/answer/2807684 https://support.google.com/youtube/answer/2807684
- Forgeties79 4y ago
  During which the content creator misses out on revenue, much of which they often can’t recoup because the content may not be evergreen. If I release a video about election results during an election and it takes weeks - hell let’s be generous and say 72 hours - to go out because of a bogus DMCA claim, that’s a huge financial loss for me. 90 days? No way. In the world of online content creation that’s a death sentence. That’s not even remotely a solution.
  - tyingq 4y ago
    And the entity filing the false claims is free to spawn a few extra corporate identities if they like and keep your videos in limbo.
    - Forgeties79 4y ago
      This is one of the few things Vimeo (at least used to, it’s been a while since it happened to me) does right. I got a notice that I used licensed music and they took my video down, I appealed and my video immediately went back up during the appeal process. This all took place within about half an hour of my posting it. I sent them the email showing the artist gave me permission, and a few days later the notice was lifted. All through this process my video was only down for about 15min. For YouTube: Freeze the transfer of the revenue on that one video until it’s resolved but keep the video up and let it still collect revenue. It’s not great if you depend on the income but it’s a hell of a lot better than losing the income entirely. This solution is much better, if still imperfect.

danuker 4y ago

> Google initially refused to comply but after some work, Bungie started getting the information it was looking for earlier this month. Yet another example of justice for me, but not for thee. A smaller content creator might not have even overturned a false DMCA claim, let alone get information about the copyright troll submitting it.

judge2020 4y ago
> A smaller content creator might not have even overturned a false DMCA claim In the YouTube DMCA process, they always, 100% restore your video if you submit a DMCA counterclaim. It'll only stay down if the claimant informs YouTube they are pursuing a lawsuit against you. > let alone get information about the copyright troll submitting it. You receive the full information of the copyright holder if you receive a DMCA takedown. You obviously don't get IP log information unless you subpoena Google, though.
- deleted 4y ago
  [deleted]
- devrand 4y ago
  > You receive the full information of the copyright holder if you receive a DMCA takedown. That’s not exactly helpful if it’s a fraudulent claim.
vageli 4y ago
What is "after some work" here alluding to (I know it's verbatim from the article but very cryptic)? Can Google arbitrarily share account details with anyone who asks without a subpoena? Does that not violate even their own ToS?
- waiwai933 4y ago
  The First Amended Complaint linked in the article indicates that Google required a subpoena (paragraphs 112-114) and were unwilling/unable to provide information informally.

sorokod 4y ago

So like swatting with Google in the role of incompetent and heavily armed police?

rahNae7o 4y ago
Can't accuse them of being incompetent if the law requires them to behave this way.
- mehlmao 4y ago
  The law doesn't require them to behave this way. They have implemented their own system that is more draconian than the DMCA so they don't have to deal with entertainment industry lawyers.
  - KennyBlanken 4y ago
    It's not so they have to deal with entertainment industry lawyers, it's to minimize the labor costs of compliance.
    - noptd 4y ago
      Or more likely - all of the above.
- sorokod 4y ago
  Well, law enforcement agencies are required to take reports of violent crimes seriously. I think that the analogy holds.

silisili 4y ago

Can anyone explain the below? Did he DMCA strike himself, and then get angry about it? Or am I reading something wrong... > The clickable emblem link was sent to PerfectNazo1@gmail.com and during the chaos of fake notice campaign, a YouTuber called ‘Lord Nazo’ was hit with fraudulent DMCA notice, sent by the Wiland Google account. > Apparently angered by this injustice, Lord Nazo fired a DMCA counternotice back at YouTube in which he criticized the wave of fake notices and claimed his video was not infringing since it was a “transformative case of fair use.”

AceJohnny2 4y ago
He got legitimately DMCA stricken, then he manufactured a campaign of illegitimate DMCA strikes and hoped he could get his own strike overturned as part of the reversal of illegitimate strikes.
- squarefoot 4y ago
  And that idiot revenge campaign served him with over $7M in damages. Assuming he can't pay even a fraction of that amount, what is going to happen to this genius? Will he land in jail for some time? I have mixed feelings about this however: pretty sure that if they inverted the roles, that is, it was the big company that sent bogus DMCA take down requests, the outcome wouldn't change: the small fish would still be eaten.
  - nobody9999 4y ago
    >And that idiot revenge campaign served him with over $7M in damages. Assuming he can't pay even a fraction of that amount, what is going to happen to this genius? Will he land in jail for some time? Thankfully, we don't have explicit (although there's plenty of incarcerated folks who wouldn't spend a day in jail if they had enough money to fight whatever bullshit charges are brought against them) debtor's prisons, so probably not.
    - thfuran 4y ago
      But isn't filing a false DMCA takedown in and of itself illegal, beyond any civil damages caused? Edit: Okay, the filing requires asserting "under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly in-fringed." But I'm not sure whether anyone has ever been prosecuted for perjury for something like this. It's seemingly generally resolved only by suing for damages.

pyrolistical 4y ago

Is part of the story missing on how google eventually accepted the fake dmca requests? Seems like at some point google slipped up or else this wouldn’t have gotten so out of hand

spondyl 4y ago
> Is part of the story missing on how google eventually accepted the fake dmca requests? There isn't really a story here. YouTube just kind of blindly accepts any and all DMCAs regardless of whether the claimant has legitimate ownership or not. Here's an excerpt from the court filing: > Ninety-six separate times, Minor used his fake “CSC” Gmail addresses to exploit the hole in YouTube’s DMCA-process security that allows anyone at all to claim to be representing a rights holder for purposes of issuing a takedown, with no real safeguards against fraud. I'd note that they refer to it as "the" hole https://www.pcworld.co.nz/article/483729/google_submission_hammers_section_92a/ https://www.pcworld.co.nz/article/483729/google_submission_h... > In its submission, Google notes that more than half (57%) of the takedown notices it has received under the US Digital Millennium Copyright Act 1998, were sent by business targeting competitors and over one third (37%) of notices were not valid copyright claims.
- cowvin 4y ago
  wow 57% and 37% are awful. it's almost as if the system shouldn't be automated.
- tadfisher 4y ago
  That is what is required under the DMCA, though. YouTube must remove content immediately after receiving a notice, under penalty of losing safe-harbor privileges. In turn, the claimant must represent themselves as the copyright holder or their agent, and the content must be infringing, under penalty of liability for the accused's costs and attorney fees. The law does not make a provision for YouTube to reject bogus claims.
  - Dylan16807 4y ago
    If it's a bogus claim then they don't need safe harbor for it...

spondyl 4y ago

Does anyone else have any other interesting court case filings to share, off the top of their head, that documents the evidence trail used to unmask litigants?

ajsfoux234 4y ago
This doesn't have much of an 'evidence trail' but I thought last year's court filing about the Maryland nuclear engineer was interesting: https://www.justice.gov/opa/pr/maryland-nuclear-engineer-and-spouse-arrested-espionage-related-charges https://www.justice.gov/opa/pr/maryland-nuclear-engineer-and... (click on the "Download Toebbe Complaint" link to see the full PDF)
walrus01 4y ago
not on the topic of unmasking anyone, but the judgment on Meads v. Meads is required reading on the topic of what's going on now with "sovereign citizens / freeman on the land", an increasingly common thing. https://www.canlii.org/en/ab/abqb/doc/2012/2012abqb571/2012abqb571.html https://www.canlii.org/en/ab/abqb/doc/2012/2012abqb571/2012a...

system2 4y ago

You have to be a true imbecile to pull this type of stuff without spoofing your IP and keep using the same email addresses created by the same address. This person must be a kid.

colinmhayes 4y ago
His name is even nick minor

onlyusername 4y ago

Here is a long-ish Tom Scott video related to YouTube's (or rather the Internet's) broken copyright system: https://www.youtube.com/watch?v=1Jwo5qc78QU https://www.youtube.com/watch?v=1Jwo5qc78QU

bzzli 4y ago

Here's a link to the complaint: https://storage.courtlistener.com/recap/gov.uscourts.wawd.308508/gov.uscourts.wawd.308508.19.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.wawd.30...

woojoo666 4y ago

A side note that I found particularly interesting > On March 22, the Reynolds account logged out of Google and less than a second later, the Wiland account logged in, suggesting the same person was behind both accounts. I've always wondered how often timing analysis is used in practice by surveillence big tech. I suspect that as people become more privacy aware, and start using VPNs, pseudonames, multiple accounts, etc, that big tech will start using timing analysis more and more to correlate traffic and identify users. Like if your friend sends you a Reddit link on WhatsApp, and you immediately open it in your browser, that Reddit session is now linked to you. Another more complex example: let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing of when your Reddit account opened the discussion, and when the linked Youtube video was accessed. And not just that video, but now every Youtube video watched in the same browsing session, is now linked back to you (assuming you have first-party cookies enabled, which is basically required if you ever want to log into anything). Seems a bit paranoid, but I actually suspect this happened to me a few months ago. I was using a FOSS reddit client and clicked a youtube link buried deep in a reddit thread, and opened it in Newpipe (a FOSS youtube client). I wasn't logged in, and was using a VPN, and yet the next day on my Youtube feed I started getting recommendations based on that video (and those recommendations were very different from my usual ones). Scary stuff.

walrus01 4y ago
> I've always wondered how often timing analysis is used in practice by surveillence big tech Books written about the NSA, GCHQ, CSE etc talk about them using things like timestamp logs/traffic analysis/time of day analyzing commercial and government telecom links going back to the 1960s, so in the modern era even if your crypto is absolutely unbreakable, there's a huge amount of analysis and correlation that can be done based on timing analysis. Then you combine your timing analysis with things like correlating geolocation of blocks of IP addresses, netflow and traffic analysis, metadata obtained from other adjacent/nearby users on same ISPs at either end, a whole fire hose of other data that's still useful even if the crypto is solid. > let's say Google has already identified your Reddit account. You open a Reddit discussion, and deep in the discussion it links to a Youtube video, and you open it in your browser. Now even if you weren't logged into Youtube, Google could guess that it's you based on the timing Not just timing but also cookies, client device/browser fingerprinting, IP address/what ISP you're on, and the usage patterns and logged in activity (and app-collected telemetry data on android and ios devices) of all the other persons in your household and neighbors.

unyttigfjelltol 4y ago

The article buried the lede, which I think is this-- Google as email provider had information all along that DMCA notices it was sending to its YouTube property were not legitimate. Google even went so far as to flag and reject some of those notices because of false personalities, but instead of going to the root cause to stop abuse of its systems it allowed the same user to plug along long enough to manipulate YouTube in a way that caused Bungie an alleged $7.6m in damages. Then the icing is that when Bungie came knocking Google initially resisted a court-related request to allow Bungie to identify the user and stop the abuse. Wow.

cyanydeez 4y ago
Back a decade ago, century link kept disabling my isdn line based of spammed dmca takedowns. I wrote them several letters demanding proof, even pointing that their abuse form was entirely open to anyone and asking for any substantive proof. It took them a third time to actually send some printouts which amounted to again random spammer on their dmca form. They "solved" the problem by firewalling connections and a lame gateway asking you to admit to whatever.
jonas21 4y ago
> Then the icing is that when Bungie came knocking Google initially resisted a court-related request to allow Bungie to identify the user and stop the abuse. Wow. A big corporation came asking for data on an individual GMail user, and Google told them, "we're not giving that to you without a proper subpoena." That's exactly what you want your email provider to do.
- tinco 4y ago
  Maybe, but that's not the point. It's not about the owner of the Gmail account, it's about the identity of whoever sent the DMCA request. Google should have had more than just an email, should have verified at least a registered company or domain or trademark, and should have willingly gave up the verified contact information to anyone who asks.
  - 4y ago

hueyluey 4y ago

Maybe this is a way to do anti DMCA activism? You send thousands of takedown notices to big companies until they realize that's it a stupid system?

jeroenhd 4y ago
This seems like an excellent way to respond to companies abusing the DMCA, like Nintendo and Hackerrank.

javajosh 4y ago

My understanding is that if you wanted to hurt a YouTube channel, you could do so like this 1. Use a VPN create a gmail address. 2. Use that address to file a DMCA notice on each channel video. 3. Google auto-accepts; the channel challenges each notice. 4. You deny all challenges. And just like that, you can destroy any YouTube channel, without any accountability. Is this correct?

lifeformed 4y ago
You also have to provide some personal information to file a request, like phone number, name, address.
- javajosh 4y ago
  But it isn't verified by Google. Is it given to the channel? Do they have any recourse if they determine it's fake?
  - jimmydorry 4y ago
    I'm not sure about Google in particular, but typically the service provider will pass along the information and tell the parties to settle in court. They will also keep the reported material down until either party forwards them the outcome of the court case.
    - javajosh 4y ago
      Sure, but doesn't Google assume the DMCA notice is valid unless proven otherwise? If that is the case, time is on the attackers side, and won't affect the attack too much.
smotched 4y ago
failed at 1, you cannot create a gmail account with a VPN (unless you want to verify by phone)
- 4y ago

nikolqy 4y ago

That's actually wildly hilarious in a way. Pretty creative way of attacking businesses. Probably more creative than something I could come up with. Copyright is way too strict though. It's ridiculous that this is even possible, to an extent.

KennyBlanken 4y ago
Weaponizing Google's lack of customer service is in fact pretty creative. The "exploit" here is that Google really doesn't care in the slightest about fraudulent DMCA takedowns - it's expensive labor-wise to handle it. Doing it from your home internet connection, less creative...

xbmcuser 4y ago

Its funny how people are siding with Bungie that Google should have given them the details but these same people complain about google knowing too much about them and its privacy implications. From the looks of it Google did the right thing where it comes to siloing data of different departments. Youtube dmca should not know the ip address of someone that send the email using gmail that is the correct way to go about it.

Chio 4y ago

This is an interesting lawsuit as it is a *company* seeking damages due to DMCA abuse by a third party, and my understanding is that this is very widespread (no source sorry). Is anyone aware of any studies done on the total cost¹ (vs benefit¹) of the DMCA due to malicious actors? ¹ defining what is a cost vs benefit (and how much) is probably the hardest part, maybe after acquiring the necessary data.

redm 4y ago

This is highly overlooked “The company tried to subpoena Google using the DMCA but the chosen mechanism only allowed Bungie to identify an alleged copyright infringer, not the sender of allegedly abusive DMCA notices.” We have been the recipient of many invalid notices to Google. Google publishes the details via Lumen but makes it impossible to reasonably analyze the data. 1) They hide the sender info. 2) They make you validate, via email, for EACH DMCA you want to view. In other words, they claim transparency, but practical use isn't possible. They also don’t publish DMCA’s against sites like YouTube.

mola 4y ago

This should've been a story that shows how dangerous and ridiculous DMCA is. Instead we see copyright owners double-down on the legal bullying. Bah

superkuh 4y ago

What stands out most here is that the youtube video creator behind the "fake" DMCA notices was himself hit by a fraudulent DMCA notice. It seems like he was only trying to bring attention to the completely broken system. I see this more as a political protest than anything else. But if you rock the boat you're going to get hit.

s28l 4y ago
My understanding of the article was that the perpetrator was hit with a genuine DMCA notice that he was upset about. It seemed his plan was to generate these fake notices with the hope that they'd be noticed and rolled back, and in the confusion, he could get his notice rescinded as well.
- superkuh 4y ago
  It was from a company with the legal right to do so but it was still abusive and not an appropriate or legal use of the DMCA. The only difference from his 'fake' DMCA claims was having a legal connection to the rightsholders. But the DMCA claim he experienced and the ones he sent out were all fake and abusive.