7 ms·

MegaUpload complaint has Dropbox Implications

105 points by vessenes 15y ago

deleted 15y ago
[deleted]
assistantpilot 15y ago
Whats more f'ed up is that it is not even clear if ripping a legally owned CD/DVD is legal. Eg. http://www.washingtonpost.com/wp-dyn/content/article/2007/12/28/AR2007122800693.html?hpid=topnews http://www.washingtonpost.com/wp-dyn/content/article/2007/12...
- deleted 15y ago
  [deleted]
- joering1 15y ago
  a similar article made me think if I ever owe any digital audio whether from my own CDs or from internet, I would have stored it on encrypted drive, preferably encrypted with more than one encrypting algorithm, and either download from work/starbucks etc, or at least owe wireless router so if they go after me, I could claim someone was using my wireless router without my knowledge. I could just hope case against me wouldnt be that strong that they would weight between me giving out a key to my hard drive and lets say 15 hard years in jail. EDIT: and then in court I would say I forgot the password because I havent been using this drive for a while now.
  - nicholasreed 15y ago
    I've thought through similar scenarios multiple times, and then when I am about to post any of them online, I realize my post would probably be read by any competent investigator and it would be turned into an additional premeditation-based charge. It definitely sucks having to consider how my comments will be construed in the future and what rights may be retroactively taken away due to intense lobbying and legislative ignorance.
    - joering1 15y ago
      thats why I never downloaded i single music file, never ripped a CD, and wrote this post from my work's network, just in case.
- chc 15y ago
  That article is about a guy who shared legally ripped music over the Internet. Big difference. I don't think this is as legally fuzzy a topic as you make it sound.
- jerf 15y ago
  The MPAA has a clear opinion about uploading your ripped content, even to someone who doesn't give it to somebody else. The MPAA would still say both copies of The Dark Knight are illegal. (Note that this is not exactly what assistantpilot said; I tweaked it on purpose since I can be more definitive, and it's relevant to the original link. You are also free to disagree with their assessment. I do, but I wouldn't care to argue it in court.) However, the poor choice of example doesn't negate the underlying point. Bits don't have color [1], and in general just because Alice shouldn't have a file in her cloud file store doesn't mean that there is nobody who does have the right to put the exact same file in the cloud store. There's no way to tell. In some ways that's the worst part of SOPA from a philosophical point of view.... what the law essentially demands isn't even possible. It is not possible for Google to look at a file and tell if it is legal or not. They can make some guesses, but on Internet scale they can't know, yet the law requires them to know, then act, or face the consequences. This is not possible, neither in theory nor in practice. Laws that require the impossible are just obscured tyranny. [1]: http://ansuz.sooke.bc.ca/entry/23 http://ansuz.sooke.bc.ca/entry/23
joering1 15y ago
> The complaint says that when notified under DMCA of an infringing file, present at a link, say megaupload.com/dark-knight-video-rip.iso that MegaUpload WOULD in fact remove the link, but that they would NOT remove the file, or remove links at say, megaupload.com/dk-knight-dvd-rip_O_o.iso, even if no DMCA takedown notice occurred for that particular link. it would be great to know if its possible they had an insider. how otherwise would they know that other links linked to the same content were linking to exact the same file that DMCA note was sent to take down. Otherwise it was unfair and thats the purpose why safe harbour exist -- it protects you a small company from millions of users uploading their content and being shorthand or not having boots to check each and single file whether it violates someones copyrights or not. > Consider this totally legal (for me) scenario: I rip the Dark Knight DVD, and place it in Dropbox as a legal backup of my content. I share the link with nobody; it's just mine, all mine. I am not sure if this is entirely legal. First you say you didnt make a copy, but "rip". Its called ripping because DVDs content is locked with an encrypted key, so locked DVD with a movie is not just a folder with files you can copy over to your desktop. Years ago there was a movie when they forgot to lock the key and based off of it software developers were able to build a key decryptor for any encrypted DVD. Most DVD ripping software is illegal throughout the world, at least some software vendors got lawsuit over their software functionality. Further, while I dont have a link handy, but I recall there was a discussion on HN that 9th circuit make it illegal for anyone to stream any copyrighted content, whether to themselves or a group of people. So uploading it into cloud and then getting it back out of it technically is illegal, AFAIK, but that was month ago when I saw this posting.
- vessenes 15y ago
  Hmm, MGM claimed that ripping a CD was legal to the SCOTUS, and I am certainly allowed to circumvent CSS on DVDs for non-infringing purposes, but I think my argument holds just fine if you substitute an ISO of Snow Leopard, a DVD I finally found in my basement recently. I find the claim that I can't remotely backup the ISO over the internet surprising -- I have never even heard of such a stance.
  - trotsky 15y ago
    http://store.apple.com/Catalog/US/Images/MacOSX.htm http://store.apple.com/Catalog/US/Images/MacOSX.htm 2. Permitted License Uses and Restrictions. A. This License allows you to install and use one copy of the Apple Software on a single Apple-labeled computer at a time. This License does not allow the Apple Software to exist on more than one computer at a time,and you may not make the Apple Software available over a network where it could be used by multiple computers at the same time. You may make one copy of the Apple Software (excluding the Boot ROM code) in machine-readable form for backup purposes only; provided that the backup copy must include all copyright or other proprietary notices contained on the original.
forrestthewoods 15y ago
"simply removing a single link to the content while duplicate links were left in place" I don't know how MegaUpload works. Does that statement mean that a single user uploaded a file and there were multiple links to that file or does it mean that multiple users uploaded bit-for-bit identical files which each had links? The way it's phrased it sounds like the former, in which case it's obviously wrong.
- Maxious 15y ago
  The latter but that is what Dropbox does. See claims 21-24 @ http://www.scribd.com/doc/78786408/Mega-Indictment http://www.scribd.com/doc/78786408/Mega-Indictment Megaupload took DMCA requests in the form of URLs (21), URLs allow access to a certain MD5 sum indexed file on their CDN (22), they would disable specific URLs to comply with DMCA requests while leaving others active rather than removing the file from their CDN (23) however if the material was child pornography/terrorism they had the ability to actually delete files and all their links (24)
  - forrestthewoods 15y ago
    Ah well alright then. I see music as an interesting situation. It is legal to rip music (Google/Amazon both have cloud services) and multiple users could easily rip and upload identical files. However it wouldn't be legal to share that ripped file. In that case you'd want the infringing file to still exist but only be accessible to the user(s) who uploaded it. Property rights in the digital age sure is complicated. :(
  - josnyder 15y ago
    The way I view copyright law (IANAL), this is the correct approach. Each upload of an item to Megaupload is an independent assertion by the uploader that they have a license to put the work in question on the site. _Content_ itself is not prima facie infringing; instead, it is the unlicensed _use_ of the content that is infringement. This was essentially Youtube's argument when Viacom uploaded "roughed up" content to their site [1]. In that case, the roughed up copy as originally uploaded would be a licensed copy, but any copies that other users uploaded, even with the same MD5 hash, would be unlicensed. On the other hand, child pornography can never be "non-infringing." It is always illegal to knowingly store obscene content, regardless of who stores it. Thus, one link to a child-pornographic file is as culpable as the next, justifying mass removal. This is essentially the argument made by Katherine Oyama of Google at one of the SOPA hearings [2]. [1] http://news.bbc.co.uk/2/hi/8575666.stm http://news.bbc.co.uk/2/hi/8575666.stm [2] http://danwin.com/2012/01/the-sopa-debate-and-how-its-affected-by-congresss-understanding-of-child-porn/ http://danwin.com/2012/01/the-sopa-debate-and-how-its-affect... (Ctrl-f "REP. MARINO")
pjscott 15y ago
Even if Megaupload took down files based on hash, there are ways for pirates to work around it. The MKV and AVI video container formats, for example, have loads of places where you could stick a nonce so that the exact same video would produce arbitrarily many hash values.
- gst 15y ago
  http://en.wikipedia.org/wiki/Locality-sensitive_hashing http://en.wikipedia.org/wiki/Locality-sensitive_hashing
  - nitrogen 15y ago
    So Locality-sensitive hashing has basically the opposite goal of a cryptographic hash function, where a single bit change in the input should result in a significant change in the output? What if there's a legitimate, private file uploaded to Megaupload's hypothetical successor, but someone uploads a highly-similar file publicly that gets a takedown notice? The problem with forcing digital locker sites to remove content by hash rather than by URL is that it's impossible for them to know whether some of the URLs that point to a given hash are legitimate (e.g. a FLAC file being transferred by a musician to their CD pressing company and a select set of friends, but someone leaks the FLAC files and they get re-uploaded and deduped). This problem would be exacerbated by using a fuzzy or locality-sensitive hash rather than a cryptographic hash.
- wladimir 15y ago
  Or they could simply wrap it in a zip/rar file, with a public (but different) password. Or code it as a video format that the hosting site doesn't know. Old tricks that are basically impossible to block. There are so many ways to recode information that make it difficult to auto-match.
gst 15y ago
So what's the difference to files hosted in Gmail? Does this mean that Google also needs to delete all mails containing a certain MP3 (for example)?
- molmalo 15y ago
  I think that the difference is that the RIAA can't look at your GMail account, so they can't know that you have that MP3. Therefore, they will not file a takedown notice. BUT... (there's always a but =P ), what happens if you upload a video to YouTube, and you save it also in your gmail. If someone files a takedown notice on that video, should google also delete from your email ? should they also delete it from every other gmail account that holds a copy of that video? Oh man, this is getting complicated...
  - JumpCrisscross 15y ago
    You have the link in your Gmail, not the original file. The link just wouldn't work. This is comparing apples to oranges.
    - CWIZO 15y ago
      He meant that you've downloaded the video file and attached it to some email in gmail.
      - molmalo 15y ago
        Exactly. Thanks for making it clear.
- Mordor 15y ago
  The difference is Goole's relationship with the music industry - this has nothing to do with laws and everything to do with Google's ability to set the agenda.
- extension 15y ago
  Files in your gmail are not public. Likewise, files in your Dropbox are not necessarily public. I don't see the problem with removing public links in response to a DMCA takedown, while still allowing private access for those people who uploaded it.
jahewson 15y ago
I don't see this happening - each file on Dropbox must have an ACL of sorts, otherwise I could access any private file simply by knowing its URL. A takedown of a public file could therefore only apply to specific users by modifying the ACL.
nl 15y ago
Don't get too hung up on this. Technologist love to think through the technical implications of something, and assume these implications will be carried through legally. The law doesn't work like that. Provided Dropbox adheres to both the letter and the spirit of the DMCA - or works with complainants to develop an arrangement both are hppy with the technical details DO NOT MATTER.
- wladimir 15y ago
  If it only was so simple... no matter what, it costs companies such as Dropbox a lot a lot of extra effort to appease all possible companies that can file complaints. That could cause them to go out of business, to have to charge more money, and/or be really restrictive to what files and users they allow. A net loss for all users of the internet, especially law-abiding ones.
  - nl 15y ago
    Oh yes, I agree with this! But that's the case no matter what the technical implementation is.
    - wladimir 15y ago
      It does. The technical implementation can have a lot of effect on the chilling effect of a law. Let's take the extremes. If the technical implementation is "we'll send a drone to fire a missile at your building", people will be much more scared to take any risk at all of hosting user-generated content than if the implementation is "you'll get a warning and a $5 fine". Everything considered, "We'll arrest you and everyone that works for your company and nuke your DNS entry" is pretty chilling. If they only punished bank misconduct that hard...

105 points by vessenes 15y ago

deleted 15y ago

[deleted]

Whats more f'ed up is that it is not even clear if ripping a legally owned CD/DVD is legal. Eg. http://www.washingtonpost.com/wp-dyn/content/article/2007/12/28/AR2007122800693.html?hpid=topnews http://www.washingtonpost.com/wp-dyn/content/article/2007/12...

deleted 15y ago
[deleted]
joering1 15y ago
a similar article made me think if I ever owe any digital audio whether from my own CDs or from internet, I would have stored it on encrypted drive, preferably encrypted with more than one encrypting algorithm, and either download from work/starbucks etc, or at least owe wireless router so if they go after me, I could claim someone was using my wireless router without my knowledge. I could just hope case against me wouldnt be that strong that they would weight between me giving out a key to my hard drive and lets say 15 hard years in jail. EDIT: and then in court I would say I forgot the password because I havent been using this drive for a while now.
- nicholasreed 15y ago
  I've thought through similar scenarios multiple times, and then when I am about to post any of them online, I realize my post would probably be read by any competent investigator and it would be turned into an additional premeditation-based charge. It definitely sucks having to consider how my comments will be construed in the future and what rights may be retroactively taken away due to intense lobbying and legislative ignorance.
  - joering1 15y ago
    thats why I never downloaded i single music file, never ripped a CD, and wrote this post from my work's network, just in case.
chc 15y ago
That article is about a guy who shared legally ripped music over the Internet. Big difference. I don't think this is as legally fuzzy a topic as you make it sound.
jerf 15y ago
The MPAA has a clear opinion about uploading your ripped content, even to someone who doesn't give it to somebody else. The MPAA would still say both copies of The Dark Knight are illegal. (Note that this is not exactly what assistantpilot said; I tweaked it on purpose since I can be more definitive, and it's relevant to the original link. You are also free to disagree with their assessment. I do, but I wouldn't care to argue it in court.) However, the poor choice of example doesn't negate the underlying point. Bits don't have color [1], and in general just because Alice shouldn't have a file in her cloud file store doesn't mean that there is nobody who does have the right to put the exact same file in the cloud store. There's no way to tell. In some ways that's the worst part of SOPA from a philosophical point of view.... what the law essentially demands isn't even possible. It is not possible for Google to look at a file and tell if it is legal or not. They can make some guesses, but on Internet scale they can't know, yet the law requires them to know, then act, or face the consequences. This is not possible, neither in theory nor in practice. Laws that require the impossible are just obscured tyranny. [1]: http://ansuz.sooke.bc.ca/entry/23 http://ansuz.sooke.bc.ca/entry/23

joering1 15y ago

> The complaint says that when notified under DMCA of an infringing file, present at a link, say megaupload.com/dark-knight-video-rip.iso that MegaUpload WOULD in fact remove the link, but that they would NOT remove the file, or remove links at say, megaupload.com/dk-knight-dvd-rip_O_o.iso, even if no DMCA takedown notice occurred for that particular link. it would be great to know if its possible they had an insider. how otherwise would they know that other links linked to the same content were linking to exact the same file that DMCA note was sent to take down. Otherwise it was unfair and thats the purpose why safe harbour exist -- it protects you a small company from millions of users uploading their content and being shorthand or not having boots to check each and single file whether it violates someones copyrights or not. > Consider this totally legal (for me) scenario: I rip the Dark Knight DVD, and place it in Dropbox as a legal backup of my content. I share the link with nobody; it's just mine, all mine. I am not sure if this is entirely legal. First you say you didnt make a copy, but "rip". Its called ripping because DVDs content is locked with an encrypted key, so locked DVD with a movie is not just a folder with files you can copy over to your desktop. Years ago there was a movie when they forgot to lock the key and based off of it software developers were able to build a key decryptor for any encrypted DVD. Most DVD ripping software is illegal throughout the world, at least some software vendors got lawsuit over their software functionality. Further, while I dont have a link handy, but I recall there was a discussion on HN that 9th circuit make it illegal for anyone to stream any copyrighted content, whether to themselves or a group of people. So uploading it into cloud and then getting it back out of it technically is illegal, AFAIK, but that was month ago when I saw this posting.

vessenes 15y ago
Hmm, MGM claimed that ripping a CD was legal to the SCOTUS, and I am certainly allowed to circumvent CSS on DVDs for non-infringing purposes, but I think my argument holds just fine if you substitute an ISO of Snow Leopard, a DVD I finally found in my basement recently. I find the claim that I can't remotely backup the ISO over the internet surprising -- I have never even heard of such a stance.
- trotsky 15y ago
  http://store.apple.com/Catalog/US/Images/MacOSX.htm http://store.apple.com/Catalog/US/Images/MacOSX.htm 2. Permitted License Uses and Restrictions. A. This License allows you to install and use one copy of the Apple Software on a single Apple-labeled computer at a time. This License does not allow the Apple Software to exist on more than one computer at a time,and you may not make the Apple Software available over a network where it could be used by multiple computers at the same time. You may make one copy of the Apple Software (excluding the Boot ROM code) in machine-readable form for backup purposes only; provided that the backup copy must include all copyright or other proprietary notices contained on the original.

forrestthewoods 15y ago

"simply removing a single link to the content while duplicate links were left in place" I don't know how MegaUpload works. Does that statement mean that a single user uploaded a file and there were multiple links to that file or does it mean that multiple users uploaded bit-for-bit identical files which each had links? The way it's phrased it sounds like the former, in which case it's obviously wrong.

Maxious 15y ago
The latter but that is what Dropbox does. See claims 21-24 @ http://www.scribd.com/doc/78786408/Mega-Indictment http://www.scribd.com/doc/78786408/Mega-Indictment Megaupload took DMCA requests in the form of URLs (21), URLs allow access to a certain MD5 sum indexed file on their CDN (22), they would disable specific URLs to comply with DMCA requests while leaving others active rather than removing the file from their CDN (23) however if the material was child pornography/terrorism they had the ability to actually delete files and all their links (24)
- forrestthewoods 15y ago
  Ah well alright then. I see music as an interesting situation. It is legal to rip music (Google/Amazon both have cloud services) and multiple users could easily rip and upload identical files. However it wouldn't be legal to share that ripped file. In that case you'd want the infringing file to still exist but only be accessible to the user(s) who uploaded it. Property rights in the digital age sure is complicated. :(
- josnyder 15y ago
  The way I view copyright law (IANAL), this is the correct approach. Each upload of an item to Megaupload is an independent assertion by the uploader that they have a license to put the work in question on the site. _Content_ itself is not prima facie infringing; instead, it is the unlicensed _use_ of the content that is infringement. This was essentially Youtube's argument when Viacom uploaded "roughed up" content to their site [1]. In that case, the roughed up copy as originally uploaded would be a licensed copy, but any copies that other users uploaded, even with the same MD5 hash, would be unlicensed. On the other hand, child pornography can never be "non-infringing." It is always illegal to knowingly store obscene content, regardless of who stores it. Thus, one link to a child-pornographic file is as culpable as the next, justifying mass removal. This is essentially the argument made by Katherine Oyama of Google at one of the SOPA hearings [2]. [1] http://news.bbc.co.uk/2/hi/8575666.stm http://news.bbc.co.uk/2/hi/8575666.stm [2] http://danwin.com/2012/01/the-sopa-debate-and-how-its-affected-by-congresss-understanding-of-child-porn/ http://danwin.com/2012/01/the-sopa-debate-and-how-its-affect... (Ctrl-f "REP. MARINO")

pjscott 15y ago

Even if Megaupload took down files based on hash, there are ways for pirates to work around it. The MKV and AVI video container formats, for example, have loads of places where you could stick a nonce so that the exact same video would produce arbitrarily many hash values.

gst 15y ago
http://en.wikipedia.org/wiki/Locality-sensitive_hashing http://en.wikipedia.org/wiki/Locality-sensitive_hashing
- nitrogen 15y ago
  So Locality-sensitive hashing has basically the opposite goal of a cryptographic hash function, where a single bit change in the input should result in a significant change in the output? What if there's a legitimate, private file uploaded to Megaupload's hypothetical successor, but someone uploads a highly-similar file publicly that gets a takedown notice? The problem with forcing digital locker sites to remove content by hash rather than by URL is that it's impossible for them to know whether some of the URLs that point to a given hash are legitimate (e.g. a FLAC file being transferred by a musician to their CD pressing company and a select set of friends, but someone leaks the FLAC files and they get re-uploaded and deduped). This problem would be exacerbated by using a fuzzy or locality-sensitive hash rather than a cryptographic hash.
wladimir 15y ago
Or they could simply wrap it in a zip/rar file, with a public (but different) password. Or code it as a video format that the hosting site doesn't know. Old tricks that are basically impossible to block. There are so many ways to recode information that make it difficult to auto-match.

gst 15y ago

So what's the difference to files hosted in Gmail? Does this mean that Google also needs to delete all mails containing a certain MP3 (for example)?

molmalo 15y ago
I think that the difference is that the RIAA can't look at your GMail account, so they can't know that you have that MP3. Therefore, they will not file a takedown notice. BUT... (there's always a but =P ), what happens if you upload a video to YouTube, and you save it also in your gmail. If someone files a takedown notice on that video, should google also delete from your email ? should they also delete it from every other gmail account that holds a copy of that video? Oh man, this is getting complicated...
- JumpCrisscross 15y ago
  You have the link in your Gmail, not the original file. The link just wouldn't work. This is comparing apples to oranges.
  - CWIZO 15y ago
    He meant that you've downloaded the video file and attached it to some email in gmail.
    - molmalo 15y ago
      Exactly. Thanks for making it clear.
Mordor 15y ago
The difference is Goole's relationship with the music industry - this has nothing to do with laws and everything to do with Google's ability to set the agenda.
extension 15y ago
Files in your gmail are not public. Likewise, files in your Dropbox are not necessarily public. I don't see the problem with removing public links in response to a DMCA takedown, while still allowing private access for those people who uploaded it.

jahewson 15y ago

I don't see this happening - each file on Dropbox must have an ACL of sorts, otherwise I could access any private file simply by knowing its URL. A takedown of a public file could therefore only apply to specific users by modifying the ACL.

nl 15y ago

Don't get too hung up on this. Technologist love to think through the technical implications of something, and assume these implications will be carried through legally. The law doesn't work like that. Provided Dropbox adheres to both the letter and the spirit of the DMCA - or works with complainants to develop an arrangement both are hppy with the technical details DO NOT MATTER.

wladimir 15y ago
If it only was so simple... no matter what, it costs companies such as Dropbox a lot a lot of extra effort to appease all possible companies that can file complaints. That could cause them to go out of business, to have to charge more money, and/or be really restrictive to what files and users they allow. A net loss for all users of the internet, especially law-abiding ones.
- nl 15y ago
  Oh yes, I agree with this! But that's the case no matter what the technical implementation is.
  - wladimir 15y ago
    It does. The technical implementation can have a lot of effect on the chilling effect of a law. Let's take the extremes. If the technical implementation is "we'll send a drone to fire a missile at your building", people will be much more scared to take any risk at all of hosting user-generated content than if the implementation is "you'll get a warning and a $5 fine". Everything considered, "We'll arrest you and everyone that works for your company and nuke your DNS entry" is pretty chilling. If they only punished bank misconduct that hard...