As I was reading about the Ashley Madison hack yesterday, I was surprised to learn that Avid Life Media, the company behind this website, claimed to be mitigating the damage to its users by using the Digital Millennium Copyright Act, known as the DMCA. That’s right, the company that helps facilitate millions of extra-marital affairs, is relying on copyright law to remove from the Internet the personal information of its clients that were obtained in the hack.
I channeled Amy Poehler and Seth Myers when I did a double take and said “Really?” How could any attorney possibly believe that DMCA takedown notices would be proper under these circumstances? Do they really take the position that the company owns the copyright to all of its users’ personal data?
DMCA Claims: A ‘Sticky Wicket’
Any law student who has taken an introductory intellectual property class could tell you that Avid Life Media could have no copyright in that data. The fact that DMCA notices were sent in this case highlights a major flaw in the DMCA and how it has been used over the years.
For those of you who don’t know, the DMCA was created to help content owners combat online copyright infringement by allowing the quick removal of infringing content through a takedown notice process.
We’ve discussed the DMCA takedown process before, but the basic idea is that a copyright owner can send a notice to an internet service provider demanding the removal of infringing content. Providers are required to comply by taking down the content promptly, and they are not permitted to independently assess the claims made in the notice beyond making sure they meet the statutory requirements for the notice.
This allows infringing content to be removed quickly without a lengthy court process, which is good for copyright owners. But the statute invites abuse, because there are essentially no consequences for sending false takedown notices.
While the DMCA does provide a mechanism for the person who posted the allegedly infringing content to send a counter-notice, the internet service provider cannot restore the content unless the original sender of the takedown notice decides not to file a lawsuit within ten days.
DMCA Takedowns, Online Abuse Combat…?
Imagine two businesses, A and B, in competition for online sales. A sends B a DMCA takedown notice that results in the removal of B’s web content. B promptly sends a counter-notice, but B’s content remains off of the Internet for ten days after the counter-notice is sent. A does not file suit, and the content is restored. A just bought itself about two weeks of no competition just by sending a letter.
This kind of DMCA abuse is not uncommon, as noted here. And here and here. Company B’s only recourse would be to file a lawsuit against A, either under state business tort law or under the DMCA, an expensive proposition and one that, until recently, had no promise of resulting in any consequence.
Even if B brought suit under the one provision of the DMCA meant to provide a mechanism to combat abuse of the DMCA, it would be an uphill battle. Section 512(f) provides that anyone who “knowingly and materially” misrepresents that material is infringing will be liable for damages to anyone injured by the misrepresentation. Courts have interpreted the section very narrowly, and very few cases have made it past the motion to dismiss stage.
In fact, until March of this year when a district court in California granted default judgment in Automattic v Steiner, no court had ever awarded damages under this provision. Perhaps courts are finally realizing that the narrow interpretation of the statute has not served its cause well, but commenters are doubtful. Only time will tell.
Back to Ashley Madison, Avid Life Media, and their use of the DMCA. Why do it? The reason is clear: it is a very fast way to get content removed from the Internet.
There is no requirement with a DMCA notice, as there would be in filing a lawsuit for an injunction, that the attorneys writing the letter certify that the arguments made are warranted by existing law and are not for an improper purpose. In other words, they don’t have to believe that the posted data actually infringes a copyright to send a takedown notice. And there is very little chance of any consequence because it is highly unlikely that the hackers (who themselves have violated the law) would sue, or that any Internet service provider receiving the notices would sue, or that either could demonstrate injury from the takedown notices.
Regardless of your opinion of the hackers, the Ashley Madison website, or Avid Life Media – and even if you think that taking down the data is the right result, this is yet another example of serious problems with the DMCA that will continue to be debated.