Cloudflare doesn’t have to cut off copyright-infringing websites, judge rules

https://arstechnica.com/tech-policy/2021/10/cloudflare-doesnt-have-to-cut-off-copyright-infringing-websites-judge-rules/

by eastdakota • 5 years ago

407 176 5 years ago

arstechnica.com

nawgz• 5 years ago

Not a lawyer, but this seems like a good result for the internet.

t-writescode• 5 years ago

You were downvoted at my time of reading this; but, I have to agree. We constantly talk about how copyright enforcement on memes, etc, would break the internet, and we're constantly yelling about YouTube breaking Fair Use exceptions of copyrighted material, and so on.

Cloudflare not being forced to take down content due to claimed copyright infringement seems exactly in line with protecting the internet and freedom of thought and creativity as a whole.

I'd love to know why people are against it.

They can still choose to take down copyright infringing material, but they're not obligated by power of the gun / legal / monetary / use-of-force rammifications.

Edit: disclosure: of course I'm not a lawyer, etc, blah blah.

0des2• 5 years ago

You know cloudflare still chooses arbitrarily to remove sites from their service, right? What we are talking about here is one small sliver of the pie, so while this one thing (piracy) wont get you yanked, your political beliefs will (and have).

Cloudflare has great utility that benefits a lot of us, but I think some day we will realize how much this centralization is a tradeoff that hurts the internet as a whole, no matter how cool the people are who work there.

edude03• 5 years ago

Happy to hear it.

johnklos• 5 years ago

They lied to the judge:

"[R]emoving material from a cache without removing it from the hosting server would not prevent the direct infringement from occurring," Chhabria wrote.

That's just patently untrue.

A web site using Cloudflare's services isn't available to the Internet once Cloudflare stops providing services, until the site's hosting is meaningfully reconfigured.

You can't say it's just caching, because you can't access the site in any reasonably normal way via any method other than going through Cloudflare. That's just plain old bullshit.

indymike• 5 years ago

Depends on configuration. Setting up a failover where if the CDN/ cache fails or is removed, the request is routed to a live server is more than possible.

sodality22• 5 years ago

That's just patently untrue.

Removing it from the cache does nothing except making Cloudflare drop it. If Cloudflare "removes material from their cache" it DOESN'T prevent any infringement, because the request will hit the main server (and possibly Cloudflare will cache it).

If cloudflare kicks them off, that's different than just "removing material from the cache" which seems to be what the argument is.

sodality22• 5 years ago

If cloudflare kicks them off, that's different than just "removing material from the cache" which seems to be what the argument is.

Let me add onto this, even w/o Cloudflare, that STILL won't stop infringements, as other CDN's or even no CDN can be used. It just clears Cloudflare of guilt/responsibility they may have.

onion2k• 5 years ago

As I understand it Cloudflare is essentially a caching proxy. If the site isn't in the cache then Cloudflare fetches it and passes it on, and also saves it in the cache for the subsequent requests. Removing it from the cache will just make every request look like it's the first one.

badrabbit2• 5 years ago

Removal from cache means they act as a reverse proxy, it does not mean they take it down. But even if that was the case, who is to say the site isn't using their real IP as fallback in their DNS setup? Why does meaningful reconfiguration matter? Is thay effort enough to thwart hosting of infringing content? Are there no CDN providers outside of america?

zozbot234• 5 years ago

A site that's acting as a reverse proxy could block these requests altogether in addition to not caching them. If the browser receives a 451 error ("Unavailable for Legal Reasons") when requesting some offending image, there isn't a trivial mechanism to redirect that request to the "real site", at least not without forgoing Cloudflare services altogether.

ericd• 5 years ago

Maybe you simply misunderstood the context and so their meaning? Sounds more likely than them committing perjury.

rsstack• 5 years ago

Mon Cheri Bridals and Maggie Sottero Designs alleged that Cloudflare contributes to copyright infringement by providing performance-improvement services, including its content-distribution network and caching capabilities that improve the quality of webpages and make them load faster, Chhabria wrote. But the "plaintiffs have not presented evidence from which a jury could conclude that Cloudflare's performance-improvement services materially contribute to copyright infringement. The plaintiffs' only evidence of the effects of these services is promotional material from Cloudflare's website touting the benefits of its services. These general statements do not speak to the effects of Cloudflare on the direct infringement at issue here."
The plaintiffs did not prove that the faster website-load times enabled by Cloudflare "would be likely to lead to significantly more infringement." Additionally, Cloudflare removing infringing material from its cache would not prevent users from seeing the copyrighted images. "[R]emoving material from a cache without removing it from the hosting server would not prevent the direct infringement from occurring," Chhabria wrote.

The claim was that the caching of the copyright infringing content is an issue. Cloudflare said "that can't be the issue".

You took the last sentence of the second paragraph out of its context.

partiallypro3• 5 years ago

We have a client that had someone make a direct copy of their website, same branding, same everything and put it on a domain running through Cloudflare. We've reached out to Cloudflare to get them to take it down but nothing has been done. You also have a Cloudflare account to file a complaint, which I found to be odd. We're a Cloudflare customer too...but still that shouldn't be a hoop you have to jump through. Now there is this identical phishing site out there that Cloudflare reverse proxies and we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.)

brundolf• 5 years ago

Could that be treated as a trademark issue rather than a copyright issue?

akersten• 5 years ago

You (your client) can still subpoena Cloudflare for the customer's IP if you can get a court to agree that it's infringement and then go after the upstream host. That's seems like a solution compatible with this ruling, and an appropriate amount of lift.

mmis1000• 5 years ago

Some big parties always try to skip the court ruling and do whatever they want block the site without a law suit directly. Even the court ruling path exists there since forever and accomplish with the problem they claimed perfectly.

Either because it is expensive or court obviously won't agree about every flawed claim they created. That isn't really a problem only in America.

Some people in Taiwan also tries to pass similar law, end up get backfired when someone noticed it and stop the law creating process everytime. (And they still didn't give up )

TheCoelacanth• 5 years ago

Cloudflare, it seems, was perfectly willing to tell them identify of the customer without even going to court.

Cloudflare's security services do impact the ability of third parties to identify a website's hosting provider and the IP address of the server on which it resides. If Cloudflare's provision of these services made it more difficult for a third party to report incidents of infringement to the web host as part of an effort to get the underlying content taken down, perhaps it could be liable for contributory infringement. But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.

ohazi• 5 years ago

This really doesn't seem like Cloudflare's problem.

Did banks sue the Ford dealer for selling big V8 getaway cars to bank robbers? Or the city for operating the roads that they used to get away? Or the toll collector for letting the bank robbers cross a bridge after they paid the toll?

No, because any of those things would have been ridiculous.

At some point we as a society are going to have to get off this intellectual property high horse.

Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses. The enormous effort to try and protect these things damages society more than the benefit that even a successful outcome might have for a rights holder.

dymk3• 5 years ago

A Ford dealership would be liable for selling counterfeit Fords, or at least would be responsible for helping track down where that counterfeit came from.

partiallypro3• 5 years ago

Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses.

Right, but the website is being used to scam customers and steal their information. So, that's not even the same thing. It's like Cloudflare protecting people that send out spam phishing emails that look like PayPal, etc. It's not just because the site was copied outright, though that's bad enough. It's about tricking customers entirely. It's literally fraud.

pfundstein2• 5 years ago

That's a flawed analogy, cloudflare here provides cover for these dodgy sites to hide behind. Cloudflare here is not only the V8 supercar but the getaway driver as well.

eikenberry• 5 years ago

Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses.

You get half your wish as wedding dresses aren't covered by any intellectual property laws except for big designer dresses which use Trademarks. Copying the dress design itself is expected and a regular part of the fashion industry.

themitigating• 5 years ago

I think the difference is that ford sells a car then someone robs a bank. With hosting it's a continuing relationship.

Hard to work that into a car analogy but what if a rental car is returned obviously with bank robbers and they want another one telling you they are going to rob another bank

matheusmoreira2• 5 years ago

Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses.

Yeah. Copyright is nonsense in the 21st century where copying is trivial. It's holding us back.

tryauuum2• 5 years ago

If you look at this thread, you will see many people coming up with different analogies, thinking about "what would Ford do" or "what if there is a meth lab". Simply because they saw your analogy and didn't like it

I wish HN would introduce a "please no analogies that compare digital stuff with physical" rule because such things turn conversations into a mess

A_non_e-moose• 5 years ago

I think this topic is not about physical VS virtual, but discrete VS continuous involvement of the manufacturer/provider.

A car is manufactured and sold once to a customer, which then goes on a road rampage. (physical, discrete)

A website is continuously served and maintained by a provider to a customer, which then uses it for shopping scams. (virtual, continuous)

A spreadsheet serial key for an offline app is sold by the developer to a customer, which then uses it for embezzlement. (virtual, discrete)

Some legal questions: Is the manufacturer/provider liable? Did they know the product/service was purchased with the intent to harm? At what point can the manufacturer/provider be considered an accomplice? The product was sold already, what can they do about it? The service is still being provided, should they stop it?

I'm wondering how long until we see the physical, continuous scenario, exactly like the road rampage, but with a connected car. Should the manufacturer disconnect that car? Should they remotely disable it?

Very complex legal and ethical questions ahead in our times.

Causality1• 5 years ago

What due process do you believe Cloudflare should implement with regards to claims that a particular site on their service deserves to be booted?

markdown2• 5 years ago

DMCA?

henhouse• 5 years ago

Cloudflare forwards DMCA copyright infringement complaints to the hosting provider, probably automatically to an abuse@ domain that it can detect. I’m not sure if they do the same for any other copyright claims, but they do pass it on to the parties that should be involved.

adrr2• 5 years ago

But don't they store the copyrighted content on their servers? It's one thing just to be a transit mechanism it's another thing to store and serve copyrighted material like a hosting a provider.

Matheus28• 5 years ago

I have never seen these work. I've submitted a couple and they just go into a blackhole, never to hear from their hosting provider.

markdown2• 5 years ago

You also have a Cloudflare account to file a complaint, which I found to be odd. We're a Cloudflare customer too...but still that shouldn't be a hoop you have to jump through.

I was once locked out of my Cloudflare account, and I couldn't contact them because to do so... required an account /* facepalm */

FYI, the way around this is to send an email to support@cloudflare.com. This isn't mentioned anywhere on the public-facing website.

A truly bizarre way to treat paying customers.

jrochkind12• 5 years ago

and we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.)

According to OP, it should be possible to get Cloudflare to tell you the originating IPs. I am not sure the mechanism though. From article:

But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.

xxdesmus3• 5 years ago

Not true -- according to the OP -- we'll tell you who the hosting provider is -- as in, the name and abuse email of the host. The origin IP is not needed.

xxdesmus3• 5 years ago

> "You also have a Cloudflare account to file a complaint, which I found to be odd."

That's incorrect. Anyone can fill out the web reporting form here: cloudflare.com/abuse -- absolutely no Cloudflare account needed.

derefr• 5 years ago

Cloudflare does take reports seriously when a site exists to phish logins from another site’s users (whether that site is a clone, or just claims to be representing the other party when it isn’t.) Especially when that other site has a credit card form.

Sadly, the most they can really do (about their regular Cloudflare Proxy clients, at least) is reveal to you the unmasked hosting info of the origin site; at which point you’ve got to start another process for reporting a TOS violation to the origin’s hosting provider.

devwastaken• 5 years ago

Sue for copyright infringement, using discovery to compel the identity of the infringer, then continue to sue the infringer.

1vuio0pswjnm7• 5 years ago

Why not name the phishing website.

There are some methods for discovering the IP address of the origin server hidden behind Cloudflare. No guarantees but IME, many origin IPs are easily discovered.

Abishek_Muthian2• 5 years ago

we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.)

TIL Cloudflare is also a registrar[1], Might be even the cheapest. I was wondering why the parent wasn't able to find who the site belonged to through just WHOIS and sending a abuse request to the registrar, Still Cloudflare should be forwarding the abuse report not sure what's the case here.

Can anyone tell share their experience with Cloudflare registrar? When compared to something like Namecheap? Also can different Cloudflare accounts for separate products use same credit cards for using the registration service?

[1] https://www.cloudflare.com/products/registrar/

fragmede• 5 years ago

In particular, the cloudflare registrar forces you to use their nameservers, which is totally fine if you understand the ramifications going in.

milankragujevic• 5 years ago

Regarding the IPs behind Cloudflare, when you send a DMCA notice to Cloudflare via email (meaning you don't need an account), Cloudflare will forward the notice to the host of the website, who will then take appropriate action. Cloudflare will usually also notify you about the origin IP of the website so you can further enforce your rights directly at the company which hosts the website.

batch12• 5 years ago

Depending on the opsec of the group that stood the site up, this may still be possible to run down.

dragonwriter2• 5 years ago

We've reached out to Cloudflare to get them to take it down but nothing has been done.

By “reached out”, I assume you don't mean “filed a DMCA takedown notice and, when they failed to take down the infringing material, filed a contributory copyright infringement lawsuit seeking both damages and a permanent injunction against Cloudflare making the infringing content available.”

But I wonder why not? If there is a good reason not to, though, its probably also the reason that Cloudflare knows they can ignore you.

GaryTang• 5 years ago

Huge win for the people!

cm2187• 5 years ago

But surely cloudflare is required to pass on a DMCA takedown notice to the offending website? Otherwise they are acting as a sort of reverse VPN, hiding the website real IP/identity.

judge2020• 5 years ago

2. Cloudflare’s security services also do not materially contribute to infringement. From the perspective of a user accessing the infringing websites, these services make no difference. Cloudflare’s security services do impact the ability of third parties to identify a website’s hosting provider and the IP address of the server on which it resides. If Cloudflare’s provision of these services made it more difficult for a third party to report incidents of infringement to the web host as part of an effort to get the underlying content taken down, perhaps it could be liable for contributory infringement. But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.

https://storage.courtlistener.com/recap/gov.uscourts.cand.33...

pyuser583• 5 years ago

Cloudflare has marketed themselves as “reverse VPN” in the past

dredmorbius2• 5 years ago

The aspect of this case that stands out to me is that copyright is claimed in clothing and fashions: "counterfeit retailers that sell knock-off dresses using the plaintiffs' copyrighted images", a claim traditionally well outside copyright, and at best quite grey. Copyright covers works of original authorship but not either ideas or functional aspects of design.

See the strong-IP case from the Copyright Alliance, who can at best muster an "it depends":

There are some mixed messages out there about whether fashion designs are eligible for copyright protection. Some experts would say “no,” others would say “yes,” and they’re both right it depends.

https://copyrightalliance.org/education/qa-headlines/copyrig...

In the US, such protections are still only at the "being considered" stage as best I can tell:

The major amendment, of course, would be the extension of design protection to fashion designs, by amending § 1301(a) to provide that “A fashion design is subject to protection under this chapter” and by amending § 1302(b) to include “an article of apparel” in the definition of “useful articles” subject to protection.

https://www.copyright.gov/docs/regstat072706.html

As the Copyright office's discussion notes, there are non-expressive protections in the specific case of ship hull designs (also in chip masks). But fashion itself has remained largely a copyright-free zone.

The proposed language did not enter into US law as evideced at Cornell's USC server:

https://www.law.cornell.edu/uscode/text/17/1301

Cloudflare has secured this round without challenging the copyrightability of the alleged infinged works themselves, but probably also has that arrow in their quivver should they need to invoke it. The court's decision here is actually a broader protection for Cloudflare (it would apply against any infringement claim), though it doesn't invalidate the plaintiff's IMO questionable fashion-based copyright claims.

wmf• 5 years ago

Putting aside fashion copyrights, it's a bad sign if a company is using somebody else's photos of somebody else's products to sell their knockoffs. They deserve to get nuked.

dredmorbius2• 5 years ago

Use of photos is straight up old-fashioned (so to speak) copyright infringement. No need for design copyright.

pessimizer• 5 years ago

Suppressing knockoffs is often the reason behind (and something hidden within) laws and treaties against counterfeits. Clear knockoffs, whose buyers know they are knockoffs, are not counterfeits any more than Monopoly money is counterfeit currency.

mshaler• 5 years ago

Digital vigilantism averted for now.

exabrial• 5 years ago

Granted, I don't like monopolies, but it should not have to. Right now Cloudflare is well-behaved, but Google was at one point in their history too.

otterley• 5 years ago

I have to say that I disagree with the holding in this order. Upon receipt of a DMCA infringement claim, CloudFlare could program its edge servers to deny requests to the reported URLs. The fact that they could easily do this (but elect not to) and that if they did, it would probably (but not absolutely) prevent further infringing copies of the content from being made (even if the origin moved elsewhere) is sufficient to convince me that they are potentially liable for contributory infringement. Sometimes you have to work backwards from how the technology works to come to the correct conclusion, but the judge clearly failed to do that here.

The fact that such a denial wouldn't necessarily block access to the content at the origin server is irrelevant. Moreover, the holding also inexplicably ignores the fact that many origin servers only allow access to their desired CDN anyway. This is actually a very common configuration to avoid having the origin server being DOSed.

If I were the plaintiffs, I would almost certainly appeal this ruling to the 9th Circuit - and after hiring a much better attorney.

samat• 5 years ago

Cloudflare is founded by lawyers. So yes, I guess they have the best lawyers in business and it should be hell to fight them in court.

raxxorrax2• 5 years ago

Pretty sensible and important judgement considering how destructive and plentiful wrong DMCA claims alone have been.

mattbee3• 5 years ago

The judgment talks about Cloudflare's services in terms of caching, speed, security and so on, but seems to ignore the vital service that Cloudflare provide to shady sites - anonymity.

This victory adds to the impression that Cloudflare is a safe front to present content that would be taken down if hosted directly.

We understand that a "Front organization" for criminal activity isn't something to tolerate in bricks & mortar businesses - why is it allowed on the internet?

So while I don't particularly care for the wrongs of copyright takedowns, Cloudflare (or other US-based edge networks) surely shouldn't become a bulletproof legal shield for any person or company who can hide their origin?

(and Cloudflare still extend their services to the booter sites from whose illegal activities they've sold protection from! But that's not important right now...)

robertlagrant5• 5 years ago

Don't forget the real front - the physical device and screen that are the real fronts involved. Everything else - internet, caching, web server technology, operating system for web server, etc, is just a middleman.

mattbee3• 5 years ago

Haha exactly, you joke but...

If you want a society where it's even possible to take down "low-hanging" content, and where physical enforcement of that takedown might span international boundaries, the legal goalposts sometimes need to move.

And I feel like if we don't help move the technical and legal goalposts in a sympathetic manner - like recognising that a caching edge proxy is part of a site's hosting setup - we end up being part of the problem & pushing governments into more draconian solutions.

(I'm not sure why the litigants in this case were targeting Cloudflare, but I assumed because they have no other idea who is hosting these infringing sites)

So e.g. what does a legislature do if internet architecture has completely hardened towards privacy, such that edge proxies, whois, Facebook or whoever don't allow some visbility into the ultimate owner/publisher of a piece of content? They legislate what they can touch - the manufacture of the devices in our hands and on our laps, or the configuration of the access networks we all have to use.

uluyol• 5 years ago

According to the article, CF doesn't provide anonymity for websites that infringe copyright.

But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.

mattbee3• 5 years ago

That wasn't their first response - it had to go to court first!

I used to run a hosting company in the UK, and we have a precedent from 1996? where once a hosting company is informed of a libellous statement served from its network, it can be held jointly liable for it as publisher.

So it became quite common for UK hosting companies to take down sites on the slightest hint of a libel complaint.

And I (irresponsbibly) used to enjoy fielding these complaints, filtering out the chancers who were never going to sue, and telling them to get lost, bccin'g the customer. Legal indemnity is a nice service and our customers appreciated it.

eastdakota has done the same on a larger stage, and made more of cf's neutral, not-a-hosting-company, can't-catch-us attitude which plays well here. (and I'm not unsympathetic - except for the nazis and booters). But when cf are taking double-digit percentages of all internet traffic, they're can't & won't continue fielding every complaint in court.

rubyist5eva• 5 years ago

The judgment talks about Cloudflare's services in terms of caching, speed, security and so on, but seems to ignore the vital service that Cloudflare provide to shady sites - anonymity.

They aren’t really anonymous - CF knows who they are.

This victory adds to the impression that Cloudflare is a safe front to present content that would be taken down if hosted directly.

Not really, in the article it says that CF will notify the hosting provider of the infringing material.

smoyer• 5 years ago

One observation that's only become clear to me after reading the judge's opinions in this case is that the legal profession has come a long with in the last ten year with respect to understanding technologies and in recognizing useful analogies to existing case law.

IdontRememberIt• 5 years ago

For several month we have been facing continuous phishing attacks. The attackers are using cloudflare + Russian registrars + Russian hosting.

Can you guess who never cut the service (but other two react very quickly)?

animex• 5 years ago

So this means Cloudflare can ignore DCMA takedowns?

dragonwriter2• 5 years ago

yes, the DMCA safe harbor relies on underlying potential liability to motivate compliance; without it there is no reason to bother. Which is why providers often are more lax about counternotice procedures, because they have already structured user agreements so that they have no liability for an unnecessary takedown, so the safe harbor on the user side doesn't matter.

Knowing you aren't liable on the content owner side for particular content means the DMCA takedown process is irrelevant to you.

askbjoernhansen• 5 years ago

If Cloudflare was an email provider everyone would be blocking them for sending too much spam and not caring about it.

Cloudflare doesn’t have to cut off copyright-infringing websites, judge rules

Related Stories