Cowardly Mismanagement of DMCA Takedown Notices by Domestic ISPs

Posted on 02 February 2010, 1 month, 8 days ago.

I will have to move my hosting overseas. The situation in US is no longer free enough to meet my computing needs. It isn't the actual law but the systematic, overreaching cooperation of ISPs with media firms that has limited my freedom to support innovative and vital services.

Motivated by my strong opinions about human rights, I resolved to operate a tor exit node on my virtual private server. I believe that donating bandwidth to support freedom of speech and expression to those trapped behind authoritarian firewalls or regimes is the decent thing to do. At the risk of sounding trite, I think that it is the American thing to do.

I knew that there would likely be problems and I prepared myself for them. I read all the information I could find about the legal status of tor in the US and the recommended techniques for limiting DMCA complaints. My exit policy blocked the most common file sharing ports. The router has a dedicated IP address whose reverse DNS announced it's function (tor-proxy.nocko.net). I host an informative website at that address explaining tor and the current legal opinions on the operation of the router and contact info for complaints or questions.

Within 48 hours, my ISP contacted me with a DMCA takedown request. I promptly replied with a modified EFF boilerplate response letter. My ISP accepted this and I thought we were both ready to move on... Twelve hours later I received notification of the second complaint.

I had realised that my router would statistically be likely to carry unsavoury content, like all the internet backbone routers and millions of infected home computers. Regardless, I believe that giving the common person access to safe, reliable anonymous communication software is worth the cost of a few people abusing it and the slight hassle of informing media corporations about the nature and importance of tor. However, I underestimated the swift, autonomic spam response from media firms and the truly disturbing reaction of my ISP.

Returning to my story, a large media conglomerate had erroneously identified my IP address as illegally hosting copyrighted content. My host is serving no such content. I replied again with a modified version of the EFF boilerplate. Upon receiving the second response, my ISP informed me that while "Tor is not specifically excluded", that I am responsible for all traffic that flows through my node in accordance with their terms of service. They threatened termination if I did not modify the service such that further complaints were not received. The dialog with my ISP is mirrored here.

While I understand that businesses may enforce their own policies, my ISP would like to remain blameless. They claim that they are merely executing their responsibilities under the DMCA. However, their poorly qualified "terms of service" is not the same as US law. Under the law it is the opinion of the EFF (and myself) that a tor router is just like any non-tor router on the internet. Routers  don't store or inspect packets, they just pass them to their destination as requested. Service providers and other routing entities are protected via DMCA section 512(a), which describes "safe harbour" provisions. While I am prepared to honour all of the requirements for a service provider under the law, it is my ISP that will not allow this to continue. They seem to be confusing alleged copyright infringement with some sort of crime, when my use case is clearly a legal one.

It is also clear under the law that my ISP is completely insulated from liability for my actions, even if the courts were to disagree with my interpretation of the law. They are only required to continue business as normal and (perhaps) notify me when complaints arrive, so that I may respond. Still they refuse to support their customer. Why should this be? What reason would a ISP immune from criminal and civil penalties have to defer all judgement to a third-party whose evidence is demonstrably wrong?

I tried, for a time, to convince my hosting company that they should enforce their ToS in closer accordance with the law. They have decided to stick with their arbitrary notion that I am responsible for all traffic that flows through my router. They maintain this position even though they are not responsible for all the traffic that flows through their routers, nor is their ISP.

I assumed that perhaps my ISP, being a modestly sized company, was the exception rather than the rule. I doubt that my hosting company has a well staffed legal department... I set about searching for a US firm that would host my router. However, after several hours of searching I was unable to find an ISP in the United States that would allow my use case, just a list of ISP horror stories. It seems impossible to host a tor exit node in the United States unless your are large enough to be your own ISP.

Traditionally it is the affirmative side that carries the burden of proof, but domestic service providers have removed this burden. They blindly obey the auto-generated form letters from alleged copyright owners. Loyal customers are judged guilty and threatened without a bit of evidence or a chance to defend themselves. It paints a disturbing picture: mere conjecture from an extremely biased third-party is the new rule of evidence for DMCA enforcement, since all domestic ISPs enforce an arbitrary superset of the DMCA.

We often look to other countries for examples of censorship, but things are not so different here. I am being censored by my ISP based upon the provably false accusations of a media corporation. While the DMCA was bad legislation, it can't bear full responsibility for our current state of affairs. The de facto law of the land is no-proof, customer termination. This is enabled by weak-willed and lazy domestic service providers. While three strikes laws for infringement accusations are currently facing international backlash, we must work to end service provider complacency which already delivers the worst consequences of three strikes to US consumers.