Viacom to Get Copy of Every Record of Every Access to Every YouTube Video?:
The Electronic Frontier Foundation has a page up here, referring to this district court decision. At first blush, I think that the Video Privacy Protection Act prohibits this; the Google/EFF analysis provided in the link strikes me as correct, and the decision as incorrect.
'NAME and IP address' ??? WTF makes them think Youtube has any ability to know ( or report ) NAMES ( real ones ) of viewers ? 99% of all views will provide no name ( only an IP at most, which may very often be dynamic, chaning for every user session ), and the rest only an IP - no way to identify any user.
What about userIDs for users that are logged in?
Also a bagpipe trio doing Scotland the Brave along with a bongo group at a Renaissance Festival.
Maybe I should get a lawyer?
They received a list of all videos (whether still up or removed), the number of times viewed, and, most importantly, the number of times viewed by IP address.
That allows them to track what videos were watched by what IP address. That is a bonanza for Viacom's marketers. They don't care if Joe Smith from Duluth, Minnesota watched some piece of Star Wars fan cinema. What they care about is that 204.1.1.1 watched that cinema 15 times and watched Family Guy clips.
Or that 75% of the IP addresses who watched a YouTube of the trailer for a Paramount film (say, Indy 4) also went to the (Viacom controlled) film website.
The litigation team is probably trying to show a Grokster-style reliance by You-tube on pirated content.
(Emphasis added.)
This potentially links the viewers to the third-party websites they browse.
This is especially troublesome in the case of political videos embedded on political websites.
And there is no real guarantee that this logging data will not be acquired by, for instance, the governments of Pakistan, Egypt or Syria, to name but a few regimes who would appear willing to expend intelligence resources to acquire this data.
A law dog - Yes, they could do some ROUGH analysis of repeat hits / per user hits based on IP - exccept for dial-up users, who's IP changes at every session.
yes, there is potential for data mining in it - but who do they then target ? Ip # 123.23.45.87 ? How do they ever 'connect' to that viewer ? How do they know it's not a totally differenr person than before ? etc etc.
Viacom also wanted "the computer source code which
controls both the YouTube.com search function and Google’s
internet search tool “Google.com”."
yeh, OK - that will be a cold day in hell, when Google gives up its search algorythm source code ... uh huh.
The same could be said for Volokh screennames: a user can pick absolutely anything. And yet many of the screenames are personally identifiable. See, e.g., "orinkerr", "Paul Milligan," etc.
They're not going to mail that person a letter saying "We saw you really love Hannah Montana, please buy this lunchbox!"
Instead they will see that 75% of Hanna Montana watchers also watch at least 4 videos of Artist X or clips from TVShow Y. It's one thing to know that TVShow Y has a zillion views; it's something wholly more useful to know that 90% of those viewers are tweens.
Oftentimes Volokh screennames are bogus. Also, you are ignoring the real issue. Many people use YouTube for free porn.
IOW, if a video was removed from Youtube due to a DMCA take-down notice or similar FROM SOME OTHER COPYRIGHT HOLDER, the Judge just ordered Google/YT to VIOLATE THE DMCA by distributing a copy of it ( millions of them ) AFTER having been given proper notice of copyright infringement.
Swift move, Judgy. Real likely to stand up on appeal.
Sensible - newsgroups are a much better source of free porn. Or at least I heard that somewhere :-)
.
LOL
Furthermore, there is a very simple solution to fixing the problem by making the data non-identifiable but making it completely equal in usefulness to Viacom: replace the IP addresses and user IDs with unique randomly generated numbers. That will still tell Verizon the information it wants to know, without giving out personally identifiable information.
I really hope mandamus is sought.
Is Google destroying the data as soon as practicable? I rather doubt it. They seem to be trying to have their cake and eat it too, in regard to defining personally identifiable information. The statement, "The reality is though that in most cases, an IP address without additional information cannot [identify a person]", which the judge cites, seems to imply that the judge sees it this way. Google, afterall, tends to collect a significant amount of information about it's customers for use in creating ad service algorithms and the like. That does not seem to fall under the "ordinary course of business" allowed uses of "debt collection activities, order fulfillment, request processing, and the transfer of ownership."
Of course, the decision does not actually examine the factual, technical, question of whether IP addresses are personally identifiable information.
Well played.
From decoded packet capture:
Note that this is not a request to view the video, just a request for the top-level page where the video is embedded.
In other words, this order appears to turn over the IP addresses for everyone who read Volokh on a regular basis.
No no no. There's nothing in the DMCA that penalizes ISPs for complying with discovery orders. All the DMCA (Section 512, anyway) does is immunize ISPs from contributory liability they might arguably face without the DMCA -- it leaves the rest of copyright law intact. And at the very least, good-faith compliance with a court order to produce materials in litigation would be a fair use of that material.
To those who claim that IPs are not identifying, that is only partially true. Although IPs do not identify a person, they can certainly be used as tools to try and ID persons. The RIAA has sued over 20,000 people based on IPs alone. While their claim that IPs identify people is shaky, the IPs have none the less led to financial harm to people the RIAA claims to be associated with those IDs.
It may be possible, with effort and some luck, to identify the person behind a specific IP without gaining access to the ISPs records, but it's not as clear-cut as you seem to be saying.
I think that's actually a pretty brilliant suggestion. I wonder if anyone knows the answer to the question that was raised.
Here are some variations:
- Don't print the info. Send the job to India and hire a very large number of people to write the info in many different handwriting styles.
- Print the info using captcha techniques that make it resistant to OCR.
And then you can watch YouTube's lawyers get sanctioned. Paper documents are "allowable", but if documents are kept in the ordinary course electronically, you normally have to produce them electronically. This is especially true when there are big advantages usability-wise to keeping documents electronically, such as the ability to search them electronically.
But can I watch that on youtube?
OK, that suggests a different answer, which would (sort of) meet the requirement of keeping it electronic: floppy disks. Obviously there are many variations. Syquest cartridges? Iomega's Zip, or Jaz?
No need to go all the way back to punch cards or paper tape.
OK, I realize I'm exaggerating. But I bet there are some interesting stories about folks trying to play games like this.
1: The problem is that evidentiary rulings can't be immediately appealed, so there's nothing Google can do within the case to avoid having to turn over the records.
2: However, the judge's decision appears to violate VPPA, and I have to wonder if there's a crazy 4th amendment violation theory as well (VPPA is more solid). VPPA was passed to protect the privacy rights of viewers.
3: Therefore, a consumer, preferably EFF, should sue Judge Stanton under 1983 using either or both theories, requesting injunctive relief and a preliminary injunction. That gets heard immediately, and if denied, is immediately appealable. I don't know my federal court rules well enough to know whether it has to be filed in SDNY or if the consumer plaintiff can go forum shopping.
Suing a judge is usually a bad idea for a number of reasons (the judiciary doesn't take kindly to it, and that's not even the top of the list). The straightforward approach is intervention in the litigation.
Very smart observation.
And as others have mentioned, the data is very valuable in revealing patterns and associations, even if individuals are not identified.
Something else that I think hasn't been mentioned: don't IP addresses generally reveal geography? Not my street address, but my county, region or country (at least). That's valuable info for marketers.
What effect can you have by joining in the litigation? I guess you can ask the judge to reconsider, but you still can't appeal or get a different judge. I realize suing a judge isn't a great option, but in this case, it seems to be the only option, and certainly the one that'll speed this faster to, say, the 2d Circuit.
The problem is that there doesn't seem to be a good way for a 3rd party to challenge a hideously bad evidentiary ruling that violates the 3rd party's rights under the current federal system. It's certainly a less dangerous solution than Google withholding the data and hoping to appeal the contempt charge.
Especially if the third party lives in Turkey, and has been following Wired's advice to use OpenDNS to evade Turkey's censorship.
The good news is that the Turks probably won't shoot someone just for watching a Kurdish (PKK) video. But, in hindsight, it was bad advice and Wired shouldn't have given it.
I wouldn't be so sanguine about the Tunisians, but otoh, Tunisia's capability to bribe one of Viacom's lawyers is probably fairly limited.
All in all though, some 81-year-old senile judge's "protective order" doesn't really have a lot of deterrent effect to a motivated adversary or a greedy lawyer.
If everyone is lucky, then Viacom's recent $500 million deal with Microsoft means MS has an exclusive on the data.
A likely long-term result of all this approved tracing info is that many/most people will eventually be forced to use off-shore anonomizing proxies for all internet activity.
I see a lucrative future for nations who can say "no" to US requests for tracing info.
-----
I think freedom and liberty are fragile rights, easily eroded. Much has been lost already.
proxy server.
I'm a bit skeptical that a "subscriber" is created merely by creating a user ID and password. To me, the term subscription implies an exchange of consideration of some form. Although I hope I'm wrong as it applies to this dispute...
- ET!
An IP != a person. I don't mean to suggest otherwise. But, an IP can be used by a litigious putative copyright owner (the RIAA, for instance, in well over 20,000 suits) to claim liability and demand extortionate settlements.
So, while an IP does not equal a person's identity, it is part of a nexus of information that may be used to track down an ISP accountholder and claim they are liable for the activities associated with that IP. So, there is a real issue of liability even though IP's are not a reliable indicator of who is viewing a particular video.
Click the link to hear Lee Greenwood's tribute to our nation and to the men who died to keep it free, GOD BLESS THE USA, aka, PROUD TO BE AN AMERICAN: http://www.sceniclasvegas.com/proud_to_be.html
God Bless The USA
If tomorrow all the things were gone
I'd worked for all my life,
And I had to start again
with just my children and my wife,
I'd thank my lucky stars
to be living here today,
'Cause the flag still stands for freedom
and they can't take that away.
I'm proud to be an American
where at least I know I'm free,
And I won't forget the men who died
who gave that right to me,
And I gladly stand up next to you
and defend her still today,
'Cause there ain't no doubt I love this land
GOD BLESS THE USA
From the lakes of Minnesota
to the hills of Tennessee,
Across the plains of Texas
from sea to shining sea.
From Detroit down to Houston
and New York to L.A.,
There's pride in every American heart
and it's time we stand and say:
I'm proud to be an American
where at least I know I'm free,
And I won't forget the men who died
who gave that right to me,
And I gladly stand up next to you
and defend her still today,
'Cause there ain't no doubt I love this land
God Bless the U. S. A.
Lee Greenwood
(Compliments of http://genelalor.com/)
As far as user names and IP addresses go together they are enough to enable any drunk 12 year old computer nerd to track down many of the individuals. While many people don't use their real names they rarely come up with new handles for every site and even then use slight modifications. Between the general geographic area discernible from their IP address and a google search on similar strings to their handle you can probably get almost 50% of youtube users tracked down to their other online accounts.
If you want to get fancy and apply clever statistical matching algorithms and compare writing samples and stuff you could probably get most youtube users.
--- There is something majorly wrong when a law is felt to be 'more solid' than the Constitution.
Perhaps this is one more reason why lawyers and congress critters are held in such low esteem by average people?
Especially when a portion of the Constitution is being referred to as something 'crazy'.
http://www.youtube.com/watch?v=bNssIhS7ATc&feature=related
According to the YouTube Privacy Notice, they log this information because, among other reasons:
Does Volokh.com or its service provider, Power Blogs(*), log every HTTP GET request and result? It would be common, and unsurprising if they do.
But why does Volokh.com log that data?
(*) Incidentally, PowerBlogs is endorsed by Eugene Volokh: “I highly recommend it.”
...unless I'm missing something, which is always a possibility. :)