pageok
pageok
pageok
Viacom to Get Copy of Every Record of Every Access to Every YouTube Video?:
The Electronic Frontier Foundation has a page up here, referring to this district court decision. At first blush, I think that the Video Privacy Protection Act prohibits this; the Google/EFF analysis provided in the link strikes me as correct, and the decision as incorrect.
A Law Dawg:
What a cheaply purchased treasure trove of marketing data Viacom just got.
7.3.2008 2:50pm
Paul Milligan (mail):
Viacom got nothing.

'NAME and IP address' ??? WTF makes them think Youtube has any ability to know ( or report ) NAMES ( real ones ) of viewers ? 99% of all views will provide no name ( only an IP at most, which may very often be dynamic, chaning for every user session ), and the rest only an IP - no way to identify any user.
7.3.2008 3:43pm
OrinKerr:
Paul,

What about userIDs for users that are logged in?
7.3.2008 3:45pm
Richard Aubrey (mail):
I watched a couple of Tennesee Ernie Ford videos. Am I in trouble?
Also a bagpipe trio doing Scotland the Brave along with a bongo group at a Renaissance Festival.
Maybe I should get a lawyer?
7.3.2008 3:46pm
A Law Dawg:
Paul,

They received a list of all videos (whether still up or removed), the number of times viewed, and, most importantly, the number of times viewed by IP address.

That allows them to track what videos were watched by what IP address. That is a bonanza for Viacom's marketers. They don't care if Joe Smith from Duluth, Minnesota watched some piece of Star Wars fan cinema. What they care about is that 204.1.1.1 watched that cinema 15 times and watched Family Guy clips.

Or that 75% of the IP addresses who watched a YouTube of the trailer for a Paramount film (say, Indy 4) also went to the (Viacom controlled) film website.
7.3.2008 3:54pm
Sensible Lawyer (mail):
Dude. I use YouTube for free porn. This is a problem.
7.3.2008 3:54pm
A Law Dawg:
When I say "They", of course, I mean "Viacom marketers."

The litigation team is probably trying to show a Grokster-style reliance by You-tube on pirated content.
7.3.2008 3:55pm
RobertS:
From the order:

(4) The motion to compel production of all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website is granted;


(Emphasis added.)

This potentially links the viewers to the third-party websites they browse.

This is especially troublesome in the case of political videos embedded on political websites.

And there is no real guarantee that this logging data will not be acquired by, for instance, the governments of Pakistan, Egypt or Syria, to name but a few regimes who would appear willing to expend intelligence resources to acquire this data.
7.3.2008 3:56pm
Paul Milligan (mail):
Orin - the Google / Youtube 'userid' is in effect annoymous - it is a user-selected name and pwd, with no verificaiton of any kind. You could go create an account as 'BarneyFife27' right now. Unless it's taken :-)

A law dog - Yes, they could do some ROUGH analysis of repeat hits / per user hits based on IP - exccept for dial-up users, who's IP changes at every session.

yes, there is potential for data mining in it - but who do they then target ? Ip # 123.23.45.87 ? How do they ever 'connect' to that viewer ? How do they know it's not a totally differenr person than before ? etc etc.


Viacom also wanted "the computer source code which
controls both the YouTube.com search function and Google’s
internet search tool “Google.com”."

yeh, OK - that will be a cold day in hell, when Google gives up its search algorythm source code ... uh huh.
7.3.2008 4:06pm
OrinKerr:
Paul,

The same could be said for Volokh screennames: a user can pick absolutely anything. And yet many of the screenames are personally identifiable. See, e.g., "orinkerr", "Paul Milligan," etc.
7.3.2008 4:10pm
A Law Dawg:
there is potential for data mining in it - but who do they then target ? Ip # 123.23.45.87 ? How do they ever 'connect' to that viewer ?


They're not going to mail that person a letter saying "We saw you really love Hannah Montana, please buy this lunchbox!"

Instead they will see that 75% of Hanna Montana watchers also watch at least 4 videos of Artist X or clips from TVShow Y. It's one thing to know that TVShow Y has a zillion views; it's something wholly more useful to know that 90% of those viewers are tweens.
7.3.2008 4:18pm
Robert Bork (mail):
Orin,

Oftentimes Volokh screennames are bogus. Also, you are ignoring the real issue. Many people use YouTube for free porn.
7.3.2008 4:19pm
Paul Milligan (mail):
Further ( pp 10 - 11 ) "Under the circumstances, the motion to compel production of copies of all removed videos is granted."

IOW, if a video was removed from Youtube due to a DMCA take-down notice or similar FROM SOME OTHER COPYRIGHT HOLDER, the Judge just ordered Google/YT to VIOLATE THE DMCA by distributing a copy of it ( millions of them ) AFTER having been given proper notice of copyright infringement.

Swift move, Judgy. Real likely to stand up on appeal.
7.3.2008 4:19pm
Robert Bork (mail):
Yes, this is a bogus screenname, to anticipate the Humorless Commenter.
7.3.2008 4:20pm
Jorge Schmidt:
Does anyone know whether the court entered a protective order governing Viacom's access to and use of the data? Is it limited to its litigation of this case?
7.3.2008 4:25pm
Paul Milligan (mail):
Orin - this is true, and the EFF makes that point, that that brings it under VPPA privacy protection. Valid point. I was thinking of the other side of the coin, the RIA / MPAA kind of 'who do we sue next' viewpoint.

Sensible - newsgroups are a much better source of free porn. Or at least I heard that somewhere :-)
7.3.2008 4:28pm
Sock Puppet (mail):
-- Yes, this is a bogus screenname, to anticipate the Humorless Commenter. --
.
LOL
7.3.2008 4:29pm
Paul Milligan (mail):
Robert Bork - what was the real story about that Coke can, anyway ? And has VC now been officially Borked ?
7.3.2008 4:33pm
zooba:
Judge really screwed up the issue of whether IP addresses were identifiable. Google and most people admit that MOST IP addresses are non-identifiable BY THEMSELVES. SOME IP addresses are identifiable BY THEMSELVES, specifically static ip addresses. However, ALMOST ALL IP addresses can be identifiable if you also give the time during which the IP addresss was used, which is exactly what the logging database contains. With the IP address + time, all you have to do is ask/subpoena the ISP for the user information for that user.

Furthermore, there is a very simple solution to fixing the problem by making the data non-identifiable but making it completely equal in usefulness to Viacom: replace the IP addresses and user IDs with unique randomly generated numbers. That will still tell Verizon the information it wants to know, without giving out personally identifiable information.

I really hope mandamus is sought.
7.3.2008 4:36pm
Originalism Is Useful (mail):
Newsgroups? I heard libertarian judges are the best source of free porn.
7.3.2008 4:42pm
Gregory Conen (mail):
Consider section (e) of the same, which requires that records of personally identifiable information to destroyed "as soon as as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected".

Is Google destroying the data as soon as practicable? I rather doubt it. They seem to be trying to have their cake and eat it too, in regard to defining personally identifiable information. The statement, "The reality is though that in most cases, an IP address without additional information cannot [identify a person]", which the judge cites, seems to imply that the judge sees it this way. Google, afterall, tends to collect a significant amount of information about it's customers for use in creating ad service algorithms and the like. That does not seem to fall under the "ordinary course of business" allowed uses of "debt collection activities, order fulfillment, request processing, and the transfer of ownership."

Of course, the decision does not actually examine the factual, technical, question of whether IP addresses are personally identifiable information.
7.3.2008 4:47pm
A Law Dawg:
Newsgroups? I heard libertarian judges are the best source of free porn.


Well played.
7.3.2008 4:52pm
wireshark user (www):
As I just verified, merely browsing to a recent volokh.com archive page results in a HTTP request for the YouTube video embedded on that page.

From decoded packet capture:
GET /v/xiMoKAybo1A&hl=en HTTP/1.1
Host: www.youtube.com


Note that this is not a request to view the video, just a request for the top-level page where the video is embedded.

In other words, this order appears to turn over the IP addresses for everyone who read Volokh on a regular basis.
7.3.2008 5:04pm
Bruce:
IOW, if a video was removed from Youtube due to a DMCA take-down notice or similar FROM SOME OTHER COPYRIGHT HOLDER, the Judge just ordered Google/YT to VIOLATE THE DMCA by distributing a copy of it ( millions of them ) AFTER having been given proper notice of copyright infringement.

No no no. There's nothing in the DMCA that penalizes ISPs for complying with discovery orders. All the DMCA (Section 512, anyway) does is immunize ISPs from contributory liability they might arguably face without the DMCA -- it leaves the rest of copyright law intact. And at the very least, good-faith compliance with a court order to produce materials in litigation would be a fair use of that material.
7.3.2008 5:06pm
Glen Campbell (mail) (www):
I think YouTube/Google should print out each and every one of those names and IP addresses (maybe one per page) and deliver it to Viacom's headquarters. Paper documents are allowable in discovery, right?
7.3.2008 5:11pm
Dave N (mail):
Paul Milligan wrote:
Robert Bork - what was the real story about that Coke can, anyway ?
Um, you are mistaking Robert Bork with Clarence Thomas, unless you are suggesting that Justice Thomas peruses the VC using the nom de plume "Robert Bork."
7.3.2008 5:13pm
Scote (mail):
This seems very odd. What legitimate use is their for Viacom to need to know unique ID's of **viewers**? In their suit against Google, Viacom only needs to prove number of views of commercial videos vs. user content, not an ID of the viewers. Thus the discovery is overbroad.

To those who claim that IPs are not identifying, that is only partially true. Although IPs do not identify a person, they can certainly be used as tools to try and ID persons. The RIAA has sued over 20,000 people based on IPs alone. While their claim that IPs identify people is shaky, the IPs have none the less led to financial harm to people the RIAA claims to be associated with those IDs.
7.3.2008 5:16pm
Gregory Conen (mail):
@Scote: The RIAA got most of the identities from subpoenias to ISPs and similar organizations. I'm hardly an expert, but it seems as though that might make them not "personally identifiable information"; the text of the law is rather unclear.

It may be possible, with effort and some luck, to identify the person behind a specific IP without gaining access to the ISPs records, but it's not as clear-cut as you seem to be saying.
7.3.2008 5:29pm
Fub:
Richard Aubrey wrote at 7.3.2008 2:46pm:
I watched a couple of Tennesee Ernie Ford videos. Am I in trouble?
Only if he was playing viola. That would put you in possession of classified information.
Also a bagpipe trio doing Scotland the Brave along with a bongo group at a Renaissance Festival.
Maybe I should get a lawyer?
Naa. Just lay low and avoid the music police.
7.3.2008 5:36pm
Pliny (mail):
The slashdotters are raising an interesting issue about consequences in the EU for Google. As has been mentioned here in the past, they're not that big on people's IP addresses and user history being thrown around.
7.3.2008 5:36pm
CrazyTrain (mail):
A Law Dog -- I would agree that this would indeed be a "treasure trove" of information for Viacom marketing. HOWEVER, the production of this information (if it goes forward) will certainly be under a standard protective order governing dissemination of the information, which would likely not allow Viacom marketing to see the information, and if they can see it, they almost certainly will not be allowed to use it for purposes other than as directly related to this specific litigation.
7.3.2008 5:43pm
jukeboxgrad (mail):
"I think YouTube/Google should print out each and every one of those names and IP addresses (maybe one per page) and deliver it to Viacom's headquarters. Paper documents are allowable in discovery, right?"

I think that's actually a pretty brilliant suggestion. I wonder if anyone knows the answer to the question that was raised.

Here are some variations:

- Don't print the info. Send the job to India and hire a very large number of people to write the info in many different handwriting styles.

- Print the info using captcha techniques that make it resistant to OCR.
7.3.2008 5:58pm
CrazyTrain (mail):
I think YouTube/Google should print out each and every one of those names and IP addresses (maybe one per page) and deliver it to Viacom's headquarters. Paper documents are allowable in discovery, right?

And then you can watch YouTube's lawyers get sanctioned. Paper documents are "allowable", but if documents are kept in the ordinary course electronically, you normally have to produce them electronically. This is especially true when there are big advantages usability-wise to keeping documents electronically, such as the ability to search them electronically.
7.3.2008 6:04pm
jukeboxgrad (mail):
Thanks for that helpful and prompt explanation. I should have realized it was too easy to be real.
7.3.2008 6:10pm
jukeboxgrad (mail):
"And then you can watch YouTube's lawyers get sanctioned."

But can I watch that on youtube?
7.3.2008 6:11pm
A Law Dawg:
The judge's order says the information is 12 terabytes. That's a lot of Indian scribes.
7.3.2008 6:12pm
A Law Dawg:
Crazy Train apparently attends the E-Discovery CLE's I keep getting spam for. Thanks for that!
7.3.2008 6:13pm
jukeboxgrad (mail):
"12 terabytes"

OK, that suggests a different answer, which would (sort of) meet the requirement of keeping it electronic: floppy disks. Obviously there are many variations. Syquest cartridges? Iomega's Zip, or Jaz?

No need to go all the way back to punch cards or paper tape.

OK, I realize I'm exaggerating. But I bet there are some interesting stories about folks trying to play games like this.
7.3.2008 6:37pm
NYU JD:
Here's an idea to stop this:

1: The problem is that evidentiary rulings can't be immediately appealed, so there's nothing Google can do within the case to avoid having to turn over the records.

2: However, the judge's decision appears to violate VPPA, and I have to wonder if there's a crazy 4th amendment violation theory as well (VPPA is more solid). VPPA was passed to protect the privacy rights of viewers.

3: Therefore, a consumer, preferably EFF, should sue Judge Stanton under 1983 using either or both theories, requesting injunctive relief and a preliminary injunction. That gets heard immediately, and if denied, is immediately appealable. I don't know my federal court rules well enough to know whether it has to be filed in SDNY or if the consumer plaintiff can go forum shopping.
7.3.2008 6:47pm
CiarandDenlane (mail):
NYU JD:

Suing a judge is usually a bad idea for a number of reasons (the judiciary doesn't take kindly to it, and that's not even the top of the list). The straightforward approach is intervention in the litigation.
7.3.2008 7:10pm
Alan Bunbury (mail):
The remedy seems to be extremely disproportionate to the mischief being remedied. Considering that not all YouTube viewers are illegally viewing copyrighted Viacom material, it would seem to me that the violation of users' privacy is excessive. The VPPA argument against the decision is also interesting; I don't know much about that Act but the EFF are pretty convincing on their page and I would like to see a case taken by them, as consumers, to secure injunctive relief protecting their right to privacy.
7.3.2008 7:27pm
bdeck22 (mail):
What ever happened to threatening boycotts?
7.3.2008 8:23pm
Dr. T (mail) (www):
yes, there is potential for data mining in it - but who do they then target ? Ip # 123.23.45.87 ? How do they ever 'connect' to that viewer ? How do they know it's not a totally differenr person than before ? etc etc.
Viacom can conduct contests and 'give-aways' on a variety of web pages (that don't have to reveal connections to Viacom) designed to appeal to certain subsets of Internet users. These contests and give-aways would require registration, and then Viacom would have IP addresses and registrations that it can match to the YouTube database.
7.3.2008 8:59pm
Humble Law Student (mail) (www):
Oh God, this will be humiliating when people get to see that I've watched Kate Perry's "I Kissed a Girl" about ten times.
7.3.2008 9:01pm
E:
Humble Law Student, the logs won't reveal whether you liked either "it" or the taste of her cherry chapstick.
7.3.2008 9:17pm
jukeboxgrad (mail):
"then Viacom would have IP addresses and registrations that it can match to the YouTube database"

Very smart observation.

And as others have mentioned, the data is very valuable in revealing patterns and associations, even if individuals are not identified.

Something else that I think hasn't been mentioned: don't IP addresses generally reveal geography? Not my street address, but my county, region or country (at least). That's valuable info for marketers.
7.3.2008 9:51pm
NYU JD:
CiarandDenlane:

What effect can you have by joining in the litigation? I guess you can ask the judge to reconsider, but you still can't appeal or get a different judge. I realize suing a judge isn't a great option, but in this case, it seems to be the only option, and certainly the one that'll speed this faster to, say, the 2d Circuit.

The problem is that there doesn't seem to be a good way for a 3rd party to challenge a hideously bad evidentiary ruling that violates the 3rd party's rights under the current federal system. It's certainly a less dangerous solution than Google withholding the data and hoping to appeal the contempt charge.
7.3.2008 9:55pm
H Bowman, MD:
If the data must be provided electronically, I think I have some 160kb 5.25" floppies left in the garage. I'll send them to Google to help.
7.3.2008 10:02pm
cynical:
The problem is that there doesn't seem to be a good way for a 3rd party to challenge a hideously bad evidentiary ruling that violates the 3rd party's rights under the current federal system.


Especially if the third party lives in Turkey, and has been following Wired's advice to use OpenDNS to evade Turkey's censorship.

The good news is that the Turks probably won't shoot someone just for watching a Kurdish (PKK) video. But, in hindsight, it was bad advice and Wired shouldn't have given it.

I wouldn't be so sanguine about the Tunisians, but otoh, Tunisia's capability to bribe one of Viacom's lawyers is probably fairly limited.

All in all though, some 81-year-old senile judge's "protective order" doesn't really have a lot of deterrent effect to a motivated adversary or a greedy lawyer.

If everyone is lucky, then Viacom's recent $500 million deal with Microsoft means MS has an exclusive on the data.
7.3.2008 10:22pm
Sandy G (mail):
People who knowingly upload and make available infringing content should be punished. The rest of all this tumult is a privacy-invading outrage. The judges and lawyers (and bloggers) who attempt to approve this little category or that little category do not understand the actual possibilities for data correlation techniques.

A likely long-term result of all this approved tracing info is that many/most people will eventually be forced to use off-shore anonomizing proxies for all internet activity.

I see a lucrative future for nations who can say "no" to US requests for tracing info.
-----

I think freedom and liberty are fragile rights, easily eroded. Much has been lost already.
7.3.2008 10:50pm
George Weiss (mail) (www):
two words:

proxy server.
7.3.2008 11:18pm
enjointhis:
Hm, I'm probably missing something but... The statute protects records of "consumers," a term that is defined in §2710(a)(1) as a "renter, purchaser, or subscriber of goods or services from" the provider. Your everyday YouTube viewers are probably not renting or purchasing from YouTube; so the statutory protection kicks in only if they're "subscribers."

I'm a bit skeptical that a "subscriber" is created merely by creating a user ID and password. To me, the term subscription implies an exchange of consideration of some form. Although I hope I'm wrong as it applies to this dispute...

- ET!
7.3.2008 11:59pm
Scote (mail):

Gregory Conen (mail):
@Scote: The RIAA got most of the identities from subpoenias to ISPs and similar organizations. I'm hardly an expert, but it seems as though that might make them not "personally identifiable information"; the text of the law is rather unclear.

It may be possible, with effort and some luck, to identify the person behind a specific IP without gaining access to the ISPs records, but it's not as clear-cut as you seem to be saying.


An IP != a person. I don't mean to suggest otherwise. But, an IP can be used by a litigious putative copyright owner (the RIAA, for instance, in well over 20,000 suits) to claim liability and demand extortionate settlements.

So, while an IP does not equal a person's identity, it is part of a nexus of information that may be used to track down an ISP accountholder and claim they are liable for the activities associated with that IP. So, there is a real issue of liability even though IP's are not a reliable indicator of who is viewing a particular video.
7.4.2008 12:14am
berlet98 (mail) (www):
HAPPY INDEPENDENCE DAY, AMERICA!

Click the link to hear Lee Greenwood's tribute to our nation and to the men who died to keep it free, GOD BLESS THE USA, aka, PROUD TO BE AN AMERICAN: http://www.sceniclasvegas.com/proud_to_be.html

God Bless The USA


If tomorrow all the things were gone

I'd worked for all my life,

And I had to start again

with just my children and my wife,

I'd thank my lucky stars

to be living here today,

'Cause the flag still stands for freedom

and they can't take that away.


I'm proud to be an American

where at least I know I'm free,

And I won't forget the men who died

who gave that right to me,

And I gladly stand up next to you

and defend her still today,

'Cause there ain't no doubt I love this land

GOD BLESS THE USA


From the lakes of Minnesota

to the hills of Tennessee,

Across the plains of Texas

from sea to shining sea.

From Detroit down to Houston

and New York to L.A.,

There's pride in every American heart

and it's time we stand and say:


I'm proud to be an American

where at least I know I'm free,

And I won't forget the men who died

who gave that right to me,

And I gladly stand up next to you

and defend her still today,

'Cause there ain't no doubt I love this land

God Bless the U. S. A.


Lee Greenwood


(Compliments of http://genelalor.com/)
7.4.2008 1:21am
TruePath (mail) (www):
Hmm, that's an interesting question. Do I become a renter/subscriber of a product by paying for it by watching adds? Still it does seem kinda week.

As far as user names and IP addresses go together they are enough to enable any drunk 12 year old computer nerd to track down many of the individuals. While many people don't use their real names they rarely come up with new handles for every site and even then use slight modifications. Between the general geographic area discernible from their IP address and a google search on similar strings to their handle you can probably get almost 50% of youtube users tracked down to their other online accounts.

If you want to get fancy and apply clever statistical matching algorithms and compare writing samples and stuff you could probably get most youtube users.
7.4.2008 4:22am
Mark E (mail):
" 2: However, the judge's decision appears to violate VPPA, and I have to wonder if there's a crazy 4th amendment violation theory as well (VPPA is more solid). VPPA was passed to protect the privacy rights of viewers. "

--- There is something majorly wrong when a law is felt to be 'more solid' than the Constitution.

Perhaps this is one more reason why lawyers and congress critters are held in such low esteem by average people?

Especially when a portion of the Constitution is being referred to as something 'crazy'.
7.4.2008 10:11am
CDR D (mail):
Busted. I confess. Might as well reveal my favorite here:

http://www.youtube.com/watch?v=bNssIhS7ATc&feature=related
7.4.2008 11:11am
Tony Tutins (mail):
The key question that hasn't been asked so far: Why is YouTube/Google keeping logs of this information in the first place? Libraries years ago made a practice to shred borrowers' records once the books were returned -- what doesn't exist can never be subpoena'd. But librarians as a profession are strongly committed to the freedom of information and the exercise of First Amendment rights.
7.4.2008 11:57am
xyzzy:
Why is YouTube/Google keeping logs of this information in the first place?


According to the YouTube Privacy Notice, they log this information because, among other reasons:
• We use both your personally identifiable information and certain non-personally-identifiable information (such as anonymous user usage data, cookies, IP addresses, browser type, clickstream data, etc.) to improve the quality and design of the YouTube Sites and to create new features, promotions, functionality, and services by storing, tracking, analyzing, and processing user preferences and trends, as well as user activity and communications.

• We use cookies, clear gifs, and log file information to: (a) store information so that you will not have to re-enter it during your visit or the next time you visit the YouTube Sites; (b) provide custom, personalized content and information; (c) monitor the effectiveness of our marketing campaigns; (d) monitor aggregate metrics such as total number of visitors, pages viewed, etc.; and (e) track your entries, submissions, and status in promotions, sweepstakes, and contests. [...]


Does Volokh.com or its service provider, Power Blogs(*), log every HTTP GET request and result? It would be common, and unsurprising if they do.

But why does Volokh.com log that data?

 

(*) Incidentally, PowerBlogs is endorsed by Eugene Volokh: “I highly recommend it.”
7.4.2008 12:55pm
theobromophile (www):
While google may only have the IP addresses, but it automatically stores the searches run by its gmailers. (This feature can be turned off - I figured it out, once upon a time, and forgot.) Nonetheless, for the millions of people who have gmail, and use firstname.lastname@gmail.com (or similar), it will be very, very easy for google to connect searches with IP and full names.

...unless I'm missing something, which is always a possibility. :)
7.6.2008 10:56pm