Thread by @doctorow

Late last week, the @RIAA sent a legal threat to @Github, claiming that the popular (and absolutely lawful) tool #youtubedl (which allows users to download Youtube videos for offline viewing, editing and archiving) violated Section 1201 of the #DMCA.

pluralistic.net/2020/10/24/120…

1/

Even by the heavy-handed standards of the RIAA - a monopolist's "association" dominated by only three members - this was extraordinary. The law in question derives much of its efficacy from its vagueness, which chills software developers from risking its severe penalties.

2/

#DMCA1201 is an "anti-circumvention" law, banning the distribution of tools that bypass "effective means of access control" for copyrighted work, with a $500k fine and a 5-year sentence for a first violation.

3/

Thus 1201 gives companies the power to felonize any action, even lawful ones. All you need to do is design a product so that using it in ways that you dislike requires bypassing "access controls" and presto! Your preferences are laws - "Felony contempt of business-model."

4/

That's how Apple makes it a crime for me to write an app and sell it to you for your Iphone without giving Apple 30% of the purchase price. It's how Medtronic makes it a crime to fix its ventilators. It's how HP makes it a crime to refill a printer cartridge.

5/

For all its centrality to modern commerce, 1201 has seen precious few cases litigated to judgment, so its contours remain fuzzy. That works to companies' advantage. They know that risk-averse competitors, security researchers and investors steer wide to avoid violating it.

6/

Who wants to risk a wrong guess about the lawfulness of your activities that can land you in prison for 5 years?

7/

There have been moments when the RIAA's rage brought us close to litigating key features of 1201, but cooler heads prevailed and they surrendered rather than putting their theories in front of a judge and risking a narrowing of 1201.

eff.org/cases/felten-e…

8/

In threatening youtube-dl, RIAA is risking a lot. Like what is an "effective means of access control"? There's an argument that goes, "If I can bypass it, how was it 'effective'?" That was tried in the @2600 case over Decss, and it didn't fly.

eff.org/effector/15/14

9/

But while the courts were reluctant to decide how stout an access control must be to acquire statutory protection, they were unsympathetic to the arguments of the defunct file-sharing tool Aimster, which used Pig Latin to "encrypt" its filenames.

10/

They argued that RIAA enforcers violated 1201 by "decrypting" them. This was quickly dismissed by courts, putting a floor under what "effective" means: "stronger than Pig Latin, weaker than Decss."

news.slashdot.org/story/01/03/06…

11/

The "access controls" that youtube-dl bypasses are (AFAIK) somewhere within those two bounds - basically a lot of obfuscation, but not encryption. If this goes to trial, "obfuscation" methods could end up being fair game for circumvention.

12/

The other thorny question RIAA is raising here is standing - they're arguing that since some of their members' works are restricted by Google's access controls, then they have the right to sue over circumvention, even if Google doesn't mind.

13/

If this question is ruled on, then it could go badly for RIAA irrespective of the ruling. If the court rules that only the creator of an access-control can invoke DMCA 1201, the list of potential aggressors under 1201 dwindles to a mere handful.

14/

If the court rules that the RIAA DOES have standing, then that means that every single rightsholder whose works are implicated by an access control would ALSO have standing.

15/

If the day comes that the RIAA's members want to break with a Big Tech music company (like Youtube, say!), and authorize their customers to jailbreak their music and take it with them to a rival service, any other rightsholder with a file on Youtube could stop this.

16/

Indeed, under this theory, there may be no way of EVER authorizing a circumvention - you'd need cooperation from every implicated rightsholder and the access-control's creator. The RIAA's members strongly value their own self-determination and this could really hurt them.

17/

Will this go to trial? It's hard to say. Certainly, the RIAA has firehosed around so many complaints that they've created a cohort of potential defendants who might be willing to take their chances in court.

18/

As @torrentfreak reports, before hitting Github, RIAA sent out notices in Germany - to Uberspace (the youtube-dl project's host) and to former project maintainer Philipp Hagemeister (no longer involved).

torrentfreak.com/riaas-youtube-…

19/

And @natfriedman, Github's CEO, joined the developers' IRC channel to offer support (he told Torrentfreak, "We want to help the youtube-dl maintainers defeat the DMCA claim so that we can restore the repo").

https://twitter.com/t3rr4dice/status/1320660235363749888

20/

The notice seems to have radicalized the company: "We are thinking about how GitHub can proactively help developers in more DMCA cases going forward, and take a more active role in reforming/repealing 1201."

Interestingly, Github's owner, @Microsoft, is an RIAA member.

21/

In the meantime, copies of the youtube-dl sourcecode have proliferated as developers and activists have mirrored it in protest of the RIAA's heavy hand.

22/

DMCA 1201 is unconstitutional: that's an argument @eff is making in its lawsuit on behalf of @matthew_d_green and @bunniestudios, which seeks to overturn the law.

eff.org/cases/green-v-…

23/

A legal reckoning over 1201 is long overdue, thanks to the tactical cowardice of RIAA, which has run from the victims that stood up to its bullying rather than risking a day in court and the law's judicial overturn. EFF's suit has been slow going, plagued by long delays.

24/

It's never good to be on the receiving end of legal threats from wealthy, powerful, connected industry groups. But here might be a case that finally drives a stake through 1201's heart. It's not a silver lining, but at least it's something.

eof/