Bungie slams YouTube’s DMCA system in lawsuit against Destiny takedown fraudsters

Bungie slammed YouTube’s Digital Millennium Copyright Act (DMCA) process in a lawsuit against 10 John Doe defendants accused of sending fraudulent takedown notices against Destiny 2 videos.

“Doe Defendants were able to do this because of a hole in YouTube’s DMCA-process security, which allows any person to claim to be representing any rights holder in the world for purposes of issuing a DMCA takedown,” Bungie wrote in a complaint filed Friday in US District Court for the Western District of Washington. Bungie continued:

In other words, as far as YouTube is concerned, any person, anywhere in the world, can issue takedown notices on behalf of any rights holder, anywhere. A disgruntled infringer or a competitive content producer, for example, can issue takedown notices purportedly on behalf of Disney, or Fox, or Universal—or even Google itself. All they need to do is: (1) fill out the video removal form… (2) have a Google account—including, upon information and belief, one created that same day and with fake information; and (3) fill out information and click verification buttons fraudulently certifying that they have the right to submit the takedown request, with no verification done by YouTube.

While YouTube and its owner Google were not named as defendants, they feature heavily throughout Bungie’s complaint. The 10 Doe defendants haven’t been identified yet because of “the Byzantine procedural labyrinth Google required before it would address the fraud its users were committing, let alone identify who its fraudsters were,” Bungie wrote.

The fraudulent notices were apparently sent in retaliation by Destiny 2 players who had received Bungie’s legitimate takedown requests, the lawsuit said. The fraudsters apparently targeted other YouTubers who had received official Bungie takedown requests and then sent emails to the victims that claimed the official Bungie notices were also fraudulent.

“YouTube’s easily gamed reporting system”

The fraudulent notices began on or around March 17 and targeted Destiny YouTubers including My name is Byf and Aztecross, who have 967,000 and 595,000 subscribers, respectively. Even Bungie’s official Destiny YouTube channel got served a fraudulent takedown notice, the lawsuit said. The notices were sent from “a fake Gmail address that was, upon information and belief, newly created, which did not match the addresses used by Bungie’s brand protection vendor for legitimate DMCA notices.”

“Thanks to YouTube’s easily gamed reporting system, the attack was a success, and videos were removed (and YouTubers given ‘copyright strikes’ that, under YouTube rules, threaten the future viability of their YouTube channels) on the basis of the Fraudulent Takedown Notices,” Bungie wrote.

Afterward, “the Destiny community was bewildered and upset, believing that Bungie had reneged on a promise to allow players to build their own streaming communities and YouTube channels on Destiny 2 content. Destiny community members were also misled to believe that Bungie’s brand protection agent was also fraudulent, causing confusion among users as to the authenticity of legitimate DMCA notices,” Bungie said.

Bungie said its attempt to solve the problem was “complicated by the fact that while YouTube has a form that allows anyone to claim to represent a copyright holder and issue copyright strikes, it has no dedicated mechanism for copyright holders who are being impersonated to let YouTube know about the DMCA fraud.”

When contacted by Ars, a YouTube spokesperson said, “We take abuse of our copyright takedown process seriously and terminate tens of thousands of accounts every year for violating our policies, which prohibit submitting false information in a takedown request. We’ll continue our work to prevent abuse of our systems, and we’re committed to taking appropriate action against those who knowingly misuse our tools.”

YouTube also said that copyright law compels the website to take DMCA complaints at face value and quickly remove content when someone alleges their copyrights are being violated. YouTube further said it has employees and systems that work to detect suspicious behavior but acknowledged that trolls and bad actors can sometimes circumvent the measures.

Bungie seeks defendants’ real names

Bungie uses the vendor CSC Global to send its actual takedown notices, which are sent only after specific approval from Bungie’s legal department, the lawsuit said. After learning of the fraudulent Aztecross takedown, “CSC issued a retraction notice requesting reinstatement of the video, but on Monday, March 21 it reported that YouTube had denied the retraction request because the retraction notice was not sent from the same email that had issued the initial Fraudulent Takedown Notice,” Bungie’s lawsuit said.

At 3:18 pm local time on March 22, after more urgent requests from Bungie, “Google provided an update: it had terminated the accounts that submitted the fraudulent requests and all fraudulent submissions would be reversed, but Google would not share any information identifying who the fraudulent users were, including channel identifiers, email addresses, or other identifying information, without a law enforcement request or civil process. Fortunately for the people whose videos were targeted by the Fraudulent Takedown Notices, Bungie has the financial resources to begin that civil process in order to meet Google’s requirements.”

Bungie’s lawsuit said it is “entitled to damages and injunctive relief, including enhanced statutory damages of $150,000 for each Fraudulent Takedown Notice that willfully infringed Bungie’s copyrights.” Bungie also accused the defendants of business defamation, violation of the Washington Consumer Protection Act, and breach of contract (the Destiny 2 software license agreement). Bungie said it suffered “significant reputational and economic damage.”

https://arstechnica.com/?p=1843948