Yesterday, in the Viacom v. Google litigation, the federal court for the Southern District of New York ordered Google to produce to Viacom (over Google's objections):
all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website
The court’s order grants Viacom's request and erroneously ignores the protections of the federal Video Privacy Protection Act (VPPA), and threatens to expose deeply private information about what videos are watched by YouTube users. The VPPA passed after a newspaper disclosed Supreme Court nominee Robert Bork's video rental records. As Congress recognized, your selection of videos to watch is deeply personal and deserves the strongest protection.
The Logging database contains:
for each instance a video is watched, the unique “login ID” of the user who watched it, the time when the user started to watch the video, the internet protocol address other devices connected to the internet use to identify the user’s computer (“IP address”), and the identifier for the video.
Google correctly argued that “the data should not be disclosed because of the users’ privacy concerns,” citing the VPPA, 18 U.S.C. § 2710. However, the Court dismissed this argument with no analysis, stating “defendants cite no authority barring them from disclosing such information in civil discovery proceedings, and their privacy concerns are speculative.”
In a footnote, the Court references the VPPA, noting that the federal law “prohibits video tape service providers from disclosing information on the specific video materials subscribers request or obtain.” It is possible that the reference to "video tapes" in the VPPA was confusing. However, the Act is not limited to the technology available at the time of its enactment.
To the contrary, the act refers to “prerecorded video cassette tapes or similar audio visual materials.” A YouTube video may not be a videotape, but certainly qualifies as audio visual material. Thus, YouTube is a “video tape service provider” under the act, because it is “engaged in the business [of] delivery of … audio visual materials.”
The VPPA protects “personally identifiable information,” which is defined to include “information which identifies a person as having requested or obtained specific video materials or services.” This is exactly what is in the Logging database.
Accordingly, pursuant to this federal law, the Court may not order the production of “personally identifiable information”:
in a civil proceeding [except] upon a showing of compelling need for the information that cannot be accommodated by any other means, if—
(i) the consumer is given reasonable notice, by the person seeking the disclosure, of the court proceeding relevant to the issuance of the court order; and
(ii) the consumer is afforded the opportunity to appear and contest the claim of the person seeking the disclosure.
Today’s court order made no finding that Viacom could not be accommodated by any other means, nor were the YouTube users provided with notice and an opportunity to contest the claim.
Instead, the Court focused on some statements made by Google on its blog:
We . . . are strong supporters of the idea that data protection laws should apply to any data that could identify you. The reality is though that in most cases, an IP address without additional information cannot.
The Court also stated that Google did “not refute that the ‘login ID is an anonymous pseudonym that users create for themselves when they sign up with YouTube’ which without more ‘cannot identify specific individuals.’”
As an initial matter, this is factually insufficient. If any single one of the YouTube users in the Logging database picked a Login ID that does identify that user (i.e. if my YouTube login was kurtopsahl), then the Logging database' information about viewing habits is protected by the VPPA, even if others pick anonymous pseudonyms.
Furthermore, even Google’s IP address statement only asserts that “in most cases” the IP address is not identifiable, certainly not in all cases. Putting aside whether a Google Public Policy blog's statement on an unrelated topic can waive the privacy rights of YouTube users, the statement means that at least some YouTube users are identifiable, and must be protected by the VPPA.
In any event, the court ordered production of not just IP addresses, but also all the associated information in the Logging database. Whatever might be said about 'an IP address without additional information,' the the AOL search history leak fiasco shows that the material viewed by a user alone can be sufficient to identify the user, even with neither a login nor an IP address.
The Court's erroneous ruling is a set-back to privacy rights, and will allow Viacom to see what you are watching on YouTube. We urge Viacom to back off this overbroad request and Google to take all steps necessary to challenge this order and protect the rights of its users.
Posts
I have nothing more to contribute.
i watched mylie cyrus videos for 6 hours a day
no but seriously, this is absolutely insane.
dear god. The ramifications...
This suit will solve nothing. People will still be able to go to (X) website and look up free streaming teevee shows and movies.
I think youtube fucked up by allowing the stuff, and got in trouble, but I don't like the idea of them giving out my IP address and user name.
Releasing user names and IPs goes too damn far. Maybe you could make a case for releasing a history of the number of times videos have been viewed, but there is absolutely no reason that Viacom needs to know my username and IP address. None.
Steam | Twitter
Google has an incentive not to release private information, people would be less inclined to use their services. Viacom has no such incentive. Once viacom has it, they clearly intend to make it a public display, showing users (groups or individuals) who watch copyrighted material constantly on youtube to prove their point.
2. Youtube is popular because of both. Also, there is non-user generated material that does not violate copyright that gets posted and is very popular.
3. Youtube's policies are fine. I think torrent files should be of far greater concern than youtube. And attacking an individual company to try and change law "Video Privacy Protection act" is not the way to do things.
I think attacking the internet is a waste of time and resources, just think of it as free advertising. If people are viewing your copyrighted material, just release it in blue-ray. The number of people who go to the effort of downloading/viewing poor quality or huge files will be insignificant compared to the number of people who just buy/rent/watch legally.
So you're telling me, Youtube, a high-tech web-based company, has a database containing all the individual viewing information for each time a video is viewed but doesn't have a simple counter that records the total views for any given video (which is what Viacom was actually wanting to know)? Really?
It seems the Judge (who happens to be 80 years old) is quickly dismissing privacy concerns based on two assumptions: 1) That LoginIDs are anonymous (which, to Viacom probably would be considering they don't have any of the personal information Youtube might have when you sign up); and 2) That IP addresses are dynamic in the vast majority of cases based up this blog post and thus can't be traced back: http://googlepublicpolicy.blogspot.com/2008/02/are-ip-addresses-personal.html
The idea of a judge coming to a decision on IP addresses based upon one blog post is somewhat disturbing, though I wonder that a simple IP address (even if static) without any of the information normally held by one's ISP can be useful at all at linking to a specific person.
Currently DMing: None
Characters
[5e] Dural Melairkyn - AC 18 | HP 40 | Melee +5/1d8+3 | Spell +4/DC 12
User names on the other hand, well, that could lead to a bunch of account closures on YT since this judge is apparently on Viacom's side.
The video quality sucks, and there's legal stuff like Hulu now.
If I went to the store that sold bootleg DVDs and I bought one (Edit: And I didn't know it was a bootleg), why am I held liable? Wouldn't only the store be responsible for that? To me it's the same thing.
Hulu is limited to the US only.
Currently DMing: None
Characters
[5e] Dural Melairkyn - AC 18 | HP 40 | Melee +5/1d8+3 | Spell +4/DC 12
That I didn't know. And is lame.
Damn you Aegis for beating me to it (and explaining better)!
Not to mention many TV networks (NBC, TBS, Comedy Central, Cartoon Network) are putting up all their shows for free online. Viacom is behind on the ball here.
Think of it like a drug deal or prostitution. They're basically saying you, the viewer/buyer, is just as guilty as the website/dealer.
That's if I was specifically looking for the illegal material and knew the legality behind the material to begin with isn't it? If I go looking for "Dark Knight Trailer" and get trailers that were only released in theater and aren't public (like some are), why is that illegal as it's really no fault of my own? I'm having a hard time getting where this becomes the consumers issue because it's copyrighted.
Yes! Copyrighted material is like porn.
(That's what they said at least.)
Viacom (mentioned in the ruling) is already doing this, trying to develop fingerprinting technology on any of their videos that will then check Youtube to see if any videos with this fingerprint is present.
Currently DMing: None
Characters
[5e] Dural Melairkyn - AC 18 | HP 40 | Melee +5/1d8+3 | Spell +4/DC 12
Every video that is uploaded to youtube is protected by copyright unless the creator says otherwise. However a lot of commercial stuff is put up there by the copyright owners (eg: http://youtube.com/user/sonybmg ).
What Viacom want is for google to create an automated system that determines who owns the copyright to whatever is being uploaded, and whether the uploader is that entity (or has their authorisation).
Basically they think Google should be forced to implement a system that is able to determine the intent of the user. Presumably with magic.
My Portfolio Site
B.net: Kusanku
I wonder what would happen if they said no to Viacom and appealed to the supreme court?
With this current court? Viacom gets what they want, PLUS copies of any future ultrasounds of YouTube users' unborn children to help in determining demographics for Nickelodeon and MTV shows.
Google should not have to "scrub" their data base. That would be like telling a bank or insurance agency they need to delete personal information lest it be subpoenaed. I certainly hope google can and does successfully appeal this ruling.
You should contact someone like the Electronic Frontier Foundation to find out how you can help. I don't think at this point you have any type of legal recourse, but I'm sure they could advise you on what else you can do (like writing a congressperson or generally spreading the word, doing research into precedent, etc.).
It's like counting the number of cars that drive across a given road by taking pictures of their license plates.
the "no true scotch man" fallacy.
In roll 200 garbage trucks filled with paper, with all the data printed on it in tab delimited text format with the data sorted into columns (IE, first 10 million pages are just a list of millions of user IDs, then the next row has IP addresses). That would supply them with all the data, but they would have to type it in row by row by hand.
I'm fairly sure SCO did something like this in their suit against IBM (printed out all the source code for an entire Linux distribution) and got smacked with a contempt of court ruling.
Fact request: are the retailers whining about it at all, or is it just the production companies? I'm curious.
As far as I know retailers haven't whined about copyright. Partly they don't have anything copyrighted so they have no grounds to whine, but mostly I suspect they aren't really having trouble selling stuff. If the wallmarts of the world weren't making cash selling CD's and DVD's I'm sure they would throw their political weight into the fight.
The law doesn't require that, so Viacom is being a bunch of whiny bitches. The safe harbor provisions should protect Google in this one, since they follow the takedown procedures in the DMCA. I have no idea why the judge thought it was a good idea to force Google to turn over all their user information.
And yea, looking at user-specific info when all you want is a traffic counter is pretty stupid.
Besides that, if a court orders you to produce data you don't get to charge anyone for that cost, regardless of how difficult it is. Back when I worked for an insurance company, they were involved in a class-action lawsuit and we (the IT guys) spent thousands of man-hours producing data that the judge ordered the company to provide. Attempting to prove a point by spending even more money probably isn't something they'd be interested in.
If anything didn't they experience an increase of sales because of this? It's like free advertising done by advertisers you don't even have to pay.