A Russian oligarch is still trying to erase himself from the internet (and it’s working)

As discussed in two previous blog posts, [See Part 1 and Part 2], the Lumen Project has discovered a combined total of more than 89,000 DMCA notices which appear to be deliberate fraudulent attempts to misuse the notice-and-takedown procedure. While examining notices discussed in the previous blog, I came across a new domain name, "newsy24.net," which appears to be an active facilitator of such abuse. Unlike earlier sets of notices which appear to have used ‘dead’ websites as the basis for their abuse, the DMCA notices in the set I will discuss here from ‘newsy24.net’ are submitted from a website that is still currently live. Here I will explain how I assessed its connection to the website described in part II of this blog, how it has been operational and sending fraudulent notices since May 2022, and what this means for speech critical to cultural and political discourse.

During my research into the notifications discussed in blog II, I came across another set of 5,493 notices that were strikingly similar to the ones I had already found. The first similarity was the URL itself. This new notice set uses the URL "newsy24.net" instead of "newsy24.ru," which was used in the previous notice set. The second similarity was the content at the allegedly infringing URLs— all of the material the notices referenced revolved around a particular Russian oligarch. Finally, the sites' designs were nearly identical, appearing equal in visual style and content.

I wanted to investigate if these two URLs were linked by checking Wayback Machine. On May 6, 2022, 'newsy24.ru 'was taken offline. However, a Wayback Machine capture shows that starting from that date, ‘newsy24.ru’ began redirecting to ‘newsy24.net’. Captures from 'newsy24.net' began to appear on Wayback Machine in May 2022, and its earliest capture can be seen here. This could help explain why a recent capture from April 2022 shows the now-defunct ‘newsy24.ru’ having identical content and appearance to the currently live ‘newsy24.net.’ Because the captures of ‘newsy24.ru’ appear so much earlier than ‘newsy24.net’ and with similar content, articles and appearance, I believe that DMCA notices from ‘newsy24.ru’ and ‘newsy24.net’ have been a systematic effort.

However, what is more alarming is that ‘newsy24.net’ actively submits notices that appear to be fraudulent. Although the number is rising, since July 22, 2022, they have submitted 1,312 notices to Google for removal. Of the 500 random notices I chose to study, all 500 were explicitly related to allegations of criminal activity.

There are 4,075 notices which use the domain ‘newsy24.net’ to form the basis of their takedown. A search of the domain name https://newsy24.net demonstrates that the website is still currently live. The alleged use of ‘newsy24.net’ to defend his reputation has been previously reported. However, what is more concerning is that since this report, newsy24.net continues to backdate articles and abuse the notice and takedown procedure. Since June 2022, Lumen has received more than 1,000 notices related to this one particular oligarch from ‘newsy24.net’ for removal. One ‘newsy24.net’ notice that has been successful in takedown from Google can be seen here.

In other instances, the ‘fake original’ URL in this notice from newsy24.net is used to attempt to remove a ‘true original’ article which has the same text but a different title. Other examples of notices which repeat this can be seen here, here, here, here, and here. This leads me to believe that all of these ‘true originals’ are perhaps not true originals. I am led to believe that all of these domains, both ‘fake original’ and ‘true original’, are all part of a collaborative effort to remove one true original.

As fraudulent notices continue to be submitted by URLs such as ‘newsy24.net’, it's seeming more and more likely that important political and cultural speech is slipping through the cracks of the DMCA. Numerous documented cases of misuse show that corporations are using the law for purposes other than policing copyright infringement.

For example, instead of targeting specific pieces of infringing content, as the DMCA requires, Warner Bros. submitted DMCA takedown notices with Google to remove entire domains that could potentially lead to such content. Sony has been advocating for the collection of license fees for the legal usage of their copyrighted works. Using the pretense of copyright infringement, a web security firm utilized the DMCA takedown system to suppress a vociferous critic of its services. London's Sunday Times tried to get an article critical of the paper removed from the internet by filing a DMCA takedown notice. In an effort to uncover identities of bloggers, several organizations have resorted to serving DMCA takedown notices. Many businesses and controversial individuals are taking advantage of the DMCA takedown notice system since it is less expensive than invoking defamation laws to silence their criticism. The DMCA takedown notice process has also been used by fraudulent senders for the purpose of monetary gain to target and shut down self-publishing authors.

When it comes to fraudulent takedown notices, Section 512 has failed to safeguard the public and has instead enabled organized misuse of the DMCA, however inadvertently. Thjere is clearly an ongoing tension between this (ab)use of the DMCA to stifle dissent and delete articles produced by journalists and the 1st Amendment's protection of free speech and the press. One can only hope that the US Copyright Office, as part of its ongoing examination of the DMCA, addresses these shortcomings and, considers taking steps, such as statutory damages or identity verification, to more effectively prevent fraudulent takedown attempts.

[NOTE: See ongoing related investigative work being done by Nekā personīga | tv3.lv]