21,000+ notices piggyback on set of notices from Blog Part I

In light of the growing number of revelations regarding Russian corruption in recent months, it stands to reason that anyone who may be under investigation for such behavior would want any online criticism of their behavior removed. The DMCA notice and takedown procedure remains the favored approach for coordinating the suppression of critical articles as part of larger reputation management efforts.

The essence of the DMCA’s notice and takedown procedure is that OSPs cannot be held liable for copyright infringement as long as they removed disputed materials in response to takedown notices they receive. For copyright holders, takedown notices have made it easier to address online infringement and remove content online without having to go to court to assert their rights.

As documented by the Lumen Database since 2002, copyright holders go to tremendous lengths to safeguard their work from unauthorized replication online. A typical first step in addressing online copyright infringement is to issue a DMCA notice to the online service providers, such as Twitter, YouTube, and Google, who are hosting the allegedly infringing materials. OSPs handle millions of requests to remove online content or de-list it from search results each week. Although most requests are from copyright holders appropriately trying to protect their works, there are a number of bad actors who utilize the system to their advantage. Some of these misuses of the DMCA notice and takedown system are clumsy at best, but others are quite sophisticated, and digging into their details often reveals that censorship is the ultimate objective.

It is worth pointing out that although Google has the power to de-index or remove links from search results, they have no power to remove content which they are not hosting. For example, the allegedly infringing URL in this notice was de-indexed from Google, but it still remains live on the internet. For most notice senders, whether legitimate rights holders or abusers of the DMCA process, this is the desired result—if it does not exist in Google’s results, it doesn’t exist online from a practical perspective. Additionally, many notice senders make no effort in attempting to get the actual content removed because they know that this is usually futile. There have also been cases where a URL has been removed from Google, but not from other search engines because it has never occurred to the sender to send takedown notices to other various search engines, given Google’s market share.

Lumen Fellow Shreya Tewari discussed elements of several such cases earlier this year, and I did as well in my first blog post. This week, I uncovered an additional 21,000+ suspicious-looking notices which seem to be related to the notices I have already identified. They are all putative copyright infringement claims submitted to Google between September 2020 and September 2022, demanding the removal of various articles—the majority of which are associated with the alleged criminal activities of a particular Russian oligarch.

In this new notice set, 21,890 notices cite the ‘fake original’ URL ‘newsy24.ru’ as the premise for their (fraudulent) takedowns. A "fake original" is a duplicated work that, at first glance, gives the impression that it was first published before the genuine article. Because some of the allegedly infringing URLs reported by ‘newsy24.ru’ and ‘ubiystvo.kiev.ua’ from Blog I are the same (see here and here), in addition to the content located at the allegedly infringing URLs being so similar in nature, it seems plausible this is a continuation of the systematic effort.

I picked 300 DMCA notices at random from the 'newsy24.ru' notification set to investigate individually. Within the subset, I found notices sent from numerous jurisdictions, as marked by the notice sender, including the Netherlands, United States, Russia, Ukraine, and the United Kingdom.

In the subset, there were cases of repeated infringement. For instance, the same allegedly infringing URL was requested to be removed more than 25 times, by 25 distinct senders, and from three different jurisdictions, again, as indicated by the notice sender. An example of this can be seen here. This is another piece of evidence that lends credence to the theory that the purportedly distinct senders are only a front for a single organized conspiracy to exploit the DMCA procedure in unethical ways.

Next, I attempted to determine if any of the information that 'newsy24.ru' had requested be removed had already been prohibited in Russia. Russia has blacklisted legitimate news services more than any other domain category. Nearly 80 percent of the blacklisted domains in 2022 are news websites. I performed a search on Roskomsvoboda, a non-profit register of prohibited Russian domains whose objective is to protect the freedom of information on the internet. I found that a handful of the domains targeted within the subset are also banned by Roskomnazdo—Russia’s Service for Supervision of Communications, IT, and Mass Media, including are ladno.ru, viborsalavat.com, from-ua.info, and rureporter.com, among others that I had already found to be banned in my first blog. This overlap could imply that the source of all these fraudulent takedown requests is Russia and not the jurisdiction indicated by the notice sender, as well as that this oligarch is well-connected enough to enlist the assistance of the Russian Ministry in his takedown efforts.

I conducted a search for ‘newsy24.ru’, on the Wayback Machine to attempt to determine how long the URL had been active for, and to see how many articles were related to the oligarch in question. I found that the domain had been crawled and captured 109 times within the last decade, with November 2012 the earliest. Initially, it seems to have been a piracy website that made movies and television shows available for download with takedown notices submitted on behalf of Lionsgate in 2013 regarding its film, The Bay.

In April 2014 the site began to display a strange mix of both copyright infringing downloadable content and articles about Russian criminal activity. That capture can be seen here. By 2019 the site map displays only nine articles related to corrupt political activity. However, in 2020, a flood of articles about corrupt politics, finance, and business began to appear, including the first articles relating to this oligarch. Out of 5,099 captured URLS on the Wayback machine with the prefix ‘newsy24.ru’, 306 of them are related to him. The related items appear only between September 2020 and April 2022.

The URLs from 237 out of my 300 randomly selected notices in the subset were successfully removed from Google’s search results or were never indexed to begin with. Examples of URLs which were successfully de-indexed from Google’s search results can be seen here, here, and here.

Evidenced by this batch of takedown requests, it is clear that the notification and takedown process requires further checks and balances to ensure that targeted content is actually or plausibly infringing before it is removed permanently as well as that the process provides due process for targets. An alarmingly large number of questionable notices were uncovered in this study, both here and in Blog I. Taken together, these results, coupled with the fact that targets rarely employ the counter notice process, point to the need for improved measures to avoid and remediate abusive takedown demands. The current iteration of the DMCA does not adequately protect OSPs from this scale of misuse, which is pervasive and becoming more difficult to distinguish from legitimate takedown requests. Given the very small number of counter notifications received by OSPs and the significant social cost of restricting expression, any expenses linked to granting quick putback in response to a genuine counter notice would be far surpassed by the benefit of minimizing DMCA misuse.