Chapter 8

Online Service Providers: Gateway or Traffic Cop?

As we noted, many OSPs—thousands of commercial companies as well as public libraries, colleges, and universities-have been exposed to a legal claim of copyright infringement without even knowing it. Under copyright rules if someone copies, distributes, or displays a copyrighted work publicly without authority of the copyright owner or its agent, then a violation of law has occurred. Even innocent infringements are subject to penalties. In Chapter 6, we saw that, in addition to injunctive relief, a copyright owner prevailing in an infringement action may be entitled to receive actual damages and profits of the infringement, or statutory damages plus attorney's fees.

One of the developments associated with the Internet has been that valuable copyrighted works, such as new musical CDs and movies, are posted at renegade sites for anyone to download without paying a fee. This practice has driven some copyright owners to the courts for relief. However, since the source of the infringements is often an untraceable site in cyberspace, an alternative defendant has been the Internet service provider that links customers to these sites (Figure 8-1).

Traditionally, common carriers have been exempt from liability for copyright infringement because they merely provide the facilities that link sender and receiver and have no control over the actual content of the transmissions. Many OSPs, both for-profit like AOL, WorldCom, AT&T, and Earthlink, and nonprofits such as libraries and educational institutions, feel this describes their function for subscribers, customers, patrons, students, and faculty in connection with the Internet. However, in their capacity as OSPs, the firms and institutions do more. Technically, they provide software to link users to sites as well as store information on their servers and facilitate recording and display by users or subscribers. Each of these activities is a function recognized in copyright law as an exclusive right of copyright owners. Copyright law also holds that helping someone else violate

Figure 8-1 Online Service Provider in the Middle

copyright rights is an infringement, a so-called vicarious or contributory infringement. Therefore, certain commercial OSPs have been held by some courts to be liable for copyright infringement. That an institution is “not for profit” does not eliminate exposure to the copyright infringement claim.

To remedy this exposure, commercial and nonprofit OSPs sought a limitation under copyright law. After 2 years of negotiations, the Online Copyright Infringement Liability Limitation was approved by Congress as part of the omnibus DMCA. The limitation greatly reduces an OSP's exposure to monetary damages; however, it does not exempt an OSP from legal action or injunctive relief. Nevertheless, it is a first line of defense against a claim of copyright infringement, in addition to other copyright defenses and limitations like fair use. The rules are complex and require strict adherence to rigorous deadlines. Unless in full compliance with the law, an OSP, even a nonprofit institution, faces loss of the exemption and exposure to potentially large copyright damage claims. Service providers must not only understand the rules, but also establish internal mechanisms for compliance and monitoring of these activities. Here is the OSP primer.

Definition of an OSP

The statute sets forth the following definition of service provider:

All entities whose services fit these descriptions, and the definition in (b) is intended to be very broad, may qualify with regard to those activities. However, to the extent the functions of the OSP involve the creation and posting of content, choosing recipients of messages or controlling users, the limitation does not apply; and regular copyright rules respecting proper clearance, as well as fair use and other defenses, are fully applicable.

Types of OSP Activities Covered

The OSP limitation covers most transitory digital network communications. Specifically, these are

• Intermediate and transient storage of materials (such as Web pages or chat room discussions) in the course of transmitting, routing, or providing connections
• System caching
• Placing information on a system or network at the direction of users
• Use of information location tools, such as directories, indexes, and hypertext links

To qualify for the limitation with regard to all covered OSP activities, a set of conditions for each specific function must be met. If a firm or institution performs all the OSP functions, as most do, then all requirements must be met.

The requirements fit into three key categories:

• Material.
  1. The material must be made available online by someone other than the OSP. The limitation therefore does not cover any content that the OSP creates and places online for its subscribers.
  2. The OSP cannot modify the material. If the OSP plays a role in changing content created by others, it loses the benefit of the limitation.
  3. No copy of the material during intermediate storage can be maintained longer than “reasonably necessary.” When an OSP transmits information or content through its facilities, its systems keep a working copy of it for some period of time. The law requires that this retention not be indefinite, rather it should be retained only as long as required by the technology.
  4. The OSP cannot have “actual knowledge” that the material or the activity is infringing. What is more, the OSP should not even be aware of facts or circumstances from which infringing activity is apparent. If the OSP receives such awareness, it must act quickly to remove or disable access to the site. In short, a little knowledge can be a bad thing for the OSP. Since most OSPs do not monitor content for copyright ownership, in most cases they do not know much about a possible infringement. After all, a user might be an independent creator of the work, a licensee, or even a fair user. How is the OSP to know? We get to that in a moment.
• Parties to the Transmissions. The transmissions must be initiated by one party or at the direction of another person and sent to yet another. To qualify, the OSP must be just like a phone company, an intermediate link between points A and B, not an outputter of the message at either end. No copy of the material during intermediate storage can be made accessible to another person. In other words, as the Internet transmission is occurring, only the sender and recipient should have access to the content. The OSP should not allow strangers to the transmission to have access to the work. The OSP cannot select recipients; rather, whoever sends the message or solicits the work should be in control. The OSP cannot receive a financial benefit directly attributable to an infringing activity in a case in which the OSP has the right and ability to control the activity. Congress did not want the OSP to benefit from the infringement. Even so, the OSP may make reasonable charges for its services. Either the sender, the receiver, or both may have to pay for services. In short, a monthly subscription fee is not a benefit directly attributable to the infringing activities.
• Procedures. The transmission, routing, provision of connections, or storage must be carried out through an automatic, technical process. All these activities are typically performed through the use of highly specialized equipment. The OSP must follow rules relating to refreshing, reloading, or other updating of the material; and the OSP cannot interfere with technology associated with the material, such as software that controls access or use, like fees. In other words, the OSP must enable technology to work its ways without intervention.

The owner must also comply with notice and takedown procedures. This is a key concept of the limitation; if a content owner discovers an infringement in cyberspace and follows procedure by giving the OSP “proper notification,” then the OSP must expeditiously remove or disable access to the offending material. In other words, it has to block access to the site and prevent content from flowing via the Internet to its subscribers. However, if the affected website owner properly objects and serves an appropriate “counternotice”—here's a twist-then the OSP must adhere to “put back” procedures. These procedures keep the OSP at arms length from the content dispute while allowing the copyright owner and the alleged infringer to work through the dispute by themselves.

The recent response of Google, the popular Web search engine, to receipt of an infringement notice points out some as yet uncharted aspects of the OSP provisions. Google was notified by the Church of Scientology that its search results for “Scientology” included links to copyrighted church material; the material in question was located on the website of Operation Clambake, an organization located in Norway that was critical of the church. Google complied with the DMCA by removing the link to the Scientology material (initially removing but then restoring the link to the Operation Clambake home page), but was besieged by free speech advocates who claimed that Google was censoring its search results. Google's solution was to adopt a new policy under which it informs users when it has removed a result and links them to the Chilling Effects Clearinghouse website (www.chillingeffects.org), where they can read the DMCA complaint, which Google supplied.

Obligations of Copyright Owners

As is apparent, the limitation places several key obligations on copyright owners. Among the most relevant are the following:

• When refreshing, reloading, or updating material, the owner must adhere to generally accepted industry standard data communications protocols.
• As a parallel to the OSP's obligation not to interfere with technology controlling access to the material (e.g., passcodes and fees), the owner's technology must (1) not significantly interfere with the OSP's system or network performance regarding intermediate storage of material, (2) be consistent with generally accepted industry communications protocols, and (3) not extract information from the OSP's system or network about the person initiating the transmission that it could not have acquired through direct access to that person.
• The OSP must comply with notification requirements in connection with notice and takedown procedures.

Notice and Takedown, Counternotice, and Put-back Procedures

Notice and takedown is an essential part of the protections sought by the content community and forms a new regulatory regime for both OSPs and copyright owners. If a content owner reasonably believes that a site misuses copyrighted matter and notifies the OSP according to statutory procedures or if the OSP independently becomes aware of the facts and circumstances of infringement, then the OSP must quickly and effectively remove the material or disable public access to the site or else face loss of the limitation.

Among the elements of the notice and takedown process are the following:

1. The OSP must have a designated agent to receive notices, and it must use a public portion of its website for receipt of notices.
2. The OSP must notify the Copyright Office of the agent's identity. The Copyright Office will maintain electronic and hard copy registries of website agents so that they may be easily contacted in case of infringement.
3. Proper written notification from a copyright owner to an OSP must include (a) the name, address, and electronic signature of the complaining party; (b) sufficient information to identify the copyrighted work or works; (c) the infringing matter and its Internet location; (d) a statement by the owner saying that he or she has a good faith belief that there is no legal basis for the use of the materials complained of; and (e) a statement of the accuracy of the notice and, under penalty of perjury, that the complaining party is authorized to act on behalf of the owner.

Any misrepresentation of material facts will subject the offending party to claims for damages and attorney's fees.

If the OSP complies in good faith with the statutory requirements, the limitation immunizes it from liability to subscribers and third parties; however, this immunity is conditioned on affording the affected subscriber notice of the action. If a subscriber files a proper “counternotice,” attesting to its lawful use of the material, then the OSP must “promptly” notify the copyright owner and, within 14 business days, restore the material, unless the matter has been referred to a court. The counternotice must contain (1) the subscriber's name, address, phone number, and physical or electronic signature; (2) identification of the material and its location before removal; (3) a statement under penalty of perjury that the material was removed by mistake or misidentification; and (4) subscriber consent to local federal court jurisdiction or, if overseas, to an appropriate judicial body.

Special Rule for Higher Education

The OSP regime makes one special exception to the general rule that an institution is responsible for the acts of its employees. In a bow to academic freedom, scholarly research, and the practice of administrators of higher educational institutions of not interfering with classroom work, the statute provides that faculty and graduate students employed to teach or research shall not be considered part of the institution for OSP purposes. Thus, if a member of the faculty posts infringing content, selects recipients of infringing matter, or knows of an infringement, the school where he or she teaches would not automatically lose its right to the limitation.

The higher ed exception has three important qualifications: First, the faculty or graduate student's activities cannot involve online access (including e-mail) to materials that were “required or recommended” within the preceding 3 years for a course taught by the employee at the institution. Second, the institution cannot have received more than two notices of actionable infringement by the faculty or graduate student. Third, the institution must provide all users of its system or network informational materials in compliance with U.S. copyright laws. It is important to note that the policy should not only spell out the rights of ownership but also the limitations on those rights, most noticeably fair use and educational exceptions.

If properly followed, the higher educational institution will not be tainted by the actions of its teaching and research employees. As an institution, it should qualify for protection against money damage claims and should not be required to block access or terminate a subscriber's use. It could still be subject to other injunctive remedies, such as those involving preserving evidence.

OSP Limitation and Privacy

The statute also recognizes the importance of protecting the privacy of a user's identity on the Internet. Procedures are laid out by which a complaining copyright owner may obtain the identity of individual subscribers from the OSP. The principal safeguard involves the content owner's compliance with a formal court request that can be issued by federal court clerks. If followed, this process protects the OSP from liability under federal or state prohibitions respecting release of information regarding individual subscribers.

In addition to all these rules, the OSP must develop and post a policy for termination of use by repeat offenders and accommodate and not interfere with “standard” technical measures used by copyright owners to identify and protect their works, such as digital watermarking and access codes. The act makes clear that the OSP is not required to monitor its services for potential infringements. It need not seek out information about copyright misuse; however, it cannot ignore obvious facts.

These rules took effect in October 1998. Almost immediately, the Copyright Office swung into action, establishing a procedure for accepting OSP registrations. Today, thousands of companies and institutions have registered their services with the Copyright Office. This registry is the first place to go when a copyright owner knows about website infringements. Putting OSPs on notice and demanding take-downs are the orders of the day. It is also important for unregistered OSPs to review the statute and practices with their administrators. Ignoring the benefits from the limitation on OSP liability leaves the unprepared exposed to potentially huge copyright liabilities.