ISPs, RIAA, the DMCA, 'graduated response,' and 'three strikes': the real story

The worldwide conflagration over "graduated response" and "three strikes" copyright enforcement proposals -- on which fire was thrown last week by conflicting reports of US ISPs' cooperation with the RIAA -- has, unsurprisingly, been marked by confusion and incorrect statements of the law. Let's try to clear some of this up.

First, the terminology. "Graduated response" is a term generally used to describe a program implemented by an ISP to address claims by copyright owners of infringement by the ISP's subscribers. Under graduated response, the ISP "graduates" -- i.e., increases, or makes more severe -- its response to the infringing subscriber upon each successive notice of infringement. So, for example, the first claim may lead to a warning. The next claim may lead to a harsher warning. The next claim might lead to a suspension, a monetary penalty, a degradation of service, or worse. A "three strikes" program refers to a particular subset of graduated response programs where the penalty upon the third notice of infringement is termination of the subscriber's account.

So what is the state of US law regarding graduated response and three strikes? Are ISPs legally required to implement these programs? Almost certainly no, as to peer-to-peer users. I think the law is now fairly clear that ISPs may not be held financially responsible for infringement by their users via p2p networks -- and that ISPs are not obligated (absent specific court order) to take action against users who infringe by p2p, even repeatedly. The reason lies in 17 U.S.C. § 512(a) -- the ("clear (albeit complex)"!) DMCA safe harbor for "Transitory Digital Network Communications" systems like ISPs. Section 512(a) provides a safe harbor from infringement claims against operators of so-called "dumb pipes" where "the transmission, routing, provision of connections, or storage is carried out through an automatic technical process without selection of the material by the service provider." (More detail in RIAA v. Verizon and pages 50-51 of the House DMCA report.) Significantly, the 512(a) safe harbor does not have a "notice and takedown" or repeat infringer provision [see update below]. In sum, 512(a) says that if the pipe is truly dumb -- a mere conduit, with no selection of material, no modification of content, and no storage -- then it gets the safe harbor, no further action required. (I should add that 17 U.S.C. § 512(j)(1)(B)(i) does authorize a court to issue an injunction (not monetary damages) "restraining [an ISP] from providing access to a subscriber or account holder of the service provider’s system or network who is using the provider’s service to engage in infringing activity...by terminating the accounts of the subscriber....")

[UPDATE: It is true that Section 512(i) provides that, to benefit from any of the DMCA safe harbors, the ISP/host must have "adopted and reasonably implemented, and inform[ed] subscribers and account holders of the service provider’s system or network of, a policy that provides for the termination in appropriate circumstances of subscribers and account holders of the service provider’s system or network who are repeat infringers." However, I know of no court that has interpreted that provision as requiring the forwarding of notices by an ISP to accused p2p infringers.]

(It's crucial to keep in mind the distinction between the Section 512(a) safe harbor for ISPs and the Section 512(c) safe harbor that governs "Information Residing on Systems or Networks At Direction of Users." The 512(c) safe harbor arguably covers hosts of user-generated content like YouTube and MySpace (though my friends at Viacom and UMG and NBCU don't concede this point). Section 512(c) does have a notice-and-takedown provision, and, to maintain the safe harbor, hosts must "terminat[e] in appropriate circumstances...repeat infringers." "Three strikes" is not a concept completely alien to the DMCA. YouTube, for one, has stated that it terminates upon a third DMCA notice as part of its implementation of the "repeat infringer" provision. See pages 17-18 of this brief.)

But wait: isn't an ISP at least required to pass on infringement notices to its subscribers when it receives such notices from copyright owners? CNET says so:

The Digital Millennium Copyright Act of 1998 has mandated that ISPs forward those letters to people accused of violating copyright.

And so (though I hesitate to cite such an openly pro-infringement site) does TorrentFreak:

For years, content owners such as record labels or movie studios have been sending copyright infringement notices to ISPs, who are legally obliged to forward these to their customers.

(my emphasis). Here's the explanation: I think CNET and TorrentFreak are both just plain wrong. Neither cites any DMCA provision that would obligate an ISP to forward infringement notices premised on p2p infringement by an ISP customer, and I know of none (and believe me, I've looked).

So why, if not forced by the DMCA or other provisions of copyright law, would ISPs forward notices, implement graduated response programs, or even terminate repeat p2p infringers (as TorrentFreak accurately says has been going on for years)? At least three reasons:

1) Because ISPs want to keep Congress off their backs. While the copyleft generally doesn't think online copyright infringement is a serious problem, virtually the entire Congress does. (Remember, the PRO-IP Act passed the House last year 410-11, and by unanimous consent in the Senate.) Suppose ISPs tell copyright owners: "Stop sending us your silly notices, and go pound sand. Section 512(a) protects us, and if our subscribers use BitTorrent to download every movie, TV show, and song on earth, that's your problem, not ours." Legally, they may well be within theirs rights to do exactly that. But politically, they would be virtually begging Congress to amend the DMCA in such away that their safe harbor would become considerably more dangerous. Better to cooperate with copyright owners at least to some extent -- if not all the way up to three strikes -- than to risk a new legal regime in which they would face massive liability if they do not take much stronger action against their infringing subscribers.

2) Because of contractual obligations -- or hopes of getting them. Major copyright owners often have business relationships with ISPs/cable operators/telecoms. For example: a studio may license its movies to a cable provider as part of a VOD service. The studio may say to the MSO: "We'll license you our movies. But you also run an ISP that provides Internet service to millions of subscribers, and neither of us should want to undermine our VOD service (where we split revenue) by having people downloading these very titles for free on BitTorrent. So, as part of our agreement, we want you to pass along infringement notices, institute graduated response, etc." ISPs/MSOs may push back, citing cost, technical difficulties, concern over customer privacy, or Internet freedom, but if they want the content badly enough, they will agree to some cooperation in copyright enforcement above and beyond what the DMCA actually requires. (Of course, ISPs will resist three strikes with all their might. Who wants to terminate customers paying $50 or more every month?)

3) Because -- as the WSJ puts it -- "the increasing burden of large amounts of music and movies [are] clogging [ISPs'] pipes." If forwarding infringement notices and taking stronger action against the worst of the infringers can free up bandwidth and thus increase connection speeds for everyone, then it's perhaps in the ISPs' interest to do it. (This is probably the weakest of the three reasons I've listed. ISPs don't really seem to mind when their customers use p2p systems -- and in fact the ability to download music and movies for free surely attracts many customers -- as long as such uses don't significantly disrupt the operations of their networks.)

So the studios and the record labels will continue to negotiate with the ISPs, and will probably reach various agreements to implement graduated response -- though I have real doubts whether three strikes will be implemented on a large scale. But remember that these negotiations are taking place because of business, long-term political, and technical reasons -- and not because the DMCA actually requires it.