Unintended Consequences: How the DMCA Made the Distribution of Stolen Celebrity Photos All Too Easy

Stephen Carlisle September 11, 2014

The ugly side of the internet was on vivid display last week. One or more persons still unknown engaged in a prolonged hacking attack to access the personal photographs of various celebrities in which they appeared fully or partially nude, including academy award winning actress Jennifer Lawrence, model Kate Upton, actress Kirsten Dunst, actress Mary Elizabeth Winstead, ¹ and Olympic Gymnast Mykala Maroney. ² These photos were then leaked over the internet for all to see. In the case of British TV actress, Jessica Brown Findlay, a short sex tape was posted. ³

The package of photos and videos had apparently been floating around the dark corners of the internet for some time, under the title “Major Win.” ⁴  That a sickening invasion of peoples’ privacy is seen as a “major win” tells you a lot about the hacker community that is responsible for this. Mykala Maroney, Ariana Grande and Victoria Justice all denied the pictures were authentic, since faking a nude photo of a celebrity is all too easy in the era of Photoshop. Grande insists that the photos are not of her and has not backed off that claim. ⁵ Justice later admitted they were real, and threatened legal action. ⁶ Maroney also later admitted the photos were real, but with a twist. She was only 16 when the photos were taken, making them illegal child pornography. ⁷

The photos were first leaked to a website known as 4Chan, a site, according to Jonathan Bailey at Plagiarism Today, which is an “anonymous message board that is infamous for shocking and offensive content.” ⁸ From there, the package spread to Reddit, under the sub-reddit tag of “The Fappening,” a title combining the words “happening” with “fap,” a slang term for masturbation. ⁹ The Fappening proved so popular that the enormous amount of visitors to Reddit looking for the photos threatened to crash the entire Reddit site. ¹⁰

The distribution of these photos was illegal on at least four levels:

• They were the result of the illegal hack of private databases
• They were an invasion of privacy
• They were infringements of copyright
• In the case of Mykala Maroney, they were illegal child pornography

There was no doubt that the images were protected by copyright, and the celebrities had the right to demand their removal. The photos were either “selfies” in which the celebrity owned the copyright, or someone intimately involved with the celebrity took the photo and could assert a copyright claim. Reddit asserts it was under no legal obligation to prevent the posting of such illegal material in the first place, all because of the DMCA. ¹¹ Under the DMCA, Reddit has “safe harbor” immunity against any copyright infringement liability that comes from user posted content. ¹²

Their only obligation is that once informed by a DMCA takedown notice, they are to act “expeditiously to remove, or disable access to, the material.” ¹³ What constitutes an “expeditious” time is subject to debate. For its part, the ever helpful Google listed the Jessica Brown Findlay sex video on the very first page of search results for her name for more than eight hours. ¹⁴ It was viewed over 500,000 times, and then copied to social media and pornography sites, where it received another 600,000 hits. ¹⁵ Google has now pushed that particular search result back, but not removed it. ¹⁶ The website that hosted the material has now removed it, ¹⁷ but clearly the damage has been done. The digital nature of the file ensures that it is still out there on the internet somewhere.

Reddit did respond to the DMCA takedown notices, only to find the material instantly re-posted. ¹⁸ This is the phenomenon known as “whack-a-mole” which was discussed in a previous blog post. ¹⁹ These, of course, generated another stream of takedown notices, which in turn, of course, generated another stream of re-postings. ²⁰ The constant game of whack-a-mole not only consumed vast resources of time and effort by the Reddit staff, but due to the constant re-posting of photos of Mykala Maroney, which constitute child pornography, exposed Reddit to serious criminal liability. ²¹ In the end, Reddit gave up and banned the entire thread, and all resulting subthreads. ²²

Of course, the Fappening package is still available from the Pirate Bay, and is their most popular download. ²³

This demonstrates the unintended consequences of the DMCA takedown provisions. If there was strict liability, most of this would never have happened, as such obviously infringing and illegal material would not have been allowed to be posted in the first place. It would not prevent illegal posting totally because there are always people like the Pirate Bay, who could not care less that they are invading people’s privacy and distributing child pornography.

By placing the burden on the copyright holders to police the internet, the DMCA ensures that infringing material will be posted and available for at least a period of time sufficient to ensure that the illegal copy is widely disseminated. The rule that the takedown must happen “expeditiously,” again ensures that the illegal copy remains available after the notice is received, until the website gets around to removing it. In one documented instance, this took months. ²⁴ And lastly there is the whack-a-mole problem. The DMCA only provides that the web site take the material down. It does not place any duty on the website to take down re-posts, unless of course they get another DMCA takedown notice. This is a process which just repeats and repeats as if it is a film loop.

What is interesting is the outrage that the Fappening has produced. It is a bit of a curiosity when one considers the fact that what happened to celebrity photos is no different than what copyright content providers have been facing for years. David Lowery at the Trichordist observes, “The same mentality and arguments that make it acceptable to hack and post personal photos have been used as an excuse to ignore the massive, for profit, theft of personal copyrighted works for more than a decade. Neither is acceptable. As the future of music is tied to ad funded piracy, so is privacy tied to internet profits by the same lack of personal consent.” ²⁵

Usually any attempt to protest the large scale hijacking of copyrighted works devolves into a debate on the merits of copyright in general, with the inevitable charge that content creators are somehow dinosaurs riding a failed business model. Absolutely none of those arguments apply here, yet the result is exactly the same. The material is copied and passed around the world with a total disregard for the rights of the people involved, and when removed, it is re-posted, time and time again. Plainly, the whole “copyright is dead” line of thought is merely an excuse to engage in illegal conduct that people wish to do anyway.

As Jonathan Bailey of Plagiarism Today eloquently put it, “When the rights and wishes of others are easy to ignore and “because I can” becomes a valid reason to do something, no one is safe.” …“And that is the scary thing. Today it’s Jennifer Lawrence, tomorrow it could be you, your spouse, your best friend or your child.” ²⁶

Copyright is the one tool that one has that has the chance to be effective against malicious hacking such as the Fappening, and its partner in crime “revenge porn,” i.e. the deliberate posting of nude and sexually explicit photos of a former romantic partner to get back at them. ²⁷ As opposed to the only other available methods, namely lawsuits and trying to convince a State or Federal prosecutor to take action, a DMCA notice can be done rather quickly, though, as pointed out above, not so quick as to eliminate the problem. Yet to be truly effective, takedown needs to be “take down and stay down” as proposed by my previous blog. Otherwise, more Fappenings will occur, and the result will be the same.

There is one interesting postscript to all of this. The site that started it all, 4Chan, may be in for some serious liability here. It seems that since their website operates to remove all posts very quickly (presumably in an effort to constantly drive traffic to the site) they neglected to appoint a registered agent to receive DMCA takedown notices. ²⁸ The appointment of a DMCA registered agent is an absolute requirement to receive safe harbor protection. ²⁹ So, 4Chan has no safe harbor, and can be held directly liable for the infringing material posted on its site. Let’s hope that one of these aggrieved ladies makes them pay royally for this shameful violation of their privacy.