The most important thing to understand when it comes to the way the abuse team handles DMCA complaints is that our procedures aren’t just SoftLayer policy — they are the law. Our role in processing copyright complaints is essentially that of a middleman. In order to protect our Safe Harbor status under the Online Copyright Infringement Liability Limitation Act (OCILLA), we must enforce any complaint that meets the legal requirements of a takedown notice. That DMCA complaint must contain specific elements and be properly formatted in order to be considered valid.

Responding to a DMCA Complaint

When we receive a complaint that meets the legal requirements of a DMCA takedown notice, we must relay the complaint to our direct customer and enforce a deadline for removal of the violating material. We are obligated to remove access to infringing content when we are notified about it, and we aren’t able to make a determination about the validity of a claim beyond confirming that all DMCA requirements are met.

The law states that SoftLayer must act expeditiously, so if you receive notification of a DMCA complaint, it’s important that you acknowledge the ticket that the abuse department opened on your account and let us know your intended course of action. Sometimes that action is as simple as removing an infringing URL. Sometimes you may need to contact your client and instruct them to take the material down. Whatever the case may be, it’s important to be responsive and to expressly confirm when you have complied and removed the material. Failure to acknowledge an abuse ticket can result in disconnection of service, and in the case of copyright infringement, SoftLayer has a legal obligation to remove access to the material or we face serious liability.

DMCA Counter Notifications

Most DMCA complaints are resolved without issue, but what happens if you disagree with the complaint? What if you own the material and a disgruntled former business partner is trying to get revenge? What if you wrote the content and the complaining party is copying your website? Thankfully there are penalties for filing a false DMCA complaint, but you also have recourse in the form of a counter notification. Keep in mind that while it may be tempting to plead your case to the abuse department, our role is not to play judge or jury but to allow the process to work as it was designed.

In some cases, you may be able to work out a resolution with the complaining party directly (misunderstandings happen, licenses lapse, etc.) and have them send a retraction, but most of the time your best course of action is to submit a counter notification.

Just as a takedown notice must be crafted in a specific way, counter notifications have their own set of requirements. Once you have disabled the material identified in the original complaint, we can provide your valid, properly formatted counter notification to the complaining party. Unless we receive a court order from the complaining party within the legally mandated time frame the material can be re-enabled and the case is closed for the time being.

While it might sound complicated, it’s actually pretty straightforward, but we urge you to do your research and make sure you know what to do in the event a client of yours is hit with a DMCA takedown notice. Just as we are unable to make judgment calls when it comes to takedown notices or counter notifications, we are also unable to offer any legal advice for you if you need help. Hopefully this post cleared up a few questions and misconceptions about how the abuse department handles copyright complaints. In short:

Do take DMCA notifications seriously. You are at risk for service interruption and possible legal liability.
Do respond to the abuse department letting them know the material has been disabled and, if applicable, if you plan to file a counter notification.
Don’t refuse to disable the material. Even if you believe the claim is false and you wish to file a counter notification, the material must be disabled within the time period allotted by the abuse department or we have to block access to it.
Don’t expect the abuse department to take sides.

As with any abuse issue, communication and responsiveness is important. Disconnecting your server is a last resort, but we have ethical and legal obligations to uphold. The DMCA process certainly has its weaknesses and it leaves a bit to be desired, but at the end of the day, it’s the law, and we have to operate inside of our legal obligation to it.

-Jennifer

Beyond our responsibility to enforce the law and our Acceptable Use Policy, the Abuse department is designed to be a valuable asset for our customers. We’ll notify you of all valid complaints (and possibly highlight security vulnerabilities in the process), we’ll assist you with blacklist removal, we can serve as a liaison between you and other providers if there are any problems, and if you operate an email-heavy platform or service, we can help you understand the steps you need to take to avoid activity that may be considered abuse.

At the end of the day, if the Abuse department can maintain a good rapport with our customers, both our jobs can be easier, so I thought this installment in the “Tips from the Abuse Department” series could focus on some best practices for corresponding with Abuse from a customer perspective.

Check Your Tickets

This is the easiest, most obvious recommendation I can give. You’d be surprised at how many service interruptions could be avoided if our customers were more proactive about keeping up with their open tickets. Our portal is a vital tool for your business, so make sure you are familiar with how to access and use it.

Keep Your Contact Information Current

Our ticket system will send notifications to the email address you have on file, so making sure this information is correct and current is absolutely crucial, especially if you aren’t in the habit of checking the ticket system on a regular basis. You can even set a specific address for abuse notifications to be sent to, so make use of this option. The quicker you can respond to an abuse report, the quicker the complaint can be resolved, and by getting the complaint resolved quickly, you avoid any potential service interruption.

If we are unable to reach you by ticket, we may need to call you, so keep your current phone numbers on file as well.

Provide Frequent Updates

Stay in constant communication in the midst of responding to an abuse report, and adhere to the allotted timeline in the ticket. If we don’t see updates that the abusive behavior is being addressed in the grace period we are able to offer, your server is at risk of disconnection. By keeping us posted about the action you’re taking and the time you need to resolve the matter, we’re able to be more flexible.

If a customer on your servers created a spamming script or a phishing account, taking immediate steps to mitigate the issue by suspending that customer is another great way to respond to the process while you’re performing an investigation of how that activity was started. We’ll still want a detailed resolution, but if the abuse is not actively ongoing we can work with you on deadlines.

Be Concise … But Not Too Concise

One-word responses: bad. Page long responses: also not ideal. If given the option we would opt for the latter, but your goal should be to outline the cause and resolution of any reported abusive activity as clearly and succinctly as possible in order to ease communication and expedite closing of the ticket.

Responding to a ticket with, “Fixed,” is not sufficient to for the Abuse department to consider the matter resolved, but we also don’t need a dump of your entire log file. Before the Abuse team can close a ticket, we have to see details of how the complaint was resolved, so if you don’t provide those details in your first response, you can bet we’ll keep following up with you to get them. What details do we need?

Take a Comprehensive Approach

In addition to stopping the abusive activity we want to know:

1. How/why the issue occurred
2. What steps are being taken to prevent further issues of that nature

We understand that dealing with abuse issues can often feel like a game of Whack-A-Mole, but if you can show that you’re digging a bit deeper and taking steps to avoid recurrence, that additional work is very much appreciated. Having the Abuse department consider you a proactive, ethical and responsible customer is a worthy goal.

Be Courteous

I’m ending on a similar note to my last blog post because it’s just that important! We understand getting an abuse ticket is a hassle, but please remember that we’re doing our best to protect our network, the Internet community and you.

Unplugging your server is a last resort for us, and we want to make sure everyone is on the same page to prevent us from getting to that last resort. In the unfortunate event that you do experience an abuse issue, please refer back to this blog — it just might save you some headaches and perhaps some unnecessary downtime.

-Jennifer

It stands to reason that the more efficient people are at reporting abuse, the more efficient we can be at shutting down the activity, so I’ve compiled some tips and resources to make this process easier. Enjoy!

Review our Legal Page

Not only does this page contain our contact details, there’s a wealth of information on our policies including what we consider abuse and how we handle reported issues. For starters, you may want to review our AUP (Acceptable Use Policy) to get a feel for our stance on abuse and how we mitigate it.

Follow Proper Guidelines

In addition to our own policies, there are legal aspects we must consider. For example, a claim of copyright infringement must be submitted in the form of a properly formatted DMCA, pursuant to the Digital Millennium Copyright Act. Our legal page contains crucial information on what is required to make a copyright claim, as well as information on how to submit a subpoena or court order. We take abuse very seriously, but we must adhere to the law as well as our privacy policy in order to protect our customers’ businesses and our company from liability.

Include Evidence

Evidence can take the form of any number of things. A few common examples:

• A copy of the alleged spam message with full headers intact.
• A snippet from your log file showing malicious activity.
• The full URL of a phishing page.

Without evidence that clearly ties abusive activity to a server on our network, we are unable to relay a complaint to our customer. Keep in mind that the complaint must be in a format that allows us to verify it and pass it along, which typically means an email or hard copy. While our website does have contact numbers and addresses, email is your best bet for most types of complaints.

Use Keywords

We use a mail client specifically developed for abuse desks, and it is configured with a host of rules used for filtering and prioritization. Descriptive subject lines with keywords indicating the issue type are very useful. Including the words “Spam,” “Phishing” or “Copyright” in your subject line helps make sure your email is sent to the correct queue and, if applicable, receives expedited processing. Including the domain name and IP address in the body of the email is also helpful.

Follow Up

We work hard to investigate and resolve all complaints received however, due to volume, we typically do not respond to complaining parties. That said, we often rely on user complaints to determine if an issue has resumed or is ongoing so feel free to send a new complaint if activity persists.

Be Respectful

The only portion of your complaint we are likely to relay to our customer is the evidence itself along with any useful notes, which means that paragraph of profanity is read only by hardworking SoftLayer employees. We understand the frustration of being on the receiving end of spam or a DDOS, but please be professional and try to understand our position. We are on your side!

Hopefully you’ve found some of this information useful. When in doubt, submit your complaint to abuse@softlayer.com and we can offer further guidance. Stay tuned for Part 2, where I’ll offer suggestions for SoftLayer customers about how to facilitate better communication with our Abuse department to avoid service interruption if an abuse complaint is filed against you.

-Jennifer

Late Friday afternoon, Judiciary Committee Chairman Lamar Smith announced that the DNS-blocking provisions would be removed from SOPA, and on Saturday, The White House responded to in opposition to the the bills as they stand today. Shortly thereafter, SOPA was “shelved.”

The Internet was abuzz … but the Champagne wasn’t getting popped yet. After digging into the details, it was revealed that SOPA being “shelved” just meant that it is being temporarily put to sleep. Judiciary Committee Chairman Lamar Smith stood explained:

“To enact legislation that protects consumers, businesses and jobs from foreign thieves who steal America’s intellectual property, we will continue to bring together industry representatives and Members to find ways to combat online piracy.

Due to the Republican and Democratic retreats taking place over the next two weeks, markup of the Stop Online Piracy Act is expected to resume in February.”

I only mention this because it’s important not to forget that SOPA isn’t dead, and it’s still very dangerous. If you visit sites like reddit, Wikipedia, Mozilla and Boing Boing today (January 18, 2012), you experience the potential impact of the legislation.

The Internet’s outrage against SOPA has brought about real change in our nation’s capital: The House is reconsidering the bill, and they’ll hopefully dismiss it. With our collective momentum, we need to look at the PROTECT IP Act (PIPA, or Senate Bill 968) – a similar bill with similarly harmful implications that’s been sneaking around in SOPA’s shadow.

As it is defined today, PIPA has a stated goal of providing the US Government and copyright holders an additional arsenal of tools to aide in taking down ‘rogue websites dedicated to infringing or counterfeit goods.’ The Senate bill details that an “information location tool shall take technically feasible and reasonable measures, as expeditiously as possible, to remove or disable access to the Internet site associated with the domain name set forth in the order.” In addition, it must delete all hyperlinks to the offending “Internet site.”

Our opposition to PIPA is nearly identical to our opposition to SOPA. Both require a form of essentially breaking a core aspect of how the Internet functions – whether that breakage happens in DNS (as detailed in my last blog post) or in the required rearchitecture of the way any site that accepts user-generated content has to respond to PIPA-related complaints.

PIPA is scheduled for Senate vote on January 24, 2012. It is important that you voice your opinion with your government representatives and let them know about your opposition to both SOPA and PIPA. We want to help you get started down that path. Find your local representatives’ contact information:

[SOPA Concerns]: Contact your congressperson in the U.S. House of Representatives
[PIPA Concerns]: Contact your Senator in the U.S. Senate

Keep spreading the word, and make sure your voice is heard.

-@toddmitchell

Given how pervasive the Internet is in our daily lives, you shouldn’t need to be “a techie” to understand the basics of what makes the Internet work … And given the significance of the SOPA legislation, you should understand where the bill would “break” the process. Let’s take a high level look at how the Internet works, and from there, we can contrast how it would work if SOPA were to pass.

The Internet: How Sites Are Delivered

1. You access a device connected in some way to the Internet. This device can be a cell phone, a computer or even a refrigerator. You are connected to the Internet through an Internet Service Provider (ISP) which recognizes that you will be accessing various sites and services hosted remotely. Your ISP manages a network connected to the other networks around the globe (“inter” “network” … “Internet”).
2. You enter a domain name or click a URL (for this example, we’ll use http://www.softlayer.com since we’re biased to that site).

3. Your ISP will see that you want to access “www.softlayer.com” and will immediately try to find someone/something that knows what “www.softlayer.com” means … This search is known as an NS (name server) lookup. In this case, it will find that “www.softlayer.com” is associated with several name servers.

4. The first of these four name servers to respond with additional information about “softlayer.com” will be used. Domains are typically required to be associated with two or three name servers to ensure if one is unreachable, requests for that domain name can be processed by another.
5. The name server has Domain Name System (DNS) information that maps “www.softlayer.com” to an Internet Protocol (IP) address. When a domain name is purchased and provisioned, the owner will associate that domain name with an authoritative DNS name server, and a DNS record will be created with that name server linking the domain to a specific IP address. Think of DNS as a phone book that translates a name into a phone number for you.

6. When the IP address you reach sees that you requested “www.softlayer.com,” it will find the files/content associated with that request. Multiple domains can be hosted on the same IP address, just as multiple people can live at the same street address and answer the phone. Each IP address only exists in a single place at a given time. (There are some complex network tricks that can negate that statement, but in the interest of simplicity, we’ll ignore them.)
7. When the requested content is located (and generated by other servers if necessary), it is returned to your browser. Depending on what content you are accessing, the response from the server can be very simple or very complex. In some cases, the request will return a single HTML document. In other cases, the content you access may require additional information from other servers (database servers, storage servers, etc.) before the request can be completely fulfilled. In this case, we get HTML code in return.

8. Your browser takes that code and translates the formatting and content to be displayed on your screen. Often, formatting and styling of pages will be generated from a Cascading Style Sheet (CSS) referenced in the HTML code. The purpose of the style sheet is to streamline a given page’s code and consolidate the formatting to be used and referenced by multiple pages of a given website.

9. The HTML code will reference sources for media that may be hosted on other servers, so the browser will perform the necessary additional requests to get all of the media the website is trying to show. In this case, the most noticeable image that will get pulled is the SoftLayer logo from this location: http://static2.softlayer.com/images/layout/logo.jpg

10. When the HTML is rendered and the media is loaded, your browser will probably note that it is “Done,” and you will have successfully navigated to SoftLayer’s homepage.

If SOPA were to pass, the process would look like this:

The Internet: Post-SOPA

1. You access a device connected in some way to the Internet.
2. You enter a domain name or click a URL (for this example, we’ll use http://www.softlayer.com since we’re biased to that site).

*The Change*

3. Before your ISP runs an NS lookup, it would have to determine whether the site you’re trying to access has been reported as an “infringing site.” If http://www.softlayer.com was reported (either legitimately or illegitimately) as an infringing site, your ISP would not process your request, and you’d proceed to an error page. If your ISP can’t find any reference to the domain an infringing site, it would start looking for the name server to deliver the IP address.
4. SOPA would also enforce filtering from all authoritative DNS provider. If an ISP sends a request for an infringing site to the name server for that site, the provider of that name server would be forced to prevent the IP address from being returned.
5. One additional method of screening domains would happen at the level of the operator of the domain’s gTLD. gTLDs (generic top-level domains) are the “.____” at the end of the domain (.com, .net, .biz, etc.). Each gTLD is managed by a large registry organization, and a gTLD’s operator would be required to prevent an infringing site’s domain from functioning properly.
6. If the gTLD registry operator, your ISP and the domain’s authoritative name server provider agree that the site you’re accessing has not been reported as an infringing site, the process would resume the pre-SOPA process.

*Back to the Pre-SOPA Process*

7. The domain’s name server responds.
8. The domain’s IP address is returned.
9. The IP address is reached to get the content for http://www.softlayer.com.
10. HTML is returned.
11. Your browser translates the HTML into a visual format.
12. External file references from the HTML are returned.
13. The site is loaded.

The proponents of SOPA are basically saying, “It’s difficult for us to keep up with and shut down all of the instances of counterfeiting and copyright infringement online, but it would be much easier to target the larger sites/providers ‘enabling’ users to access that (possible) infringement.” Right now, the DMCA process requires a formal copyright complaint to be filed for every instance of infringement, and the providers who are hosting the content on their network are responsible for having that content removed. That’s what our abuse team does full-time. It’s a relatively complex process, but it’s a process that guarantees us the ability to investigate claims for legitimacy and to hear from our customers (who hear from their customers) in response to the claims.

SOPA does not allow for due process to investigate concerns. If a site is reported to be an infringing site, service providers have to do everything in their power to prevent users from getting there.

-@toddmitchell

Many in our industry have already commented (and in some cases, “changed their minds”) on SOPA and its equally evil twin, the PROTECT IP Act (“PIPA”) in the Senate, but we wanted to share our perspective on the legislation. Even with these Dudley-Do-Right, Goody-Two-Shoes titles and their ambitious goals, SoftLayer opposes these bills in their current forms because they expose innocent and law-abiding hosting companies to uncertain liabilities.

Because this legislation has gotten quite a bit of attention in the past few months, you’re probably already familiar with it, but if you haven’t paid much attention, we can give you a quick summary: As you can read in the name of the bill, SOPA is being proposed to “Stop Online Piracy.” SOPA is under consideration by the House Judiciary Committee, and its intent is to provide additional enforcement tools to combat foreign ‘rogue’ websites that are dedicated to copyright infringement or counterfeiting. That’s a great goal, and SoftLayer does not oppose the intent of the Act … As you saw from Kevin Hazard’s blog post a few weeks ago, we have a team of people working all the time to track down and immediately address any violations of our terms of service (including copyright infringement), so we wholeheartedly agree that copyright infringement and counterfeiting are bad.

The way SOPA tries to address the problem is where we disagree with the bill, so let’s talk about the most pertinent part of the bill for a service provider like SoftLayer. If SOPA were to pass, when a case of infringement is reported, we would have to “take such measures as [we determine] to be the least burdensome, technically feasible, and reasonable means designed to prevent access by [our] subscribers located within the United States to the foreign infringing site that is subject to the order.”

What that means: We would be forced to turn off our customers’ access to a small piece of the Internet.

How are we to do that? Well the “least burdensome, technically feasible, and reasonable means designed to prevent access” are not made clear, but most of the discussions about the bill have focused on changing the way the Doman Name System (DNS) resolves to an “infringing site.” We’d be more or less ordered to break DNS … DNS was designed to simply, accurately and quickly match a domain name with the IP address that domain’s owner provides, and if SOPA were to pass, we’d have to tell DNS to behave correctly for every site EXCEPT the reported infringing sites. Again, that’s not spelled out in the legislation, so it’s like being given a job by someone who has no idea how to do the job nor whether the job is even possible to successfully complete.

And that’s all assuming that the order to suspend access to an “infringing site” is legitimate. Many of the organizations that oppose SOPA have explained possible scenarios where orders could be filed under the guise of preventing copyright infringement. A competing site/business could claim:

“the operator of the site operates the site with the object of promoting, or has promoted, its use to carry out acts that constitute a violation of section 501 or 1201 of title 17, United States Code, as shown by clear expression or other affirmative steps taken to foster such violation.”

In another scenario, a copyright holder could pull the trigger on an order simply at the thought that a user could infringe on a copyright on/via the “infringing site.”

When the United States House of Representatives reconvenes after its winter recess, we will be watching intently with hopes that the Internet’s response to the bill has effectively derailed it in its current form. As SoftLayer General Council Suzy Fulton mentioned in her post about Texas House Bill 1841, we’ve been working with an industry group called TechAmerica which submitted a letter to Congress about SOPA and many of the issues that could negatively affect our industry. Additionally, we’ve gotten involved with SaveHosting.org to speak out against laws that can hurt our customers.

As discussions continue about SOPA, we’ll look for opportunities to share more of our insight with you here on our blog. Please let us know your thoughts about the legislation below.

-@toddmitchell