The Github youtube-dl Takedown Isn’t Just a Problem of American Law

The video downloading utility youtube-dl, like other large open source projects, accepts contributions from all around the globe. It is used practically wherever there’s an Internet connection. It’s especially shocking, therefore, when what looks like a domestic legal spat–involving a take-down demand written by lawyers representing the Recording Industry Association of America (RIAA),  a U.S. industry group, to Github, a U.S. code hosting service, citing the Digital Millennium Copyright Act (DMCA), a U.S. law–can rip a hole in that global development process and disrupt access for youtube-dl users around the world.

Those outside the United States, long accustomed to arbitrary take-downs with “DMCA” in their subject line, might reasonably assume that the removal of youtube-dl from Github is yet another example of the American rightsholders’ grip on U.S. copyright law. Tragically for Internet users everywhere, the RIAA was not citing DMCA Section 512, the usual takedown route, but DMCA Section 1201, the ban on breaking digital locks. And the failures of that part of American law that can allow a rightsholder to intimidate an American company into an act of global censorship are coded into more than just the U.S. legal system.

The RIAA’s letter against youtube-dl cites the DMCA 1201’s criminalization of the distribution of technology that can bypass DRM: what’s called the “circumvention of technical protection measures”. It also mentions German law, which contains similar language. Here’s the core of the relevant U.S. statute, in 1201(b): 

1201 (b) Additional Violations.—

1. No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that—
1. is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;
2. has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or 
3. is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof. 

(While the law also has some important and hard-fought exceptions, they mostly apply only to using a circumvention tool, not to creating or distributing one.)

DMCA 1201 is incredibly broad, apparently allowing rightsholders to legally harass any “trafficker” in code that lets users re-take control of their devices from DRM locks.

EFF has been warning against the consequences of this approach even before the DMCA was passed in 1998. That’s because DMCA 1201 is not the first time the U.S. considered adopting such language. DMCA 1201 is the enactment of the provisions of an earlier global treaty: the World Intellectual Property Organization (WIPO)’s Copyright Treaty of 1996. That treaty’s existence is itself largely due to American rightsholders’ abortive attempt to pass a similar anti-circumvention proposal devised in the Clinton administration’s notoriously pro-industry 1995 White Paper on Intellectual Property and the National Information Infrastructure.

Stymied at the time by campaigns by a coalition of early Internet users, librarians, technologists, and civil libertarians in the United States, supporters of U.S. rightsholders laundered their proposal through the WIPO, an international treaty organization controlled by enthusiastic intellectual property maximalists with little understanding of the fledgling Net. The Clinton White Paper proposals failed, but the WIPO Copyright Treaty passed, and was later enacted by the U.S. Senate, smuggling back the provisions that had been rejected years before.

Since 1996, over 100 countries have signed onto the WIPO Copyright Treaty. The Treaty itself uses notably less harsh language in what it requires from its signatories than the DMCA. It says, more simply:

Contracting Parties shall provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of their rights under this Treaty or the Berne Convention and that restrict acts, in respect of their works, which are not authorized by the authors concerned or permitted by law.

But rightsholders ratcheted up the punishments and scope of the Treaty when it was incorporated in U.S. law. 

Most countries adopted the far stronger DMCA 1201 language in their own implementations. That was partly because the U.S. was one of the earliest adopters, and it’s much easier to simply copy-and-paste another nation’s implementation than craft your own. But it’s also because it has been the continuing policy of the United States Trade Representative to pressure other countries to mirror the DMCA 1201 language, either through diplomatic lobbying, or by requiring it as a condition of signing trade agreements with the U.S.

DMCA 1201 has been loaded with terrible implications for innovation and free expression since the day it was passed. For many years, EFF documented these issues in our “Unintended Consequences” series; we continue to organize and lobby for temporary exemptions to its provisions for the purposes of cellphone unlocking, restoring vintage videogames and similar fair uses, as well as file and defend lawsuits in the United States to try and mitigate its damage. We look forward to the day when it is no longer part of U.S. law.

But due to the WIPO Copyright Treaty, the DMCA’s anti-circumvention provisions infest much of the world’s jurisdictions too, including the European Union via the Information Society Directive 2001/29/EC, which stipulates:

Member States shall provide adequate legal protection against the manufacture, import, distribution, sale, rental, advertisement for sale or rental, or possession for commercial purposes of devices, products or components or the provision of services which:

(a) are promoted, advertised or marketed for the purpose of circumvention of, or

(b) have only a limited commercially significant purpose or use other than to circumvent, or

(c) are primarily designed, produced, adapted or performed for the purpose of enabling or facilitating the circumvention of, any effective technological measures.

The EU directive already mirrors the worst of U.S. law in that it apparently prohibits the possession and distribution of anti-circumvention components (the language that led to ridiculous spectacle in the 2000s of legal threats against anyone who posted the DeCSS algorithm online.) Transpositions into domestic European law, and their domestic interpretations, have had the opportunity to make it even worse. 

Fortunately this time, hosts and developers in Germany were confident enough in their rights under German law to reject the RIAA’s take-down demands. But if rightsholders’ organizations wish to continue to misuse the provisions of the Copyright Treaty to go after tools like youtube-dl in yet more countries, they will have to be fought in every country, under the terms of each countries’ version of the WIPO anti-circumvention provisions.

EFF has a long-term plan to beat the anti-circumvention laws, wherever they are, which we call Apollo 1201. But we need help from a global movement to finally revoke this ongoing attack on the world’s creators, innovators, and consumers. You can do your part by examining and understanding your own country’s anti-circumvention provision–and prepare and organize for the moment when your local RIAA comes knocking on your door.