Google, EFF back Cloudflare in row over pirate streams
(2022/06/21)
- Reference: 1655803810
- News link: https://www.theregister.co.uk/2022/06/21/cloudflare_google_eff_piracy/
- Source link:
Google, EFF, and the Computer and Communications Industry Association (CCIA) have filed court documents supporting Cloudflare after it was sued for refusing to block a streaming site.
Earlier this year, a handful of Israel-based media companies took Israel.tv to court, accusing it of streaming TV and movie content it had no right to distribute. The corporations — United King Film Distribution, D.B.S. Satellite Services, HOT Communication Systems, Charlton, Reshet Media and Keshet Broadcasting — won the lawsuit after Israel.tv's creators failed to show up to their hearings, and the judge ordered Israel-tv.com, Israel.tv and Sdarot.tv each pay $7,650,000 in damages.
In a more surprising move, however, the media outfits also won an injunction
[2]
As US federal district Judge Katherine Polk Failla put it in her ruling:
ISPs, web hosting providers, CDN service providers, DNS service providers, VPN service providers, domain name purchasing service, domain names privacy service, back-end service providers, affiliate program providers, web designers, shippers, search-based online advertising services (such as through-paid inclusion, paid search results, sponsored search results, sponsored links, and Internet keyword advertising), any banks, savings and loan associations, merchant account providers, payment processors and providers, credit card associations, or other financial institutions, including without limitation, PayPal, and any other service provider which has provided services or in the future provides services to defendants and/or the infringing website ... are hereby permanently enjoined from providing services to the website ...
It's an extensive list of potential services providers. That said, the media firms homed in on Cloudflare. In June, the six corporations filed
Cloudflare, for its part, argued the lawsuit is now moot because Isreal.tv's website is no longer available online, and Cloudflare hasn't provided services to it since late May.
[4]
[5]
Additionally, perhaps in an attempt to move the subject away from contempt of court, Cloudflare tried to boil the matter down to its essence – a row over pirated films, TV shows, and sports coverage – and argue it isn't responsible for the stuff its customers' put out on the web. Its lawyers noted in court filings
"The fact that plaintiffs filed this 'emergency' motion for contempt against Cloudflare, and Cloudflare alone, among the dozens of third parties identified in the injunction in this case, is puzzling," they added.
Meanwhile this week, Cloudflare announced a browser isolation service for email links that it claims will help block certain attacks.
The service, soon to enter [7]beta , uses tech Cloudflare [8]acquired from Area 1 in February. Here's how it works:
First, the service inspects customers' emails. If it deems any links in the messages to be suspicious, it rewrites these potentially shady URLs to point to special Area 1 addresses.
The email then gets delivered to the user's inbox, and if the user clicks on an altered link, they are rerouted to a remote browser where they can open the link without potentially compromising their own device.
"By executing the browser code and controlling user interactions on a remote server rather than a user device, any and all malware and phishing attempts are isolated, and won't infect devices and compromise user identities," the security and cloud services provider [9]claimed in a blog post.
"This improves both user and endpoint security when there are unknown risks and unmanaged devices," it noted, "and allows users to access websites without having to connect to a VPN or having strict firewall policies."
On June 16, the EFF and CCIA weighed in to support Cloudfare, calling the injunction "impermissibly broad," and in violation of the Federal Rule of Civil Procedure 65 and America's Digital Millennium Copyright Act (DMCA).
"It will cause collateral harm to numerous Internet services and their users by imposing unnecessary costs and compliance burdens," the nonprofits argued in [10]court documents .
[11]
EFF's Mitch Stoltz and Josh Richman [12]likened the ruling to "ordering a telephone company to prevent a person from ever having conversations over the company's network."
Plus, they added, "it could cause intermediaries like Cloudflare to block lawful websites and speech in order to avoid being sanctioned by courts in cases like this."
Also on June 16, Google submitted a letter expressing its concern about the scope of the injunction. "The injunctions entered in these cases purport to bind a variety of third parties…including Google," the web giant argued.
[13]Attack on Titan: Four Japanese Manga publishers sue Cloudflare
[14]Judge rejects claims Cloudflare should be held responsible for customers' copyright infringement
[15]Grooveshark faces $750 MEELLION piracy payout
[16]Cloudflare says it thwarted record-breaking HTTPS DDoS flood
This isn't Cloudflare's first experience with piracy lawsuits. Four Japanese publishers [17]threatened to sue Cloudflare on similar grounds earlier this year.
In late 2021, a US federal judge [18]ruled Cloudflare is not liable for any copyright infringement for content hosted on websites its content-delivery network supports following a lawsuit by wedding dress and gowns wholesalers Mon Cheri Bridals and Maggie Sottero Designs.
[19]
And in 2015 the cloud services provider pushed back against a court order that would have required it to play trademark and copyright cop, seeking out and banning website owners that [20]shared pirated music . ®
Get our [21]Tech Resources
[1] https://regmedia.co.uk/2022/06/20/court_documents.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://regmedia.co.uk/2022/06/20/contempt_of_court_against_cloudflare.pdf
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://regmedia.co.uk/2022/06/20/cloudflare_court_documents.pdf
[7] https://www.cloudflare.com/zero-trust/lp/email-link-isolation/
[8] https://www.theregister.com/2022/02/24/cloudflare_area_1/
[9] https://blog.cloudflare.com/email-link-isolation/
[10] https://www.eff.org/document/amicus-brief-behalf-cloudflare
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.eff.org/deeplinks/2022/06/eff-warns-another-court-about-dangers-broad-site-blocking-orders
[13] https://www.theregister.com/2022/02/01/manga_publishers_sue_cloudflare/
[14] https://www.theregister.com/2021/10/09/cloudflare_cleared_copyright/
[15] https://www.theregister.com/2015/04/26/grooveshark_faces_threequarters_of_a_beelion_damages/
[16] https://www.theregister.com/2022/06/14/cloudflare-record-ddos-attack/
[17] https://www.theregister.com/2022/02/01/manga_publishers_sue_cloudflare/
[18] https://www.theregister.com/2021/10/09/cloudflare_cleared_copyright/
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[20] https://www.theregister.com/2015/04/26/grooveshark_faces_threequarters_of_a_beelion_damages/
[21] https://whitepapers.theregister.com/
Earlier this year, a handful of Israel-based media companies took Israel.tv to court, accusing it of streaming TV and movie content it had no right to distribute. The corporations — United King Film Distribution, D.B.S. Satellite Services, HOT Communication Systems, Charlton, Reshet Media and Keshet Broadcasting — won the lawsuit after Israel.tv's creators failed to show up to their hearings, and the judge ordered Israel-tv.com, Israel.tv and Sdarot.tv each pay $7,650,000 in damages.
In a more surprising move, however, the media outfits also won an injunction
[1]PDF
in the United States in April against a slew of internet companies, among others, banning them from aiding Israel.tv in its piracy.[2]
As US federal district Judge Katherine Polk Failla put it in her ruling:
ISPs, web hosting providers, CDN service providers, DNS service providers, VPN service providers, domain name purchasing service, domain names privacy service, back-end service providers, affiliate program providers, web designers, shippers, search-based online advertising services (such as through-paid inclusion, paid search results, sponsored search results, sponsored links, and Internet keyword advertising), any banks, savings and loan associations, merchant account providers, payment processors and providers, credit card associations, or other financial institutions, including without limitation, PayPal, and any other service provider which has provided services or in the future provides services to defendants and/or the infringing website ... are hereby permanently enjoined from providing services to the website ...
It's an extensive list of potential services providers. That said, the media firms homed in on Cloudflare. In June, the six corporations filed
[3]PDF
suit against the CDN giant, arguing that because it continued providing domain-name and content-distribution services to Israel.tv in spite of the injunction, it should be held in contempt of court.Cloudflare, for its part, argued the lawsuit is now moot because Isreal.tv's website is no longer available online, and Cloudflare hasn't provided services to it since late May.
[4]
[5]
Additionally, perhaps in an attempt to move the subject away from contempt of court, Cloudflare tried to boil the matter down to its essence – a row over pirated films, TV shows, and sports coverage – and argue it isn't responsible for the stuff its customers' put out on the web. Its lawyers noted in court filings
[6]PDF
that data just passes through Cloudflare's networks on its way to and from websites and visitors, and it doesn't engage in editing or removing content."The fact that plaintiffs filed this 'emergency' motion for contempt against Cloudflare, and Cloudflare alone, among the dozens of third parties identified in the injunction in this case, is puzzling," they added.
Meanwhile this week, Cloudflare announced a browser isolation service for email links that it claims will help block certain attacks.
The service, soon to enter [7]beta , uses tech Cloudflare [8]acquired from Area 1 in February. Here's how it works:
First, the service inspects customers' emails. If it deems any links in the messages to be suspicious, it rewrites these potentially shady URLs to point to special Area 1 addresses.
The email then gets delivered to the user's inbox, and if the user clicks on an altered link, they are rerouted to a remote browser where they can open the link without potentially compromising their own device.
"By executing the browser code and controlling user interactions on a remote server rather than a user device, any and all malware and phishing attempts are isolated, and won't infect devices and compromise user identities," the security and cloud services provider [9]claimed in a blog post.
"This improves both user and endpoint security when there are unknown risks and unmanaged devices," it noted, "and allows users to access websites without having to connect to a VPN or having strict firewall policies."
On June 16, the EFF and CCIA weighed in to support Cloudfare, calling the injunction "impermissibly broad," and in violation of the Federal Rule of Civil Procedure 65 and America's Digital Millennium Copyright Act (DMCA).
"It will cause collateral harm to numerous Internet services and their users by imposing unnecessary costs and compliance burdens," the nonprofits argued in [10]court documents .
[11]
EFF's Mitch Stoltz and Josh Richman [12]likened the ruling to "ordering a telephone company to prevent a person from ever having conversations over the company's network."
Plus, they added, "it could cause intermediaries like Cloudflare to block lawful websites and speech in order to avoid being sanctioned by courts in cases like this."
Also on June 16, Google submitted a letter expressing its concern about the scope of the injunction. "The injunctions entered in these cases purport to bind a variety of third parties…including Google," the web giant argued.
[13]Attack on Titan: Four Japanese Manga publishers sue Cloudflare
[14]Judge rejects claims Cloudflare should be held responsible for customers' copyright infringement
[15]Grooveshark faces $750 MEELLION piracy payout
[16]Cloudflare says it thwarted record-breaking HTTPS DDoS flood
This isn't Cloudflare's first experience with piracy lawsuits. Four Japanese publishers [17]threatened to sue Cloudflare on similar grounds earlier this year.
In late 2021, a US federal judge [18]ruled Cloudflare is not liable for any copyright infringement for content hosted on websites its content-delivery network supports following a lawsuit by wedding dress and gowns wholesalers Mon Cheri Bridals and Maggie Sottero Designs.
[19]
And in 2015 the cloud services provider pushed back against a court order that would have required it to play trademark and copyright cop, seeking out and banning website owners that [20]shared pirated music . ®
Get our [21]Tech Resources
[1] https://regmedia.co.uk/2022/06/20/court_documents.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://regmedia.co.uk/2022/06/20/contempt_of_court_against_cloudflare.pdf
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://regmedia.co.uk/2022/06/20/cloudflare_court_documents.pdf
[7] https://www.cloudflare.com/zero-trust/lp/email-link-isolation/
[8] https://www.theregister.com/2022/02/24/cloudflare_area_1/
[9] https://blog.cloudflare.com/email-link-isolation/
[10] https://www.eff.org/document/amicus-brief-behalf-cloudflare
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.eff.org/deeplinks/2022/06/eff-warns-another-court-about-dangers-broad-site-blocking-orders
[13] https://www.theregister.com/2022/02/01/manga_publishers_sue_cloudflare/
[14] https://www.theregister.com/2021/10/09/cloudflare_cleared_copyright/
[15] https://www.theregister.com/2015/04/26/grooveshark_faces_threequarters_of_a_beelion_damages/
[16] https://www.theregister.com/2022/06/14/cloudflare-record-ddos-attack/
[17] https://www.theregister.com/2022/02/01/manga_publishers_sue_cloudflare/
[18] https://www.theregister.com/2021/10/09/cloudflare_cleared_copyright/
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrGWxEVbKBEiJobr2hWA9AAAAIU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[20] https://www.theregister.com/2015/04/26/grooveshark_faces_threequarters_of_a_beelion_damages/
[21] https://whitepapers.theregister.com/
about the aside
That email sanitisation service relies on email not being encrypted, which while the most common scenario, is hardly a happy state of affairs.
A better idea would be for the scanning to happen on the end user's device and then redirect (with user permission to avoid sensitive data being leaked) to the remotely hosted browser (which one hopes is itself properly hardened).