The RIAA Sledgehammer

The battle between the Recording Industry Association of America (RIAA) and Internet music downloaders continues to rage, and is beginning to take its toll, not just on musical mutineers, but on the Internet community as a whole. Using the broad reach of the Digital Millennium Copyright Act (DMCA), the RIAA is pressing Internet Service Providers (ISPs) into service, demanding they turn over the names of potential copyright violators. The problem is, however, that the RIAA is using a sledgehammer on a pin, and, unfortunately, that sledgehammer is available to virtually anyone who cares to wield it.

The DMCA was passed by Congress in 1998 with strong support from copyright holders to staunch the free flow of copyrighted materials online. The advent of file swapping technologies such as Napster and Kazaa only made the task more challenging. Napster, with an aggressive attitude and a central repository of material for download, was quick to draw fire and vulnerable to legal challenges. However, newer file sharing technologies like Kazaa are less tangible; they have no central database of downloads. Instead, files reside on the hard disks of individual users, making the job of tracking down copyright violators that much more difficult. This makes them a more elusive legal target, and the courts have refused to ban these file-sharing technologies simply because they can be used for illegal purposes. So, using the DMCA, the RIAA is forcing ISPs—from broadband providers such as Verizon to college network administrators—to do their dirty work and ferret out illegal file sharing.

One victim, college student Jesse Jordan, has become somewhat of a folk hero, according to Rolling Stone. After creating a search engine to facilitate file sharing, he was sued, along with three other college students who made similar search engines. The RIAA sought $150,000 for each illegal download, for a total of $900 million. Jordan settled for $12,000 (roughly what he had saved in high school to pay for college), and the others settled for similar amounts. Since then the online community has responded with donations to Jordan that total covered full $12,000. While music fans may be sympathetic, the RIAA has used the courts to pursue these cases whenever possible, and subpoenas have been served to broadband providers, colleges, and others that may be able to provide the names of individual music downloaders. Online sites, such as the Electronic Frontier Foundation have established databases for Internet users to inquire whether their usernames have been subpoenaed.

Verizon, a large broadband ISP, has challenged the use of these subpoenas every step of the way. To date, however, the courts have sided with the RIAA, which has only encouraged more aggressive action. The RIAA has unleashed a blitz of subpoenas against ISPs and universities, with the number served already topping 1,000. These actions have led other ISPs to join the opposition to RIAA’s heavy-handed tactics. After receiving more than 200 subpoenas Pac Bell, which owns a large ISP, also filed a lawsuit against the RIAA. Some universities, such as MIT and Boston College have refused to respond to subpoenas, and others may be considering similar actions. Elsewhere, university administrators are incorporating new guidelines and instructions for students in the face of hard-ball tactics from content providers. The University of California, Berkeley, estimates it has already spent more than $15,000 processing DMCA related requests.

Beyond the burden of dealing with the RIAA blitz, the subpoena process outlined in the DMCA poses significant privacy problems. In fact, it bears no semblance to what most people consider a subpoena to be. Traditionally, a subpoena is sent to a judge, who examines its merits and then decides whether it should be issued. The DMCA simply requires a copyright owner to submit a one-page request to the clerk of the court who then issues the subpoena, providing the person making the request unlimited access to private information in search of potential copyright violations. To make things worse, the definition of copyright is extremely broad, which offers the potential for abuse from almost anyone seeking access to personal information about others.

Fortunately, problems of the DMCA have not gone unnoticed. Senator Norm Coleman (R-Minn.) has called on the RIAA to provide answers about its latest flurry of subpoenas, claiming the net has been cast too widely and that processing the subpoenas is creating a backlog in the D.C. District Court. While copyright concerns are valid in an online world, Congress must revisit the issue and re-assert the primacy of privacy in any attempt to address issues of file-sharing. Internet service providers are being placed in the position of having to intrude on their customers, and those customers are having to relinquish their privacy based on nothing more than allegation.

But Congress needs to act quickly; the floodgates are open and the subpoenas are multiplying. The RIAA is also working to export the DMCA, urging the European Parliament to include similar measures in its directive on intellectual property. Ultimately, however, it may take the courts to sort out the interests at stake. Verizon’s appeal will be heard in September, and other cases are moving forward as well. To date, the lawsuits have addressed only the DMCA’s statutory, language; the subpoenas have yet to be challenged as unconstitutional. But, in the end, it may be that the threat to privacy can only be checked through a constitutional challenge to a law that expands private police powers at the expense of privacy.