Our comments and trackback policy You Link We Follow, You Comment We Promote

A U.S. Judge has ordered Google to turn over every single bit of information related to the viewing habits of Youtube users, including the user names and IP address, to Viacom. The judgement has been given in the prevailing $1 billion lawsuit that Viacom filed against Google in March 2007.

Viacom slapped Google with a massive DMCA takedown notice that affected 100,000 videos on Youtube, and immediately afterwards filed the said $1 billion U:S. lawsuit accusing Google of copyright infringements. Viacom maintained that Youtube on purpose allowed pirated videos to stay online for as long as possible, and didn’t do anything to protect the copyrighted stuff. Google in its defense maintained that the company is safe as long as it complies to take down notices issued by copyright holders in appropriate time. This in a way meant that in case you will not ask us to take down the videos, we wont take them down ourselves. Viacom argued the Youtube is built upon pirated stuff and that the professional videos get viewed more than the amateur stuff. However some studies show that this was not the case.

The data that is now ordered by the Federal Court to be handed over to Viacom was demanded by Viacom in order to prove that the pirated stuff was more popular than the user generated content. Viacom is working on these lines to try and milk Google to a larger extent. Google’s argument, that turning the data over to Viacom would invade the piracy of its users, was turned down by the Court citing a statement on Google’s own Blog in which Google claims that "IP addresses are not personally revealing by themselves". To quote from the Google Blog:

At Google, we know that user trust is fundamental to our success; users will stop choosing to use Google products and services if they can’t trust us with their data. For this reason, we have made moves to safeguard that privacy, like anonymizing our logs and worked with privacy groups on initiatives like shortening cookie length. We have proposed broad global privacy standards, and are strong supporters of the idea that data protection laws should apply to any data that could identify you. The reality is though that in most cases, an IP address without additional information cannot. The policy debate about data protection and IP addresses will continue, but it’s important to have a firm grasp of the technical realities of the debate in order to reach conclusions that make sense.

Now Google knew it well as does the rest of us that the majority of the Internet population is not tech savvy and hence have never heard the name of IP let alone that of software’s such as IP scrambler or anonymous proxies. Google kept on maintaining the line that IP addresses can not identify a person just to justify the log dump that it keeps for itself and that too for an undisclosed amount of time. The current judgement has put Google in a tricky position. If it now argues that the said data will reveal the privacy of its users, it would mean that prior to this Google was lying to its users by saying that the IP addresses didn’t reveal personal details and hence was sneak peaking into our personal lives. If on the other hand Google simply hands over all this data to Viacom, the company would be guilty of revealing personal details about its users to a third party.

Electronic Frontier Foundation has come forward to the defense of the privacy of Youtube users in a big way. The EFF has argued that the Court’s ruling is faulty on two accounts. Firstly according to the VPPA, the court may not order the production of "personally identifiable information". To quote the VPPA:

in a civil proceeding [except] upon a showing of compelling need for the information that cannot be accommodated by any other means, if—
(i) the consumer is given reasonable notice, by the person seeking the disclosure, of the court proceeding relevant to the issuance of the court order; and
(ii) the consumer is afforded the opportunity to appear and contest the claim of the person seeking the disclosure.

Firstly the Court made no efforts to determine if Viacom’s request could be accommodated in some other way or not. Secondly IP address information is highly personal even if the Don’t be Evil Google argues otherwise on its blog. The court has used Google’s argument that the username is an anonymous pseudonym that users create while signing up for an account on Youtube and hence cannot be used to identify them, against Google itself. According to the ruling if the Login IDs cannot identify the users personally Google must provide them to Viacom.

The fact of the matter is that if only one Youtube user has used a Login ID that could personally identify him, than the Youtube Login Database is protected under the VPPA. In addition to this, the court has not just ordered the production of IP addresses, but also that of all associated information in the Logging database. We all know it fairly well from AOL’s search history leak drama that the material viewed by the user is sufficient enough to identify the user, and does not require any other information such as the Login ID or the IP Address.

The Court orders also require Google to deliver all copies of videos that were ever taken down for any reason. Viacom even requested the source code of Youtube, the code Youtube uses to identify repeat copyright infringement uploads, copies of all videos marked as private, and Google’s advertising database schema. However the court disapproved of these additional demands, but Google will still have to provide information on how often each private video has been watched and by how many people.

The current court order has clearly put Google between The Rock and a Hard Place.