Limited Harbor Space - When Does an ISP Lose Safe Harbor Protection in the US?

[Len]

Safe harbor provisions for intermediaries on the Internet are the cornerstone of keeping it functional, open and above all fair. Without protection for intermediaries, including ISPs, many entities could create an environment of monitoring and control by service providers, which would undoubtedly hinder the functionality of the Internet as we know it. Even so, safe harbor provisions should be a shield, and not deflect all responsibility from providers where they could be, arguably, deemed as complicit with illegal activities. With that in mind, when could an ISP be deemed liable for the copyright infringement of its users? The US Court of Appeals took on this question earlier this month.

The case of BMG Rights Management (US) LLC v Cox Communications dealt with Cox who are an internet service provider for roughly 4.5 million users. Some of these users shared copyright protected files on Cox's service, including music, using the BitTorrent protocol. Cox's service agreement with their users prevents, among other things, the sharing of infringing content using their service, but has very little by way of automated infringement prevention systems (e.g. through automated notifications and a thirteen-strike policy to suspend a repeat offender's service temporarily). BMG identified that several of their copyright protected works were shared using Cox's service, and used a third-party service provider to send notices to Cox (who had, before this, blocked the third-party provider), with the ISP never receiving those notices. BMG then took Cox to court for copyright infringement via its users.

The Court first dealt with the matter of safe harbor protection for Cox under 17 USC section 512. For an ISP to be covered under the provision, it has to show it "…adopted and reasonably implemented… a policy that provides for the termination in appropriate circumstances of subscribers… who are repeat infringers". This would mean any user who, in short, repeatedly infringes copyrights. Even if those infringements would be mere alleged infringements (i.e. they have not gone to court or been admitted to), the provision would still apply as a requirement.

The need to have a reasonably implemented policy on termination also necessitates the meaningful enforcement of that policy. Cox, through their thirteen-strike policy, never terminated users' accounts even after repeat offenses. Through this they avoided the policy's reasonable implementation. In internal correspondence representatives in the Abuse division at Cox would dismiss the termination of users' accounts, and reinforced their reactivation for DMCA notices.

Even in the light of this, Cox contested that they had no "actual knowledge" of their users' infringing activities. The evidence discussed above contradicted this point, and even though the stance was changed internally later on, the Court still deemed them to have clear knowledge of users' infringements and that they actively ignored correspondence on the same by rightsholders. This also contradicted their stance on active implementation of the policy, as almost no users were terminated. Cox therefore failed to qualify for safe harbor protection.

The matter then turned to jury instructions on contributory infringement, particularly what the jury were instructed to consider. Cox contended that, as the product they sold (Internet service) is "…capable of substantial non-infringing use", it cannot be deemed to be infringing. The Court quickly rejected this, and determined that even if the technology can be substantially used for non-infringing purposes, it doesn't give them immunity from contributory infringement.

Secondly, Cox argued that the instructions issued, to consider the intent necessary for contributory infringement, were wrong. The jury were instructed to impose liability if "…Cox knew or should have known of such infringing activity". The Court agreed with Cox on this point, considering that the instructions were incorrect and the court erred in giving them. To prove contributory infringement one has to, according to the Court, provide proof of "…at least willful blindness [and that] negligence is insufficient". Saying the party 'should have known' is too low of a standard. A note the Court makes is that the wilful blindness has to relate to specific instances of infringement, e.g. where they have been notified of infringement and choose to ignore the notices.

Cox's appeal was dismissed, but due to errors in jury instructions the matter was remanded and sent for a new trial.

The case is very interesting, and amends the standard that juries will have to assess contributory infringement against. Clearly, had Cox responded to notices sent to them, most likely they would have been protected by safe harbour provisions. They wilful ignorance of the notices and issues, in addition to their lack of enforcing their own policy on termination, was their undoing. The case does raise a red flag for all ISPs to ensure that they indeed do implement a policy against infringers and enforce it to enjoy safe harbor protection. While the case is still going to be decided on in the future after remittance, it still is an important consideration ahead of the forthcoming decision.