Court: Cloudflare is Liable for Pirate Site, But Not as a DNS Provider

Popular Internet infrastructure service Cloudflare has come under a lot of pressure from copyright holders in recent years.

The company offers its services to millions of customers including multinationals, governments, but also some of the world’s leading pirate sites.

Cloudflare Must Stop Pirate Site

Pirate sites have proven to be quite a headache for Cloudflare and have landed the San Francisco-based tech company in court on several occasions. This includes a case in Germany, where the local branch of Universal Music sued Cloudflare for offering its services to pirate site DDL-Music.

The lawsuit initially didn’t make any headlines, but when Cloudflare displayed an ‘Error 451’ to DDL-Music users in early 2020, it was clear that something was up. The 451 error code is rare and typically reserved for cases where content has been made inaccessible for legal reasons.

In this case, Universal obtained a preliminary injunction against Cloudflare that required the company to stop providing its services to the pirate site. Failure to comply could’ve invoked a fine of up to 250,000 euros ($274,000) or, even worse, Cloudflare’s managing director could’ve been sent to prison for up to six months.

Cloudflare complied with the order but took the case to appeal. The case eventually made its way to the Cologne Higher Regional Court, which handed down a mixed decision earlier this month.

Mixed Decision from Higher Court

In its decision, the Court confirmed that Cloudflare must take action against the blatantly-infringing pirate site, dismissing Cloudflare’s concerns that this could lead to overblocking. According to the ruling, DDL-Music has no other purpose than to share pirated music and Cloudflare plays a central role in making the site available.

The ruling will come as a disappointment to the Internet infrastructure company, but there’s a positive note as well. In addition to stopping its services to DDL-Music as a customer, Universal also wanted Cloudflare to block the site on its public DNS resolver 1.1.1.1.

The Cologne court concluded that a DNS blockade would be a step too far, as Cloudflare’s DNS doesn’t play a central role in making the site accessible. There are other DNS providers that do the same.

“[D]efendant’s DNS resolver does not play a ‘central role’ in ensuring that the disputed music album could be freely shared on the Internet. The use of the defendant’s DNS resolver was neither necessary to find the IP address via the domain name, nor does it make access easier,” the court writes.

“The domain name could be resolved into the IP address just as easily using any other DNS resolver. The defendant’s public DNS resolver 1.1.1.1 is just one of many freely accessible DNS resolvers, the best known and most used of which is the Google public DNS resolver 8.8.8.8. The defendant’s DNS resolver therefore had no significant relevance to the accessibility of the infringing content of the disputed domain.”

According to the verdict, a DNS provider operates in a purely passive, automatic and neutral manner. This sets it apart from hosting providers or CDN services, which can invoke liability under Germany’s Telemedia Act (TMG) and EU law.

The DNS Blocking Frontier

The Cologne Higher Regional Court’s ruling is significant, and not just for Cloudflare. After many countries established that pirate sites can be blocked by Internet providers, copyright holders are trying to expand similar obligations further up the intermediary chain.

In this case, the Court established that CDN services can be liable but drew the line at DNS resolvers. That could prove to be important for DNS resolver Quad9, which faces a similar legal battle in Germany.

The issue isn’t limited to Germany either. A similar court order in Italy requires Cloudflare to block access to three pirate sites through its public DNS resolver.

These and other court orders will ultimately lead to important precedents going forward. However, the direct effect of the recent German ruling is rather limited. As Tarnkappe rightfully notes, DDL-Music has been offline since 2021, so there’s no need to block it at all.

Heise reports that the German Federal Music Industry Association (BVMI) is nonetheless pleased with the outcome, as it shows that Cloudflare plays a “central role in making illegal content accessible.”

According to the music group’s Managing Director of Legal & Politics, René Houareau, the decision sends “a further signal against the illegal use of music recordings by tightening liability as real perpetrator liability”.