Publishers Carpet-Bomb IPFS Gateway Operators With DMCA Notices

IPFS is a decentralized network that makes it possible to efficiently distribute high volumes of data between peers while avoiding downtime associated with regular hosting outages.

The IPFS project describes the system as a peer-to-peer hypermedia protocol designed to preserve and grow humanity’s knowledge by making the web upgradeable, resilient, and more open. Anyone who values these qualities is invited to come along for the ride using free, open source tools.

IPFS Gateways

For those who prefer not to install software but would still like to access content stored on IPFS, web gateways provide streamlined access to IPFS with zero fuss. IPFS gateways tend to be run by supporters and enthusiasts who charge nothing for their time and usually pay all of the bills.

Examples can be found here but in broad terms, public gateways aren’t particularly numerous. As reported in March, Cloudflare offers a free IPFS gateway yet despite having nothing to do with the content hosted in the network, still received over 1,000 copyright complaints in the first half of 2022.

Figures for the second half are yet to be published but if recent events are anything to go by, those numbers could be significantly higher in the next report.

Avalanche of Copyright Complaints

UK-based programmer James Stanley has a project page to make any geek smile. It begins with SCAMP, a homemade 16-bit CPU with a homemade programming language, before moving on to a robotic chessboard (accessible via API), and a footwear-based chess computer that allows Stanley to cheat at chess “hands-free and without any third-party assistance.”

Stanley is also the brains behind Hardbin.com, an encrypted pastebin-type service that utilizes IPFS. Unfortunately, Stanley took Hardbin down this week after being targeted by an anti-piracy entity demanding the removal of thousands of allegedly-infringing URLs.

“I received 3 DMCA takedown emails today, covering 7350 URLs on my hardbin.com IPFS gateway. The URLs were allegedly serving infringing copies of books,” his blog post reads.

Heavily truncated sample notice

Stanley posted the complaints to GitHub, with all three following a similar format; a demand for the immediate takedown of thousands of pieces of content that have nothing to do with the programmer, that he has no ability to take down, even if he wanted to.

Who’s Behind The Takedown Demands?

All three complaints (1,2,3) were sent from “[email protected]” but as Stanley points out, it’s hard to say who is behind the notices.

Each notice claims to have been sent by ‘Gareth Young – Internet Investigator’ but where Young works isn’t made clear. Instead, the notices carry the names and addresses of three publishing companies; Wolters Kluwer Health (New York), Knovel, a subsidiary of Elsevier, Inc. (New York), and IEEE (new Jersey).

Stanley’s research turned up a ‘Gareth Young’ who apparently worked for law firm Covington & Burling LLP. Young is also the author of a slideshow that describes methods and tactics for taking infringing content down and making people’s lives more difficult.

The page above contains numerous options, and just as Mr Young suggested, the 5th option did indeed prove effective.

“I have now taken hardbin.com down completely because dealing with this sort of thing makes it less fun to run and more like hard work,” Stanley says.

IPFS: Technical Resilience Against Censorship

That Stanley’s work on Hardbin can’t be enjoyed by him or anyone else shows that it’s still possible to have a chilling effect on IPFS, despite its technical resilience to censorship.

It’s also worth noting that the DMCA takedown notices were sent directly to abuse addresses at the programmer’s host, rather than to him directly. It’s the kind of tactic that’s easily justified when dealing with an uncooperative pirate site but entirely unhelpful when dealing with innocent parties.

And then there’s the interesting evidence uncovered by Stanley when cross-referencing the 7,350 URLs against his reverse proxy logs.

“I did some bash-fu to extract the IPFS hashes from the emails and grep for them in my nginx logs, and was surprised to find not a single match,” Stanley explains. “None of them have ever been accessed, and of the ones that I checked, none even worked.”

Other IPFS Users Targeted

Sean Lang has been keeping records on the DMCA notices he’s received related to his gateway since February 2022.

“I currently operate an IPFS gateway on ipfs.slang.cx. I don’t publish or pin any content there, it’s only a resolver for content that’s available on the rest of the IPFS network,” Lang writes on GitHub.

“I get a lot of DMCA requests from running this. Currently I’m blocking 12367 files. They’re almost all books, although I don’t have nearly enough time to go through them manually.”

Lang says that the takedown notices are usually sent by a guy called Gareth Young and have at least one familiar quality.

“The weird thing is, [the system used] doesn’t actually verify that a given file is available through my server before sending a DMCA request. I’ve looked through the traffic logs, and the vast majority of the files listed in these takedown requests have never been requested in the history of my gateway. I haven’t checked all of them, but I’ve checked a lot,” Lang says.