Microsoft action hits Cryptome Web site

The Web site Cryptome, which publishes sensitive corporate and government files, was taken down briefly by its provider after Microsoft complained of copyright infringement over the publication of one of its documents.

Cryptome often posts documents detailing the surveillance activities that companies and government agencies perform on behalf of law enforcement officials. These documents, which Cryptome refers to as "lawful spying guides," explain what information companies reveal about its customers when requested by legal authorities. Many of these documents are specifically written for law enforcement officials to guide them on obtaining customer information from a company--what to ask for, how to ask for it, and how to analyze it.

After one such document, Microsoft's Surveillance Guide, appeared on the Cryptome Web site, Microsoft asked the site's owner, John Young, to take it down, alleging copyright infringement. After Young refused, the site's host, Network Solutions, sent him a notice citing the Digital Millennium Copyright Act (DMCA) and telling him to get rid of the copyrighted material, or his site would be removed. Young still refused, and so Cryptome was taken offline as of Thursday morning.

After the take-down, an alternate site was quickly set up under the name Cryptomeorg.siteprotect.net, and most of the documents from the old site have since been re-posted. Young has also included mirrors to other Web sites where people can still read Microsoft's Surveillance Guide. A notice on the new site says that "Network Solutions shut Cryptome.org and has placed a 'legal lock' on the domain name, preventing its transfer, until the 'dispute' is settled." So Young couldn't use the Cryptome domain name.

In his initial response to the actions of Microsoft and Network Solutions, Young filed a counter-notification on Wednesday, backing up his belief that publication of Microsoft's file does not infringe upon any copyright.

"The file has not been removed because Microsoft has improperly claimed copyright violation for the file, which provides information that allows users of Microsoft products to protect their privacy and personal data security against abust of trust by Microsoft," wrote Young in his letter.

That put the ball back in Microsoft's court. Under the terms of the DMCA, Network Solutions has to reinstate the Cryptome site in another 10 to 14 days unless Microsoft responds with a notice of litigation. In short, if Microsoft wanted to pursue this further, it would have to take Young to court.

The threat of a court case might worry most people, but Young seems to welcome it. "We're now waiting to go to court with Microsoft," he told CNET. "We hope they'll do it rather than backing off. We think this is an important issue that needs to be litigated."

Young said he wants to challenge the abuse of copyright claims by Microsoft and other companies, which he believes are being used in an improper way. Copyright infringement is meant to protect intellectual property, noted Young, but he feels the documents he publishes on his site don't fall under that category.

Further, since these documents concern the public and they're available to law enforcement, Young believes they should be publicly available, either through the Freedom of Information Act or by other means. Companies and law enforcement officials would naturally argue that these documents should remain private so they're not available to criminals. But Young feels the majority of customers and other people affected by these documents are not criminals.

Young also pointed out that most companies do publish law enforcement files and similar documents for the public to see. It's only a few companies that keep them private. Yahoo is another firm that filed a complaint against Young for posting an internal document. But he said he stood firm against the company.

"Yahoo tried to bluff us into taking a document down claiming copyright when they didn't have one," Young said. "There are other firms abusing this because it's very cheap to just send out an e-mail to an ISP for a take-down rather than go to litigation."

Young also believes that the response from Network Solutions to take down the file or get shut down is solely the provider's doing. "Network Solutions has set up a draconian response, which is to try to scare you into taking a document down as though it's required by the DMCA. But it turns out there's a lot of latitude in the DMCA. So [Network Solutions] is abusing it as well as Microsoft."

Young said he believes the documents that he publishes are indications that companies are bending over backwards to placate law enforcement officials because they're afraid of being targeted by them. And he feels that Microsoft's Surveillance Guide goes much further in holding the hands of law enforcement than the typical document.

How does Young draw the line between publishing a document that's truly sensitive and private versus a document that the public may have a right to view? "That's all we do, is walk that line," he said. "We can spot it pretty well. We've been following the DMCA since the time it was proposed and the time of its passage. And we've seen the increasing abuse of it."

Young said that most of the documents he posts are sent to him from people who have gotten access to them. But many are already available on the Web. The Microsoft document came from a Web site that specialized in training law enforcement.

Cryptome gets reinstated
Despite Young's desire to go to court to prove his point, Microsoft showed signs of backing down. A Microsoft spokesperson sent CNET the following comment Thursday morning:

"Like all service providers, Microsoft must respond to lawful requests from law enforcement agencies to provide information related to criminal investigations. We take our responsibility to protect our customers privacy very seriously, so have specific guidelines that we use when responding to law enforcement requests. In this case, we did not ask that this site be taken down, only that Microsoft copyrighted content be removed. We are requesting to have the site restored and are no longer seeking the document's removal."

The news was eventually made official: Microsoft had actually withdrawn its DMCA complaint late Wednesday, asking Network Solutions to restore access to the site. In an e-mail to Network Solutions, Evan Cox, Microsoft's counsel, said the company still believes the file in question violates its copyright but that it had not intended for the entire site to be taken down. As a result, Cryptome.org was back up.

When informed of Microsoft's response, Young seemed disappointed at the prospect of not going to court. In an e-mail response, he said: "My position, upright, of course, we want Microsoft to take the lead on opening up all lawful spying guides and that is likely to require court action so Microsoft, Net Solutions, Google and the others can say they are doing so under duress of the court and public opinion--that way law enforcement cannot accuse them of violating confidential agreements too easily."

He further said that the DMCA needs to be modified to avoid including non-criminals in broad copyright dragnets aimed at actual criminals.

"And the draconian procedures worked out among ISPs and copyright holders need to be relaxed or subject to challenge," he added. "These procedures appear to be private, to save costs, and to speed results by bluffing, and are not required by the DMCA."

Updated 2:15 PST with news that Microsoft had withdrawn its complaint and that Cryptome.org was back up.