Bungie slams YouTube’s DMCA system in lawsuit against Destiny takedown fraudsters

Bungie slammed YouTube’s Digital Millennium Copyright Act (DMCA) process in a lawsuit against 10 John Doe defendants accused of sending fraudulent takedown notices against Destiny 2 videos.

“Doe Defendants were able to do this because of a hole in YouTube’s DMCA-process security, which allows any person to claim to be representing any rights holder in the world for purposes of issuing a DMCA takedown,” Bungie wrote in a complaint filed Friday in US District Court for the Western District of Washington. Bungie continued:

In other words, as far as YouTube is concerned, any person, anywhere in the world, can issue takedown notices on behalf of any rights holder, anywhere. A disgruntled infringer or a competitive content producer, for example, can issue takedown notices purportedly on behalf of Disney, or Fox, or Universal—or even Google itself. All they need to do is: (1) fill out the video removal form… (2) have a Google account—including, upon information and belief, one created that same day and with fake information; and (3) fill out information and click verification buttons fraudulently certifying that they have the right to submit the takedown request, with no verification done by YouTube.

While YouTube and its owner Google were not named as defendants, they feature heavily throughout Bungie’s complaint. The 10 Doe defendants haven’t been identified yet because of “the Byzantine procedural labyrinth Google required before it would address the fraud its users were committing, let alone identify who its fraudsters were,” Bungie wrote.

The fraudulent notices were apparently sent in retaliation by Destiny 2 players who had received Bungie’s legitimate takedown requests, the lawsuit said. The fraudsters apparently targeted other YouTubers who had received official Bungie takedown requests and then sent emails to the victims that claimed the official Bungie notices were also fraudulent.

“YouTube’s easily gamed reporting system”

The fraudulent notices began on or around March 17 and targeted Destiny YouTubers including My name is Byf and Aztecross, who have 967,000 and 595,000 subscribers, respectively. Even Bungie’s official Destiny YouTube channel got served a fraudulent takedown notice, the lawsuit said. The notices were sent from “a fake Gmail address that was, upon information and belief, newly created, which did not match the addresses used by Bungie’s brand protection vendor for legitimate DMCA notices.”

“Thanks to YouTube’s easily gamed reporting system, the attack was a success, and videos were removed (and YouTubers given ‘copyright strikes’ that, under YouTube rules, threaten the future viability of their YouTube channels) on the basis of the Fraudulent Takedown Notices,” Bungie wrote.

Afterward, “the Destiny community was bewildered and upset, believing that Bungie had reneged on a promise to allow players to build their own streaming communities and YouTube channels on Destiny 2 content. Destiny community members were also misled to believe that Bungie’s brand protection agent was also fraudulent, causing confusion among users as to the authenticity of legitimate DMCA notices,” Bungie said.

Bungie said its attempt to solve the problem was “complicated by the fact that while YouTube has a form that allows anyone to claim to represent a copyright holder and issue copyright strikes, it has no dedicated mechanism for copyright holders who are being impersonated to let YouTube know about the DMCA fraud.”

When contacted by Ars, a YouTube spokesperson said, “We take abuse of our copyright takedown process seriously and terminate tens of thousands of accounts every year for violating our policies, which prohibit submitting false information in a takedown request. We’ll continue our work to prevent abuse of our systems, and we’re committed to taking appropriate action against those who knowingly misuse our tools.”

YouTube also said that copyright law compels the website to take DMCA complaints at face value and quickly remove content when someone alleges their copyrights are being violated. YouTube further said it has employees and systems that work to detect suspicious behavior but acknowledged that trolls and bad actors can sometimes circumvent the measures.

Bungie seeks defendants’ real names

Bungie uses the vendor CSC Global to send its actual takedown notices, which are sent only after specific approval from Bungie’s legal department, the lawsuit said. After learning of the fraudulent Aztecross takedown, “CSC issued a retraction notice requesting reinstatement of the video, but on Monday, March 21 it reported that YouTube had denied the retraction request because the retraction notice was not sent from the same email that had issued the initial Fraudulent Takedown Notice,” Bungie’s lawsuit said.

At 3:18 pm local time on March 22, after more urgent requests from Bungie, “Google provided an update: it had terminated the accounts that submitted the fraudulent requests and all fraudulent submissions would be reversed, but Google would not share any information identifying who the fraudulent users were, including channel identifiers, email addresses, or other identifying information, without a law enforcement request or civil process. Fortunately for the people whose videos were targeted by the Fraudulent Takedown Notices, Bungie has the financial resources to begin that civil process in order to meet Google’s requirements.”

Bungie’s lawsuit said it is “entitled to damages and injunctive relief, including enhanced statutory damages of $150,000 for each Fraudulent Takedown Notice that willfully infringed Bungie’s copyrights.” Bungie also accused the defendants of business defamation, violation of the Washington Consumer Protection Act, and breach of contract (the Destiny 2 software license agreement). Bungie said it suffered “significant reputational and economic damage.”

Fraudsters acted after Bungie sent 41 takedowns

Bungie said it lets players create and share videos of Destiny gameplay “provided the videos contain substantial ‘player-created content.’” Bungie’s intellectual property policy prohibits “sharing of videos that are primarily Bungie-created content” such as trailers and cutscenes. The policy also disallows “simply uploading songs from Bungie soundtracks or ripped from the game files of Destiny 2.”

Between March 2 and March 16, CSC initiated and completed 41 DMCA takedowns of YouTube videos on Bungie’s behalf. All of them “related to music from Destiny 2’s original soundtracks,” the lawsuit said.

The YouTubers whose videos were taken down included the Doe defendants, the lawsuit said. “Beginning on or about March 17, 2022, Doe Defendants began submitting unauthorized DMCA takedown notices to YouTube for videos that allegedly infringed Bungie’s copyrights,” the complaint said. “Upon information and belief, Doe Defendants created fake [name]csc@gmail.com Google accounts in order to submit the Fraudulent Takedown Notices.” In the notices, the defendants “identified themselves as ‘Bungie, Inc.’” or “as Bungie’s authorized agents.”

An image of a takedown notice sent to Aztecross “indicated that content was ‘removed by Bungie, Inc.’ when any removals handled by CSC would not have used that language, and Bungie had not authorized anyone else to issue takedowns,” the lawsuit said.

Bungie: Defendants gloated and confessed

The fraud “sent shockwaves through the Destiny community,” and some players directed their anger at Bungie although the company said publicly on March 20 that it hadn’t sent the takedown notices, the lawsuit said. While Bungie was trying to navigate what it called the “Byzantine procedural labyrinth” set up by Google, the “Doe Defendants themselves were gloating, confessing,” and sending threatening emails to CSC, Bungie wrote.

“At 12:41 am on Monday the 21st, ‘Damian Reynolds’ emailed davidthomsoncsc@gmail.com the following: ‘Hope striking everyone’s content was worth it, asshat. You’ve now got Bungie’s full attention. You really oughta grow up and get a life instead of tormenting people from behind a screen like a fucking coward. If I were you, I’d delete my Google account right now because Bungie (and probably even Google) are gonna come after you hard.’”

The davidthomsoncsc@gmail.com address is the one CSC uses for legitimate DMCA takedown requests on YouTube, Bungie’s lawsuit said. It carries the name of CSC executive David Thomson. YouTube’s DMCA reporting system requires a Google account “if the reporting party processes DMCA requests via a YouTube content management product (Creator Studio or Content Manager),” Bungie said.

The defendants also sent emails to the takedown victims “that appear calculated to discredit the authenticity of takedown notices legitimately issued by Bungie’s authorized brand protection vendor by claiming, falsely, that DMCA notices attaching the authorized vendor’s email address ‘davidthomsoncsc@gmail.com’ were also fraudulent,” Bungie wrote. The defendants apparently intended “to cause the recipients of legitimate takedown notices to file inappropriate copyright counter notifications with YouTube,” Bungie wrote.