33,000+ DMCA notices sent in an apparent attempt to defend the reputation of an alleged Russian criminal--systematic abuse of the DMCA notice-and-takedown procedure

In April, 2022, Lumen Research Fellow Shreya Tewari reported discovering more than 30,000 fraudulent copyright infringement notices, dating as far back as June 2019, that appeared to be deliberate attempts to misuse the Digital Millennium Copyright Act’s (DMCA’s) notice-and-takedown procedure. In August, Shreya and I discovered an additional 33,000+ notices, some sent as recently as January 2021, strikingly similar to the initial set. The content at the allegedly infringing URLs in the new set is almost entirely related to a controversial Russian oligarch, and his alleged criminal activity. This steady stream of apparently fraudulent notices on just one “topic” is a powerful indicator that systematic misuse of the DMCA notice-and-takedown (N&TD) process is real and ongoing. However, questions such as, how long and how frequently fraudulent or otherwise problematic notices have been or will continue to be submitted, have yet to be answered.

Since June 2022, I have been assisting with research within the Lumen Database, searching for possible evidence of misuse of the DMCA process. Because I had the example notices that Ms.Tewari discovered, I had a basic understanding of how fraudulent notices might appear and what search methodology to use. My own searches within Lumen found 33,396 notices sent to Google over the course of almost two years by over 40 different notice senders, targeting more than 500 unique URLs.

Submitted to Lumen between June 2019 and January 2021, these new notices shed light on the abuse of copyright law as a tool for reputation management. They reveal how notice senders, likely acting on behalf of others, fake copyright claims to remove or censor legitimate journalism linking the notice sender’s clients to accusations of criminal activity, corruption, murder, drug trafficking, and the like. This particular set of notices, all revolving around one particular Russian oligarch, is most probably one of many others just like it.

According to various news reports, the oligarch in question is a Russian businessman with a long history of alleged involvement in a wide range of questionable activities, some of them quite extreme. Most of the articles which were cited as infringing in this notice set include material about alleged involvement in the violation, both civil and criminal, of various laws and regulations, some in the "white-collar" realm, some quite personal

Most of the domain names targeted by the 33,396 notices appear to be online news forums. I individually analyzed a randomly selected representative pilot set of 400 DMCA notices within the larger notice set, originating from five different jurisdictions as marked by the notice sender: the USA, UK, Ukraine, Russia, and the Netherlands. Of the 400 randomly selected notices, all were related to alleged criminal activity. Within that pilot group, the domains targeted for takedown include legitimate news sources in Ukraine, Russia, Luxembourg, and Norway, including Antikor News, Rus Republic, Vlasti Info, Fraza, Glavk.net, and The Russian Crimes, along with many more.

The notices found in this set used the “back-dated article” technique. This technique is carried out when a fraudulent notice sender creates a copy of a legitimate article, the ‘true original’. The notice sender back-dates the copy in an effort to make a ‘fake original,’ which superficially appears as though it had been published first. Then, the copiers send a DMCA notice to the online service provider citing their back-dated copy as the original, and alleging that the ‘true original’ has copied and infringed on their ‘fake original’ article, and requesting the takedown of the true original. If the takedown is successful, the fraudulent notice sender takes one more step: they remove their ‘fake original’ URL after they have submitted their DMCA request. It can be assumed that this final step is made to ensure that all traces of the article have been erased from the internet. If they successfully manage to get the ‘true original’ removed with their DMCA request, the N&TD procedure has been effectively weaponized to censor legitimate speech online.

Further explanation of the technique in the flow chart above can be found here.

Only sixteen of the allegedly infringing domains mentioned within the 400 randomly selected notices, are still present in Google’s search results. I arrived at this number by manually entering the 400 allegedly infringing URLS into Google search one at a time and recording either a “live” site or a null result. Given these figures, it would seem that approximately 96% of the takedown attempts in my subset were successful, and the true originals were removed from Google or were never indexed with Google to begin with.

As with Tewari’s original set of notices, many notices attempt to take down URLs using exactly the same fake original URL. In fact, in this notice set, all 33,396 notices cite the ‘fake original’ domain ‘ubiystvo.kiev.ua’ as the premise for their fraudulent takedowns. No live URLs at that domain are found when performing a Google search for https://ubiystvo.kiev.ua and the domain does not resolve. Notices with examples of https://ubiystvo.kiev.ua URLs that have been submitted for takedown and were successful in removing the ‘true originals’ can be seen here, here, here, here, and here. These also indicate that the fraudulent sender did not attempt to copy every ‘true original’ before seeking to get them removed from the internet. Multiple cases show that only one ‘fake original’ URL is used as the basis of forming notices for takedown of more than 100 articles with different content. Examples of such notices can be seen here and here.

The number of DMCA notices submitted to Google for takedown has increased substantially in recent years. Although there are many legitimate notices, discoveries such as I describe here raise many questions about the accuracy of the current N&TD procedures and their error rate. It does not help that the DMCA has no provisions requiring or encouraging transparency from online service providers, which would make finding and preventing fraudulent notices at least somewhat easier. For example, this research was possible only because Google shares copies of the notices it receives, such as those found in this set, with Lumen. Imagine how much more beneficial to the research community and the public it would be if other large platforms such as YouTube, Instagram, Facebook, or Tiktok shared their DMCA notice requests publicly as well.