George Mason University Antonin Scalia Law School

CloudFlare Enjoined From Aiding Infringers: Internet Unbroken

Just how far does a court’s power to enjoin reach into cyberspace? It’s clear enough that those directly posting or hosting infringing content are subject to an injunction. But what about a company such as CloudFlare that provides content delivery network and domain name server services? Does an injunction under Rule 65 against anyone acting in “active concert or participation” with an online infringer apply to an internet infrastructure company such as CloudFlare? CloudFlare recently argued that its service is “passive” and untouchable, but a district court vehemently—and rightly—disagreed.

The controversy started with the shutdown of the Grooveshark music streaming service pursuant to a settlement agreement with the major record label plaintiffs this past April. Back in September of 2014, Grooveshark and its two founders were found directly and indirectly liable for copyright infringement. After the district court held that their infringement was “willful,” thus subjecting them to potential statutory damages exceeding $736 million for the 4,907 works-in-suit, they consented to paying $50 million in damages and shutting down the grooveshark.com site rather than risk it with a jury.

But the demise of Grooveshark was short-lived, and just days after publicly apologizing for failing “to secure licenses from right holders,” two copycat sites popped up at different top-level domains: grooveshark.io and grooveshark.pw. The record label plaintiffs filed a new complaint and obtained ex parte relief, including a temporary restraining order (TRO), against the new sites. Upon receipt of the TRO, Namecheap, the registrar for both sites, disabled the .io and .pw domain names. When another copycat site was established at grooveshark.vc, the domain name was quickly disabled by Dynadot, the registrar, after it received the TRO.

Undeterred, the defendants publicly taunted the plaintiffs and registered yet another copycat site at grooveshark.li. Rather than continuing this global game of domain name Whac-A-Mole, the plaintiffs served the TRO on CloudFlare, the service utilized by the defendants for each of the infringing domains. And this is where things got interesting. Rather than swiftly complying with the TRO, as the domain name registrars had done, CloudFlare lawyered up and contended that it was beyond the court’s reach.

In its briefing to the court, CloudFlare argued that it played merely a passive role for its customers—including the defendants and their copycat site—by resolving their domain names and making their websites faster and more secure. CloudFlare disavowed the ability to control any content on the copycat site, and it denied that it was in active concert or participation with the defendants:

Active concert requires action, and CloudFlare has taken none. Participation means assisting a defendant in evading an injunction. CloudFlare has not so assisted defendants and, in fact, has no ability to stop the alleged infringement. Even if CloudFlare—and every company in the world that provides similar services—took proactive steps to identify and block the Defendants, the website would remain up and running at its current domain name.

CloudFlare did not deny that the defendants utilized its services; it instead argued that the TRO would not remove the infringing site from the internet. Thus, CloudFlare’s position hinged on its own passivity and on the futility of enjoining it from providing services to the defendants.

A moment’s reflection reveals the superficiality of this position. The fact that CloudFlare had no control over the content of the copycat site was not dispositive. The question was whether CloudFlare aided the defendants, and there was no doubt that it did. It was not only the defendants’ authoritative domain name server, it also optimized and secured their copycat site. That the defendants could have used other services did not erase the fact that they were using CloudFlare’s services. And once CloudFlare was served with the TRO and made aware of the copycat site, its continued provision of services to the defendants constituted active concert or participation.

CloudFlare’s policy arguments were similarly unpersuasive. It suggested that the TRO “would transform a dispute between specific parties into a mandate to third parties to enforce” the plaintiffs’ rights “against the world in perpetuity.” Of course, that is not what happened here. The question was not who else in the world the TRO reached; the question was whether the TRO reached CloudFlare because it aided the defendants.

CloudFlare further argued that it could not be enjoined because “Congress explicitly considered and rejected granting such authority to the courts with respect to Internet infrastructure providers and other intermediaries for the purpose of making a website disappear from the Internet.” To enjoin it, CloudFlare proposed, would be to pretend that the Stop Online Piracy Act (SOPA) “had in fact become law.” This argument, however, completely ignored the fact that courts have long been empowered to enjoin those in active concert or participation with infringers.

In reply, the record label plaintiffs rebuffed CloudFlare’s claim that it was not aiding the defendants: “CloudFlare’s steadfast refusal to discontinue providing its services to Defendants – who even CloudFlare acknowledges are openly in contempt of this Court’s TRO – is nothing short of breathtaking.” They pointed to how CloudFlare continued to aid the defendants, even after being on notice of the TRO: “[T]he failure of an Internet service provider to stop connecting users to an enjoined website, once on notice of the injunction, readily can constitute aiding and abetting for purposes of Rule 65.”

In the real world, CloudFlare markets the benefits of its services to its customers. It touts its content delivery network as delivering “the fastest page load times and best performance” through its “34 data centers around the world.” It boasts having “web content optimization features that take performance to the next level.” It offers robust “security protection” and “visitor analytics” to its customers. And its authoritative domain name server proudly serves “43 billion DNS queries per day.” But when it came to the defendants’ copycat site, it claimed to be a “passive conduit” that in no way helped them accomplish their illicit goals. This disingenuousness is, to borrow the plaintiffs’ term, “breathtaking.”

District Judge Alison J. Nathan (S.D.N.Y.) made short work in rejecting CloudFlare’s shallow denials. She noted that there was no factual question that CloudFlare operated the defendants’ authoritative domain name server and optimized the performance and security of their copycat site. The question was whether these acts were passive such that CloudFlare was not in “active concert or participation” with the defendants. Judge Nathan held that the services CloudFlare provided to the defendants were anything but passive:

CloudFlare’s authoritative domain name server translates grooveshark.li as entered in a search browser into the correct IP address associated with that site, thus allowing the user to connect to the site. Connecting internet users to grooveshark.li in this manner benefits Defendants and quite fundamentally assists them in violating the injunction because, without it, users would not be able to connect to Defendants’ site unless they knew the specific IP address for the site. Beyond the authoritative domain name server, CloudFlare also provides additional services that it describes as improving the performance of the grooveshark.li site.

Furthermore, Judge Nathan dismissed CloudFlare’s argument that it was not helping the defendants since they could simply use other services: “[J]ust because another third party could aid and abet the Defendants in violating the injunction does not mean that CloudFlare is not doing so.” And to CloudFlare’s concern that the TRO was overly broad, Judge Nathan reasoned that the issue before her was CloudFlare’s own actions, not those of other, possibly more attenuated, third parties: “[T]he Court is addressing the facts before it, which involve a service that is directly engaged in facilitating access to Defendants’ sites with knowledge of the specific infringing names of those sites.”

This TRO wasn’t about the “world at large,” and it wasn’t about turning the companies that provide internet infrastructure into the “trademark and copyright police.” It was about CloudFlare knowingly helping the enjoined defendants to continue violating the plaintiffs’ intellectual property rights. Thankfully, Judge Nathan was able to see past CloudFlare’s empty and hyperbolic position. Protecting intellectual property in the digital age is difficult enough, but it’s even more challenging when services such as CloudFlare shirk their responsibilities. In the end, reason trumped rhetoric, and, best of all, the internet remains unbroken. In fact, it’s now even better than before.

Further reading: Leo Lichtman, Copyright Alliance, Bringing Accountability to the Internet: Web Services Aiding and Abetting Rogue Sites Must Comply With Injunctions