George Mason University Antonin Scalia Law School

CloudFlare’s Desperate New Strategy to Protect Pirate Sites

a gavel lying on a table in front of booksSan Francisco-based CloudFlare has earned a somewhat dubious reputation in the online world. Website owners can set up CloudFlare in just a few minutes, gaining the performance, security, and privacy benefits the service provides. Traffic routed through CloudFlare’s global content delivery network is cached for faster delivery times and protected from numerous online threats. Pirate sites have flocked to the service because it hides their true identities from copyright owners by default. And it probably doesn’t hurt that CloudFlare CEO Matthew Prince thinks that “censoring the Internet” is “creepy,” even “under a court order.”

Prince practices what he preaches, and CloudFlare has been all-too-ready to lend a helping hand to even the most notorious pirates. When The Pirate Bay rose from the ashes in early 2015, CloudFlare provided the site with services that helped manage its massive server loads. CloudFlare’s encryption technology even made it easy for users in the UK to circumvent the High Court’s ban ordering ISPs to block the pirate site. Amazingly, The Pirate Bay is now back in the United States, using its original thepiratebay.org Virginia-based domain and benefiting from CloudFlare’s robust services to make its criminal enterprise run smoothly worldwide.

Of course, the only reason CloudFlare can get away with supporting the world’s most-visited torrent site is because the DMCA is such a mess. Courts have set the bar so high that CloudFlare wouldn’t likely be found to have red flag knowledge of the massive amounts of infringement it certainly knows its service enables for globally-infamous criminal infringers like The Pirate Bay. Rather than taking the high road and refusing to work with obvious pirate sites, CloudFlare lawyers up when pushed and denies the supportive role that its service provides.

We saw this last year in the Grooveshark case. After the original Grooveshark site was found liable for willful infringement and agreed to shut down, copycat sites sprung up at different top-level domains such as grooveshark.io and grooveshark.pw. The plaintiffs obtained a temporary restraining order against the copycats, which registrars Namecheap and Dynadot promptly complied with by disabling some of the domains. But when the plaintiffs asked CloudFlare to stop providing services to some of the other copycats, they were met with firm resistance. The plaintiffs had to turn to the court for an order clarifying that the injunction against the copycat sites prevented CloudFlare from providing them services.

With the backing of the Electronic Frontier Foundation, CloudFlare put up a big fight. It denied that it was in “active concert or participation” with the copycats, which under Rule 65 would have made it bound by their existing injunction. CloudFlare argued that its services were merely passive and that the domains would still remain accessible even if its services were cut off. The district court rejected CloudFlare’s self-serving arguments, noting that it was in fact aiding and abetting the copycat sites by operating their authoritative domain name servers and optimizing their traffic worldwide. Since CloudFlare had actual notice of the injunction and was in “active concert or participation” with the enjoined copycats, it was also bound by their injunction under Rule 65.

Hit with what must have been the eye-opening reality that, under penalty of contempt, it couldn’t knowingly help its enjoined customer engage in the very wrong the court had ordered it to stop committing, one might think that CloudFlare would have become more respectful of court orders involving its customers. However, as recent developments in the MP3Skull case show, CloudFlare has decided to again take the low road in shirking its responsibility to the court. And its argument here as to why it’s beyond the court’s reach is even more desperate than before.

In April of 2015, several record label plaintiffs sued MP3Skull for copyright infringement, easily obtaining a default judgment when the defendants failed to respond to the suit. Earlier this year, the plaintiffs were granted a permanent injunction, which the defendants quickly flouted by setting up shop under several different top-level domains. Naturally, the common denominator of these multiple MP3Skull sites was that they used CloudFlare. The plaintiffs’ lawyers sent a copy of the injunction against the pirate sites to CloudFlare, asking it to honor the injunction and stop supplying services to the enjoined domains. But, as with Grooveshark, CloudFlare again refused to comply.

The record label plaintiffs have now gone back to the district court, filing a motion requesting clarification that CloudFlare is bound by the injunction against the MP3Skull sites. They argue that the “law is clear that CloudFlare’s continued provision of services to Defendants, with full knowledge of this Court’s Order, renders CloudFlare ‘in active concert or participation’ with Defendants,” and they point to the opinion in the Grooveshark case in support. According to the plaintiffs, the only issue is whether CloudFlare is aiding and abetting the enjoined defendants by providing them services.

CloudFlare opposes the motion, though it noticeably doesn’t deny that it’s in “active concert or participation” with the enjoined defendants. Instead, CloudFlare argues that, since this is a copyright case, any injunction against it must comply with the DMCA:

Section 512(j) prescribes specific standards and procedures for injunctions against service providers like CloudFlare in copyright cases. It places strict limits on injunctions against eligible service providers. 17 U.S.C. § 512(j)(1). It specifies criteria that courts “shall consider” when evaluating a request for injunctive relief against a service provider. 17 U.S.C. § 512(j)(2). And it requires that a service provider have notice and an opportunity to appear, before a party may bind it with an injunction. 17 U.S.C. § 512(j)(3). Plaintiffs ignored those requirements entirely.

The gist of CloudFlare’s argument is that Section 512(j) controls injunctions against service providers like itself, notwithstanding the fact that Rule 65 binds those in “active concert or participation” with an enjoined party. In other words, CloudFlare says that the DMCA gives service providers unique immunity from having to obey court-issued injunctions under the Federal Rules—a remarkable claim requiring remarkable proof. And the case law cited to back up this claim? None. Zip. Nada. CloudFlare fails to produce one single cite showing that any injunctive-relief statute, whether copyright or otherwise, has ever been deemed to preempt the longstanding rule that it’s contempt of court to aid and abet an enjoined defendant. The desperation is palpable.

The reason the DMCA doesn’t apply to CloudFlare is obvious. Section 512(j) states that it “shall apply in the case of any application for an injunction under section 502 against a service provider” that qualifies for the safe harbors. CloudFlare goes on for pages about how it’s a service provider that would qualify for the safe harbor defense if given the chance, but all of this misses the point: CloudFlare is not being enjoined. The only service provider being enjoined is MP3Skull—and that injunction was issued under Section 502 without the limitations set forth in Section 512(j) because MP3Skull didn’t even bother to show up and attempt to claim the safe harbors. But the plaintiffs have not sought an injunction against CloudFlare, which they could only do by naming CloudFlare as a party to the suit.

Since CloudFlare itself isn’t being enjoined under Section 502, Section 512(j) provides it no limitations. The issue is simply whether, under the Federal Rules, CloudFlare is bound by the injunction that has already been issued against the MP3Skull sites. Perhaps not wanting to get bench-slapped again on the aiding and abetting question under Rule 65, CloudFlare is taking an even lower road with this desperate new argument that it’s magically immune to court orders against its customers under the Federal Rules. The district court has yet to rule on the plaintiffs’ motion, but my guess is that it will make short work in reminding CloudFlare of the court’s true power to hold aiders and abettors in contempt.