Naturally, UMG appealed, and in doing so made some compelling arguments about the wording of the law. The appellate court agreed, and has now issued pretty much the opposite decision: pre-1972 sound recordings are not covered by the DMCA (pdf and embedded below) and thus Grooveshark has no DMCA safe harbors for such songs.

There are a few different parts to the ruling, but the core argument is straightforward: section 301(c) of the Copyright Act explicitly states that no "rights or remedies" under common law copyright on pre-1972 recordings shall be "annulled or limited" until 2067, and it's pretty hard to argue that the DMCA doesn't do that:

Initially, it is clear to us that the DMCA, if interpreted in the manner favored by defendant, would directly violate section 301(c) of the Copyright Act. Had the DMCA never been enacted, there would be no question that UMG could sue defendant in New York state courts to enforce its copyright in the pre-1972 recordings, as soon as it learned that one of the recordings had been posted on Grooveshark. However, were the DMCA to apply as defendant believes, that right to immediately commence an action would be eliminated. Indeed, the only remedy available to UMG would be service of a takedown notice on defendant. This is, at best, a limitation on UMG’s rights, and an implicit modification of the plain language of section 301(c). The word “limit” in 301(c) is unqualified, so defendant’s argument that the DMCA does not contradict that section because UMG still retains the right to exploit its copyrights, to license them and to create derivative works, is without merit. Any material limitation, especially the elimination of the right to assert a common-law infringement claim, is violative of section 301(c) of the Copyright Act.

For defendant to prevail, we would have to conclude that Congress intended to modify section 301(c) when it enacted the DMCA. However, applying the rules of construction set forth above, there is no reason to conclude that Congress recognized a limitation on common-law copyrights posed by the DMCA but intended to implicitly dilute section 301(c) nonetheless.

...

Under such circumstances, it would be far more appropriate for Congress, if necessary, to amend the DMCA to clarify its intent, than for this Court to do so by fiat.

Take note of that last bit, because this ruling has made it more true than ever. And that's where the problems come in. It seems pretty clear that there is some sloppy drafting in how the DMCA is written (which isn't a surprise), in that what you have is wording that can be read this way, even though it clearly goes against the intent and purpose of the DMCA. If the DMCA's safe harbors don't apply to pre-1972 recordings, then the DMCA's safe harbors no longer apply at all to any service that includes music. That can't be what Congress intended, even if the wording of the law can be read that way.

Thus, if you go strictly by the wording, while ignoring the intent, the logic of the decision is sound, but the implications are disturbing: as Grooveshark pointed out in their defense, this interpretation would gut the DMCA. One of the key purposes of safe harbors was to prevent online services from needing to proactively scan for infringing works, since that would drastically and unfairly limit their growth, and we wouldn't have things like YouTube today if that were the case. But if pre-1972 recordings (which is plenty of material) are not included, then user-generated content sites do have to scan everything. And while it might be somewhat easier to identify pre-1972 recordings than it is to identify infringing uploads, it would still be insanely prohibitive — not to mention the massive loss to our culture from having a huge chunk of music history mostly vanish from the internet.

It's a little unclear just how far-reaching this ruling will be (it's at the state level, and it is in itself explicitly contradicting the earlier MP3Tunes ruling, which it declares to be "wrongly decided") but the potential implications are huge. Exempting all pre-1972 recordings from the DMCA would impact all corners of the internet in a bad, bad way. The only optimistic thought is that perhaps it would force congress to revisit the law, and we could finally push for a Digital Millennium Copyright Act that actually works in the digital millennium.

An internet service provider which seeks to benefit from the safe harbor provisions of the DMCA is required, as a condition of receiving such protection, "expeditiously to remove, or disable access to, the material that is claimed to be infringing or to be the subject of infringing activity." .... Certainly the thrust of the DMCA is to relieve internet service providers of the initial need to ascertain the copyright status of the sound recordings that they make available, to place the burden of asserting copyright ownership on the owners of such copyrights, and to require the internet service providers to "take down" infringing material, upon receipt of a valid notice of infringement. There is no textual, or other reason, to think that Congress intended to limit that distribution of responsibilities to only post-1972 recordings.

Moreover, the phrase "copyright owners,".... is applicable to the owner of a common law copyright, no less than to the owner of a copyright under the Copyright Act....

This Court is not attempting to extend the Copyright Act to pre-1972 Recordings, but, nonetheless, does find, based on the relevant language of the statutes and the analysis discuss above, that the safe harbor provision codified by section 512(c)(1) of the DMCA is applicable to Pre-1972 Recordings.

The imposition of data preservation requirements on a journalist who is not a party to the litigation raises questions apart from the merits of the order. Journalists need to be able to discard data when they no longer have any of their own use for it.  Yes, “the public has a claim to every man’s evidence,” but don’t members of the public who are not involved in litigation have the right to discard information despite the fact that it might turn out to be useful evidence for somebody else’s case?  Does the public have a claim to heroic efforts on every man’s part?  Shouldn’t there be higher standards for subpoenas demanding intrusive searches for discarded data in the hands of third parties?

The problem is compounded when it is a journalist that has been subpoenaed.  To what extent does society have any entitlement to make journalists in particular take heroic measures, such as searching the nooks and crannies of their computer equipment for fragments of discarded data?  The judge was sensitive to the fact that our client here is a journalist, telling Escape Media that he was not prepared to allow it to make any general search of Digital Music News’ computers.  But an issue that we may have to pursue on appeal is whether a journalist should ever have to undertake such drastic preservation efforts in aid of a lawsuit in which he is not involved, particularly given the relative unlikelihood that fragments of identifying data remain on his computers somewhere.

Indeed, the problem is broader than just journalists.  Companies often keep log files with respect to server visits (and hosted comments), but there is little business justification for keeping those logs forever; so generally speaking they are discarded after a period of time (EFF's best practices recommendations are worth a look in this regard).  Does the mere act of discarding log files set a company up for the possibility of a demand for forensic examination of the underlying servers, in the hope that some fragment of the data might be recovered?  In this regard, the trial court's order has chilling implications for other California companies, even beyond the issue of journalists. 

Issues of how to preserve the data remain to be decided.  This is not like just leaving one of your file cabinets untouched for a period of time; it is not even as easy as making sure you don't delete any of your email.  Preserving the web site while creating a copy of the underlying servers is a complicated process, requiring the services of a forensic specialist, and the cost could be substantial.  The estimates that we have been given are well into the five figures; but even the cost of several thousand dollars would be an enormous imposition on this small company.

I work for Grooveshark. Here is some information from the trenches:

We are assigned a predetermined ammount of weekly uploads to the system and get a small extra bonus if we manage to go above that (not easy).The assignments are assumed as direct orders from the top to the bottom, we don't just volunteer to "enhance" the Grooveshark database.

All search results are monitored and when something is tagged as "not available", it get's queued up to our lists for upload. You have to visualize the database in two general sections: "known" stuff and "undiscovered/indie/underground". The "known" stuff is taken care internally by uploads. Only for the "undiscovered" stuff are the users involved as explained in some posts above. Practically speaking, there is not much need for users to upload a major label album since we already take care of this on a daily basis.

First, there is a distinction between legal and licensed. Laws come from Congress. Licenses come from businesses. Grooveshark is completely legal because we comply with the laws passed by Congress, but we are not licensed by every label (yet). We are a technology company, and we operate within the boundaries of the Digital Millennium Copyright Act of 1998 (DMCA). Some would have you believe that those of us who use the DMCA to innovate are inherently infringers and that claiming Safe Harbor under the DMCA is as good as admitting guilt. Not so.

The DMCA's Safe Harbor component encourages technology companies to innovate in hopes that they will eventually solve some of the problems that are plaguing content producers today. The Safe Harbor provision reads like it was written specifically for YouTube and Grooveshark, and its necessity continues to be illustrated every day. If it weren't for this notion, many of the products and services that are now taking a bite out of piracy would never have been born.

"This [personally identifiable] information may also be kept longer than 6 months by EMG if a user is found by EMG's soul judgment to be suspect of carrying out illegal, unlawful, or dangerous actions with or in this service. Prior to keeping IP address information for more than 6 months, the user will be notified via email about their suspect status."

The privacy policy still says that, though Dante also grabbed a screenshot.

Somehow, I don't think Grooveshark actually intends to judge a person's immaterial soul for evidence of suspicious activity. But, lest you think it's a lone typo, the phrase "soul purpose" also appears later in the policy.

"EMG may allow 3d parties to place cookies and other tracking technologies, such as web beacons, clear GIFs, web bugs, tracking pixels on the Site for the soul purpose of allowing that 3d party to record that a User has visited the Site and/or used the Service."

I think they meant "sole." Somewhere, in the depths of my own soul, it feels like somebody was relying on spell check a bit too much...