Goodbye Twitter: Techdirt Will Soon End Our Automated Posting

from the bye-twitter dept

Over the last few months we’d been wondering if it was worth pulling Techdirt posting from Twitter altogether, but had been too busy with other stuff to make a decision, and now it looks like Twitter has made the decision for us. Last week, Automattic informed us that Elon Musk was demanding a ridiculous amount of money to continue allowing its Jetpack service to use the API to enable WordPress sites to automatically post to Twitter. Automattic publicly announced this week that it would not pay, and that WordPress sites would no longer be able to automatically post to Twitter.

Twitter decided, on short notice, to dramatically change the terms and pricing of the Twitter API. We have attempted to work with Twitter in good faith to negotiate new terms, but we have not been able to reach an agreement. As a result, the Twitter connection on Jetpack Social will cease to work, and your blog posts will no longer be auto-shared to Twitter.

You will still be able to share your posts to Twitter manually by pasting the post link into the body of your tweet. 

We were told that the automatic sharing of Techdirt articles as tweets would end over the weekend, though they’ve still been showing up. Honestly, we’ve got too many other things we’re working on to turn off the autosharing ourselves, so they’ll keep appearing as long as Elon allows it, but I assume that’s not much longer.

And… that’s fine. I’m sure we could probably find some hack to keep posting, but why bother?

We’re actually joining a large number of others who have left Twitter, including news organizations like NPR and PBS. Lots of others have left as well, either by choice or when pushed. NY’s Metropolitan Transit Authority, the MTA, announced recently that given Twitter’s increasing unreliability it will no longer use it for alerts.

Lots of other accounts have left as well, including many fun ones that used to make Twitter such a fun place to be. Inoreader, one of the world’s most popular RSS readers has now dropped Twitter feeds because of the new API fees. Same with Feedly. A bunch of official weather services have been exploring other options, after Twitter blocked many of their accounts from posting (though some were re-enabled after complaints).

Of course, just yesterday Twitter (again realizing that it hadn’t thought any of this through) announced that it was restoring API access for government weather and travel alerts. But, just the fact that this is all based on Elon making stupid decisions, learning they are stupid, and having to backtrack should be concerning for everyone.

So, we’re fine. Elon has every right to cut us off from posting our content to Twitter. But, really, our Twitter feed drove little to no traffic anyway, and it has limited value. It seems like a bizarre decision to cut off a service that powers 43% of the world’s websites, making it way more difficult for those services to put their content on Twitter, but Elon (I’m repeatedly told) is some sort of intergalactic business genius, and I’m just some guy who writes words on the internet.

We are looking into alternative services, but not alternative ways to post to Twitter. As I’ve made clear, I’m quite enthusiastic about a few different protocol-based systems out there, including ActivityPub (Mastodon), AT Protocol (Bluesky) and nostr. So we’ll be looking at ways to automate posting to all of those over time. Protocol systems not subject to the whims of some random dude seem like a much safer and more sustainable bet. This is also why Techdirt has been available for decades via RSS, and you can always follow us that way, or by just visiting the page once a day.

Filed Under: api, automated posting, elon musk, protocols, wordpress
Companies: automattic, twitter

Phishing Attacks On WordPress Site Owners Disguised As Copyright Infringement Warnings

from the gone-phishing dept

Last year, we discussed how malicious actors on the internet were using fake copyright infringement notices in order to get people to click links that downloaded malware onto their machines. While there have long been these sorts of malware scams, what was notable about this one was that copyright culture and the fear of infringement had made this sort of thing viable. Putting the notices of a copyright troll and someone looking to infect machines with malware side by side, they’re basically the same thing in terms of tactic: scare the shit out of people over copyright infringement to get them to hastily do something they wouldn’t otherwise do. In some cases, that’s pay a settlement fee regardless of guilt. In other cases, click a link and get infected with malware.

In the subsequent year, it’s not like copyright culture has calmed the hell down, sadly. So, perhaps it’s not a huge surprise that there are more scams like this occurring. This time, similar copyright notices are going out to owners of WordPress sites in what is simply a phishing attack.

Site owners who use WordPress need to be aware of a new technique that scammers are using to phish for WordPress login credentials: fake copyright and trademark infringement notices. If you or an employee fall for this attack, your entire site could fall into the hands of scammers who may use your site to spread malware or force you to pay a ransom to regain access.

The scam begins when the scammers send the website a notice via email or through the website’s contact system with some legal-ish sounding language claiming that material on the site is infringing their copyright to images or other content. In order to see details of the alleged infringement, the site owner is directed to a “dashboard” on a WordPress.com hosted site. Once there, the website owner will be presented with a form asking them to log in using their WordPress login credentials. Of course, there is no infringement dashboard, and if you fill in the form you have just given scammers the information they need to take over your site

So, this mirrors common email phishing attacks, which typically come from malicious actors posing as service providers looking to verify credentials for reasons having nothing to do with intellectual property. What makes this so devious is that, though the public has somewhat learned to filter out the common email phishing attempts, disguising all of this as a copyright infringement issue pointed at website owners is likely to ensnare more people than a common phish attempt. Fear is what will drive people to click the “dashboard” link quickly.

And that fear has been meticulously cultivated by copyright trolls and aggressive enforcers of IP in the most pernicious manner possible. Creating that fear in order to get settlements and quick monied responses out of people was the entire point. And now all that fear that was generated has an unintended consequence in these targeted phishing attempts.

So, if you have a WordPress site, beware. And even if you don’t, lament that copyright culture and trolls have created this security vector to begin with.

Filed Under: copyright, phishing, scams, wordpress

Automattic Releases Five Un-Gagged National Security Letters

from the ask-and-you-have-slightly-better-chance-of-receiving dept

Another batch of FBI National Security Letters has been released, thanks to the expedited review process instituted by the USA Freedom Act. Automattic, the company behind WordPress, has released five NSLs dating back to 2010, as the result of successful nondisclosure challenges.

Each of the NSLs that we are publishing initially included an indefinite nondisclosure requirement that prohibited us from sharing any information about the letter or publicly acknowledging that we received an NSL.

We recently requested that these nondisclosure requirements be lifted, under the “reciprocal notice” procedures of the USA FREEDOM Act. More detail on the procedures that we followed is below.

In response to our requests, the FBI lifted the gag orders with respect to all information in each of the NSLs we are making available today. Before publishing the letters publicly, however, we decided to redact the following information from each letter: (1) the site URL about which the government requested information, (2) names of Automattic personnel to whom the request was addressed, and (3) name and contact information for the FBI personnel involved in making the information request.

We made these limited redactions in order to protect privacy interests. The NSLs are otherwise what we received when they were served onto us.

The five NSLs are identical. (PDF links included at the bottom of the Automattic post.) Automattic responded to four of those, but had none of the information requested for the fifth. After the gag orders were lifted by the FBI, Automattic informed the targeted users.

The boilerplate NSLs ask for far more info than the FBI’s own legal guidance suggests it should be able to request. A 2008 DOJ legal memo says NSLs should be constrained to “phone billing records.” The FBI has apparently decided to interpret this as any and all electronic transactional records when it comes to internet service providers. Here’s what’s requested in the Automattic NSLs:

• Subscriber name and related subscriber information
• Account number(s)
• Date the account opened or closed
• Physical and or postal addresses associated with the account
• Subscriber day/evening telephone numbers
• Screen names or other on-line names associated with the account
• All billing and method of payment related to the account including alternative billed numbers or calling cards
• All e-mail addresses associated with the account to include any and all of the above information for any secondary or additional e-mail addresses and/or user names identified by you as belonging to the targeted account in this letter
• Internet Protocol (IP) addresses assigned to this account and related e-mail accounts
• Uniform Resource Locator (URL) assigned to the account
• Plain old telephone(s) (POTS), ISDN circuit(s), Voice over internet protocol (VOIP), Cable modem service, Internet cable service, Digital Subscriber Line (DSL) asymmetrical/symmetrical relating to this account
• The names of any and all upstream and providers facilitating this account’s communications

This is where the FBI starts digging, apparently. By demanding all this info from a single service provider, the FBI can issue NSLs and subpoenas to a large number of additional third parties, even though the DOJ’s legal guidance suggests the FBI’s NSL requests should be far more constrained.

The recently-instituted challenge options are better than what was in place previously, but Automattic points out there’s still plenty of room for improvement.

We also continue to believe that NSLs pose serious constitutional concerns, particularly because they indefinitely prevent companies like us from speaking about them, and informing our users or the public about the NSLs that we receive. The procedures used to lift nondisclosure requirements are flawed because they put the burden of seeking an end to secrecy almost entirely on the companies, like Automattic, who receive NSLs.

The FBI has almost zero legal obligation to perform proactive reviews of issued NSL gag orders. Recipients must spend their time and money challenging them. Fortunately, the challenge process now requires much less of these scarce resources. Automattic has its own boilerplate form for challenging boilerplate NSL gag orders — one it’s willing to share with any NSL recipient — so we should be seeing more of these released in the near future.

Filed Under: fbi, gag orders, national security letter, nsl, nsls, secrecy, transparency, wordpress

More Evidence That Tons Of DMCA Takedowns Are Bad News… And That People Are Afraid To Counternotice

from the it's-a-real-problem dept

Earlier this week, we wrote about a major new study that revealed that a ton of DMCA takedown notices are clearly faulty, and how that shows just how messed up the DMCA’s notice-and-takedown provisions are in giving tremendous incentives to send notices with absolutely no punishment for filing bogus takedowns. The legacy music industry and its supporters keep claiming that the fact that there are so few counternotices is evidence that there’s almost no abuse. In fact, in the legacy music industry filing we wrote about earlier today, they even had the gall to claim that the real abuse is in the counternotices themselves.

As more and more comment filings to the Copyright Office about the DMCA process are being released, there’s increasing evidence that the legacy entertainment industry’s claims are, simply, full of shit. The latest is the excellent comment filed by Automattic (the folks who make WordPress), whose WordPress.com offering hosts over 80 million websites. The company notes that even while hosting so much content, the majority of the time the company spends dealing with DMCA notices is… dealing with the bogus ones:

We put a great deal of resources toward processing takedown notices because we take our responsibilities under the DMCA seriously. We aim to respond to all inbound takedown notices within 48 hours, exceeding the law?s requirements. But a significant portion of the resources we put towards our DMCA program are aimed at combating the shortcomings of the notice and takedown system. For example, we spend significant effort reviewing and trying to weed out overbroad and abusive DMCA takedown notices, so that our users? speech isn?t needlessly censored. This is a real cost to us, and diverts resources from more productive uses, like improving the products and services we offer our customers.

As with the study we highlighted earlier this week, Automattic notes that a huge number of notices it receives are invalid. First, it notes that approximately 29% of notices simply aren’t valid notices in that they fail to meet the criteria laid out by the DMCA for what constitutes a valid notice. Then, another 10% of notices do meet the criteria to be an official notice, but are “clearly false or mistaken.” And that’s based on their own review of the notices. So, approximately 40% of all DMCA takedown notices the company receives are bogus. But, contrary to what the legacy industry folks and their shills are saying, Automattic notes that very few people file counternotices, out of a fear of being sued, and they’re concerned about how this leads to censorship of perfectly legal speech.

Our statistics bear this out. As discussed below with respect to Subject No. 30, our statistics show that about 10% of the notices of claimed infringement we receive are otherwise valid but are clearly false or mistaken. But we receive many fewer counter notifications than that?only about one-half of one percent of the total number of notices we receive. We think this ratio shows that the low number of counter notifications is not the result of a correspondingly low number of false and mistaken assertions of infringement, but instead results from the concern that sending a counter notification is likely to result in costly litigation, even if that litigation would ultimately turn out to hold that no infringement had occurred. The company notes that out of a batch of approximately 1,700 “valid” but bogus notices, only 113 counter notices were sent. Most people just don’t bother out of fear of getting sued.

The company also highlights just how broken Section 512(f) is — which is the section that is supposed to be used against bogus takedowns. But as we’ve written about in the past, it’s basically a dead letter. There are almost no examples of 512(f) being used successfully against someone for sending a takedown… with the one exception being Automattic! As we wrote about, a few years ago, Automattic actually sued over egregiously bad DMCA notices and even won a case, but… it was by default, because the notice sender just ignored the lawsuit. In the other lawsuit, it could never actually find the plaintiff who sent the bogus censorious takedowns.

The company also provides a number of actual examples of bogus DMCA takedown notices to get beyond just the statistical aspect and to prove the problem is real:

• A medical transcription training service that used forged customer testimonials on their website submitted a takedown for screenshots of the fake testimonials in a blog post exposing the scam.
• A physician demanded removal of newspaper excerpts posted to a blog critical of the physician, by submitting a DMCA notice in which he falsely claimed to be a representative of the newspaper.
• A model involved in a contract dispute with a photographer submitted a series of DMCA notices seeking removal of images of the model for which the photographer was the rights holder.
• An international corporation submitted DMCA notices seeking removal of images of company documents posted by a whistleblower.
• A frequent submitter of DMCA notices submitted a DMCA notice seeking removal of a screenshot of an online discussion criticizing him for submitting overreaching DMCA notices.

As the company notes, each of these were clearly bogus, but since 512(f) is basically useless, it would be a complete waste of time to sue over them.

It’s good to see companies sharing this kind of information, and it tracks closely with what the study from earlier this week said, which was based on a different corpus of data. So, yeah, when the legacy guys claim there’s no abuse, they’re simply full of shit.

Filed Under: abuse, censorship, copyright, counternotices, dmca, dmca 512, notice and takedown, safe harbors, wordpress
Companies: automattic

WordPress Takes A Stand Against Abusive DMCA Takedown Notices; Others Should Pay Attention

from the platforms-shouldn't-just-be-takedown-remailers dept

Automattic, the company behind blogging platform WordPress, continues to prove that just because the issuing of DMCA takedown notices has largely been handed over to automated processes, the response doesn’t need to be similarly robotic.

Its latest transparency report shows it has rejected 43% of the DMCA notices it has received as either incomplete or abusive. Contrast this to almost any other platform where the initial response is to take down content/links first and work backwards from there. (Contrast this further to services like YouTube and Soundcloud, where content is subjected to automated pre-screening that seems to result in just as many illegitimate “removals.”)

Automattic’s DMCA process is anything but.

We carefully review each notice to ensure it’s formally complete, and includes all information required by the DMCA, before taking action. Notices that don’t meet the requirements of the statute are included in ‘notices rejected as incomplete.’

We also may decline to remove content if a notice is abusive. “Abusive” notices may be formally complete, but are directed at fair use of content, material that isn’t copyrightable, or content the complaining party misrepresents ownership of a copyright.

In an effort to keep the worst abusers “honest” (or at least warn others performing the same intermediary functions), Automattic continues to maintain a “Hall of Shame” highlighting issuers of bogus takedown notices.

So, there’s at least one major platform that has its users’ backs — something it has taken as far as the filing of lawsuits against serial abusers. And it’s one of the few that will actually try to determine whether or not the usage of the disputed content falls under fair use. Automattic seems to have learned from its past mistakes, and now it’s attempting to hold rightsholders and their representatives to the same standard it applies to itself. If content is going to be removed, the person(s) making these demands need to hold up their end of the bargain.

DMCA abuse isn’t likely to stop anytime soon. The process to issue notices continues to become more streamlined, which puts even more non-infringing content at risk. On top of that, the automated processes used to compile lists of “infringing” URLs continues to be error-prone. This wouldn’t be an issue if the companies providing these services to rightsholders spent a little (or any) time giving the notices a once-over before sending them out. The failure to do so not only has the potential to remove non-infringing content, but also to screw the same people they’re supposed to be protecting — not just in terms of reputation, but also financially.

A brief perusal of DMCA notices issued to Google finds multiple examples of non-infringing content being targeted by flaky automated processes. It also shows rightsholders are being billed for largely useless takedown requests filled with URLs covered in previous requests by the same company.

This recent request by IFPI Latin America contains 237 URLs — 236 of which were already delisted in response to earlier requests.

This is far from uncommon and pretty much amounts to double billing. Even in cases where rightsholders pay a monthly or yearly fee rather than per DMCA takedown, it’s still wasted money. While it’s obviously easier to let machines do the work and humans to collect the paychecks, nothing about an automated copyright takedown notice process contributes anything towards healthier respect for the idea itself, or the creations protected by it.

Automattic, on the other hand, will continue to gather respect from its users and potential customers around the world simply by refusing to lay out a WELCOME mat for our new DMCA robot overlords.

Filed Under: copyright, dmca, dmca abuse, transparency report, wordpress
Companies: automattic

WordPress Wins Case Against DMCA Abuser… Who Ignored The Proceedings

from the it's-a-start dept

Back in the summer of 2013, we wrote about yet another case of someone abusing the DMCA to censor content, rather than for any legitimate copyright purpose. The story was quite ridiculous, involving a group in the UK, called “Straight Pride UK.” The group did an interview with a student named Oliver Hotham, who had emailed the group, noting he was a journalist with a list of questions. The guy behind “Straight Pride UK,” Nick Steiner, responded to the questions with a document, which the group labeled as a “press release.” Hotham posted his article, which, quite reasonably, made Straight Pride UK look ridiculous. In response, the group issued a DMCA takedown notice to Automattic, the company behind WordPress.com, and the host of the article.

A couple months later, the legal team at Automattic decided it had had enough of these kinds of bogus takedowns and filed two lawsuits concerning bogus takedowns, including Nick Steiner’s. As we’ve noted for years, the DMCA does have section 512(f) which allows for some punishment for bogus DMCA takedowns, but in practice, 512(f) has been almost entirely neutered by the courts. Yet here were cases of clear abuse.

So it’s good to see that the court in the Hotham/Automattic/Steiner case has now ruled for WordPress and awarded $25,084.00. Unfortunately, Steiner has more or less ignored the entire case, so it is really a default judgment. And, assuming Steiner never comes to the US, it may not ever truly impact him, and it’s doubtful that he’ll pay up. Still, at the very least, it’s nice to see some sort of victory against bogus DMCA takedowns, given that it is so rare.

Filed Under: 512f, censorship, copyright, dmca, nick steiner, oliver hotham, wordpress
Companies: automattic, wordpress

Automattic Rejects Series Of Bogus Janet Jackson Takedown Attempts By Using Janet Jackson Song Titles

from the automattic-wins-the-internet dept

Via Parker Higgins we learn that Automattic (better known as the WordPress people) have added singer Janet Jackson to their “Hall of Shame” for sending totally bogus takedowns. Apparently, her people made the wacky claim that this post on “what would your WWE smackdown name be?” represented trademark infringement. It doesn’t. The only place it even mentions Jackson is in showing a picture of Sacha Baron Cohen with the following explanation:

Costume and entrance: Picture Sacha Baron Cohen in, what else? his movie The Dictator. Elaborate General?s outfit, hat, etc. He walks in flanked by half a dozen sexy female soldiers inspired by the Janet Jackson Rhythm Nation video.

Uh, yeah. That’s not trademark infringement. It’s not copyright infringement. It’s not anything but someone writing.

The other takedown is equally problematic. It claims the following image is copyright infringement:

As you can clearly see that’s using a photo of Jackson’s famous “wardrobe malfunction” from the Superbowl many years ago, and applying the Things Tim Howard Could Save meme to it. Marginally funny. But not copyright infringement. Not only does Jackson not hold the copyright on that image, it’s obvious fair use for whoever does hold the copyright.

Still, Automattic’s lawyers had some fun with their response, noting that they “tried to use as many Janet Jackson song titles as possible” in the response (while also noting they hope that doesn’t lead to another takedown demand):

It seems like you believe the use of the trademark ?Janet Jackson? is reserved all for you, but we were hoping you?d be open to some feedback because your attempt to control every use of the mark is pretty nasty. If you read up on nominative use, you?ll discover that it doesn?t really matter that ?Janet Jackson? is used on this site. If you believe there are any other alleged infringements, would you mind submitting a notice again via our trademark form?

http://automattic.com/trademark-policy/

So excited to work with you going forward

Nicely done.

Filed Under: copyright, fair use, janet jackson, takedowns, trademark, wordpress
Companies: automattic