Carnegie Mellon University
Computing Services  ›  Information Security Office  ›  Training and Awareness  ›  Digital Copyright and DMCA

Digital Copyright and DMCA

Carnegie Mellon University takes copyright violation seriously. Besides raising awareness about copyright law, it takes appropriate action in support of enforcement as required by policy and law. United States copyright law "protects the original works of authorship fixed in any tangible medium of expression, from which they can be perceived, reproduced, or otherwise communicated, either directly or with the aid of a machine or device".

The University's Fair Use Policy states that all members of the University must comply with US copyright law and it explains the fair use standards for using and duplicating copyrighted material. In addition, the policy prohibits the duplication of software for multiple uses, meeting the Digital Millennium Copyright Act (DMCA) requirements. The DMCA criminalizes the development or use of software that enables users to access material that is copyright protected. Furthermore, the Carnegie Mellon University Computing Policy prohibits the distribution of copyright protected material via the University network or computer systems, unless the copyright owner grants permission.

The Higher Education Opportunity Act

The Higher Education Opportunity Act of 2008 (Public Law 110-315) Section 488, requires institutions of higher education to annually inform students that "unauthorized distribution of copyrighted material, including unauthorized peer-to-peer file sharing, may subject the students to civil and criminal liabilities". Carnegie Mellon University does this by publication of a news article on Computing Services' website or via massmail communication each semester. The law goes on to require institutions "to provide a summary of penalties for violation of Federal copyright laws, including disciplinary actions that are taken against students who engage in unauthorized distribution of copyrighted materials using the institution's information system." Copyright protected materials can include, but are not necessarily limited to:
  • Music
  • Movies or other videos
  • Literary works
  • Software
  • Digital images or libraries

DMCA Takedown Notice

A DMCA Takedown Notice is a legal notification from a copyright holder or their representatives instructing the recipient to remove or make unavailable the copyright protected work cited. Carnegie Mellon University typically receives DMCA Takedown Notices through email. Notifications must contain the following elements to be valid:
  1. A physical or electronic signature of an authorized representative of the copyright holder of the allegedly infringed content
  2. Identification of the specific copyrighted work claimed to have been infringed
  3. Identification of the material that is claimed to be infringing with sufficient detail to allow the service provider to locate the material that is to be removed or made inaccessible
  4. Information sufficient to allow the service provider to contact the complaining party
  5. A statement that the complaining party has a good faith belief that the use of the material is not authorized by the copyright owner
  6. A statement that the information provided is accurate, and that under the penalty of perjury that the complaining party is authorized to act on behalf of the copyright protected materials owner.
For the majority of the DMCA Takedown Notifications received by Carnegie Mellon University, the key to identifying the "alleged infringer" so that they can be notified regarding the issue is the combination of an IP address and time stamp through which the allegedly infringing material was found to be available. In some cases, this could also be a web URL, a blog site, etc.

Reasons for Receiving a DMCA Takedown Notice

The university does not monitor for potential copyright violations occurring on the university network. A number of external organizations representing copyright owners monitor for their, or their client's copyright protected works being available through peer to peer file sharing, web sites, or by any other means.

When a DMCA Takedown Notice is received, the university, acting as an ISP, is required to respond. Part of the response is to identify and notify the alleged infringer of the complaint. This is typically done by email once the responsible user has been identified. There are cases where a surrogate responsible user, typically a system administrator or other person responsible for a specific machine or service will be notified with the intent that they identify the actual user and notify them of the complaint.

Note that the university does not make the identity of the alleged infringer available to any third party without appropriate legal orders to do so.

The University Processing of a DMCA Notice

After receiving a DMCA Takedown notice, the Information Security Office (ISO) will identify the computer that was using the IP address at the time specified in the notice, the web site administrator, or a specific user or group responsible for the service making the allegedly infringing material available and will then take the following actions:
  1. Identify the account associated with the IP address at the time listed in the DMCA notification
  2. Notify the account holder and, if the account holder is a student, notify the Office of Community Standards and Integrity (OCSI) by email, including the DMCA notification in the message.
  3. Identify the person or group responsible for a cited web URL or other network service and notify of the complaint by email including the DMCA notification in the message.
The identified alleged infringer will have 5 days within which to resolve the DMCA issue. Failure to do so will result in suspension of network service.

In the case of students, this entails network suspension of all computers registered to the CMU wired or wireless networks owned by the student, VPN access, access to the CMU-SECURE wireless network, and the ability to register systems in NetReg ( http://netreg.net.870105.com).

In the case of Faculty, Staff or Other Affiliates, the network suspension will be limited to the specific device or service (e.g., a single computer or account for VPN access).

For web URLs or other network services providing access to content the ISO will work with the site administrators or owners to determine the most expedient method for making the allegedly infringing content unavailable.

Student DMCA incidents can only be cleared before or after network service suspension by the Office of Community Standards and Integrity. The OCSI will contact the Computing Services Help Center to have the incident cleared and any loss of network access resulting from the DMCA incident restored. Instructions for contacting the OCSI are included in the Network Suspension Warning notification for the DMCA incident.

Faculty, Staff and Other Affiliate incidents will be resolved in conjunction with the Information Security Office (ISO). This may also entail participation by Human Resources, the Office of General Counsel or other university administrative units as appropriate.

Resources

Penalties and Legal Actions

A user in violation of copyright law may face the following penalties:
  • Suspension from the university network as described under The University Processing of a DMCA Notice.
  • Prosecution in criminal court or a civil lawsuit seeking damages. Civil liability for copyright infringement can be as high as $150,000 per instance of infringement in addition to legal fees.  Criminal penalties for a first offense may be as high as five years in jail and a fine of $500,000.
  • Disciplinary action taken by the Human Resources, the Office of General Counsel, or the Office of Community Standards and Integrity depending on the specific affiliation of the alleged infringer.

Other Legal Actions

Along with DMCA Takedown Notices, copyright holders and their representative agencies have also issued the following types of legal documents:
  • Early Settlement Offer
  • Preservation Request
  • Subpoena
Any of these documents can be sent individually or in groups, along with or instead of a DMCA Takedown Notice.

The agency representing the copyright holder may give the alleged infringer an opportunity to settle the matter prior to initiating any other legal actions.  The Early Settlement Offer can be sent as a separate letter, but is often included in a DMCA Takedown Notice. In the interest of providing Carnegie Mellon University affiliates with notice of potential legal claims and an opportunity to settle such claims, it is the practice of Carnegie Mellon University to forward Early Settlement Letters to the alleged infringer or to include any settlement offer included in a DMCA Takedown Notice.  The University does not disclose names, contact information or any other personally identifiable information to the copyright holder in response to Early Settlement Offers, nor does it offer advice regarding how to handle such offers.

A preservation request instructs Carnegie Mellon University to preserve an alleged infringer's contact information in response to a future subpoena. The notice will typically request that the alleged infringer preserve any evidence that might reside on the computer identified in the preservation request. The preservation request, similar to the Takedown notice, contains the IP address that was reported in the violation and the timestamp, including time, date, and time zone.   Preservation Requests along with identifying information are provided to the Office of General Counsel for response rather than directly contacting the alleged infringer.

Subpoenas are legal documents typically requiring the production of identifying information or evidence of an alleged infringement to an external organization.  All Subpoenas received by Computing Services are forwarded to the Office of General Counsel for resolution.

Avoid Triggering a DMCA Takedown Notice

To avoid violating copyright laws, users should consider the following:
  • Do not publish copyright protected materials on university web sites without obtaining permission from the copyright holder or their representative.
  • Disable P2P software on all devices before connecting to the campus network.
  • Adhere to Carnegie Mellon's Fair Use Policy.
  • Consider using one of EDUCAUSE recommended resources for legal downloading.