Privacy fears in YouTube case
A billion-dollar court clash between old- and new-media giants took on unexpected privacy ramifications this week when a federal judge ordered YouTube to hand over the log-on names and Internet addresses of every person who had viewed material on the Web’s top video site -- tens of millions of people.
Viacom Inc. wants YouTube’s logs to help it determine whether unauthorized material makes up a major share of what’s watched there. The media giant, which owns the rights to shows such as “The Colbert Report” and “South Park,” is suing YouTube and corporate parent Google Inc. for copyright infringement.
Viacom General Counsel Michael Fricklas pledged “unequivocally” Thursday not to use the data to learn the real names of YouTube users in order to sue them for uploading unauthorized clips, as the recording industry has done to people who illegally shared music online.
The New York company said a protective order dictated that only its outside lawyers and experts could access the raw data, and that it could be used solely to make the case against Google.
But the ruling, filed late Wednesday by Judge Louis Stanton of U.S. District Court in New York, shocked privacy advocates. They fear a broader effect from his finding that so-called Internet Protocol addresses -- the unique numbers assigned to all computers and devices connected to the Internet -- need not be strictly protected because they aren’t tied publicly to individual names.
“It’s a very important privacy moment,” said Marc Rotenberg, executive director of the nonprofit Electronic Privacy Information Center. “It will remind folks that companies like Google are sitting on top of a lot of personal information that they can’t always control.”
Viacom and YouTube are discussing a plan to replace the Internet addresses with codes, a move designed to prevent the linking of a YouTube log-on name with a particular computer. If that happens, Google has no plans to appeal, according to people working on the case who requested anonymity because of the high financial stakes of the litigation.
Google had objected to Viacom’s request for the data, arguing that it would violate users’ privacy. But the Mountain View, Calif., company drew fire from privacy groups because it had written elsewhere, when defending its long-term collection of data on users’ Web surfing habits, that Internet addresses aren’t “personally identifiable information.”
In his written order, which covered a number of requests for evidence, Stanton cited a Feb. 22 posting to Google’s official blog saying that in most cases, an Internet Protocol address “without additional information” -- typically from an Internet service provider -- can’t identify an individual.
That’s not always true, though, and people assuming that their behavior will remain private sometimes use their legal names as log-on handles.
In addition to a law that specifically protects video renters from being identified, “there is a more fundamental constitutional issue about the right to view videos anonymously, read anonymously, receive information anonymously,” said attorney Kurt Opsahl of the nonprofit Electronic Frontier Foundation.
“IP addresses are the primary means for identifying individual speakers on the Internet,” he said. “It’s vital that they be protected and recognized as personally identifying information.”
Both the Electronic Frontier Foundation and the Electronic Privacy Information Center believe that Google and other firms should collect less personal data, save it for shorter periods and alter it so that it can’t be traced to individuals.
Authorities have mixed opinions on the sensitivity of IP addresses. In Europe, regulators decided in February that the addresses were personal data subject to significant protection. In U.S. court cases, companies suing over defamation on the Web often have to show the judge that they have a good case -- and the anonymous critics get a chance to respond -- before a service provider can be compelled to turn over an IP address.
Google wants to keep individual histories to show more-relevant videos and to comply with laws in other countries. An IP address could reveal that a viewer is in India, for example, and therefore by law must be kept from seeing a U.S. comedian mocking Gandhi, a protected national hero.
Experts said that because Wednesday’s ruling covered a broad range of requests and no consumer representatives were allowed to argue against the data release, it might not set a pattern for other judges.
But other copyright plaintiffs could sue and seek user IP addresses as a means to ferret out individual names, said Jennifer Urban, director of the USC Intellectual Property and Technology Law Clinic. Even if only the IP addresses change hands, Urban said, “it may be that the database is not kept as secure as it is here, or it’s turned over and a party decides to leak the information.”
If that happens, Urban said, “then the user’s expectation that their information stays on a Google server will be completely undermined.”
As it stands, the order could embolden other companies to engage in fishing expeditions against other targets, to “turn a company upside down” and extract data about people’s online behavior, said Kenneth D. Freundlich, an entertainment lawyer in Beverly Hills.
Viacom lost several other attempts to force evidence out of Google, including a bid to get a look at the company’s source code. But statistics about the prevalence of piracy that it could generate from even anonymous user data could provide a major boost to the case, legal experts said.
--
jessica.guynn@latimes.com
--
Times staff writer Dawn Chmielewski contributed to this report.
