That warm flood of outrage through the veins is addicting—but it also runs the danger of being addictive, and of being too easy. As the news broke this week about the "Internet provisions" in the Anti-Counterfeiting Trade Agreement (ACTA), it didn't take long for the outrage to emerge.

For instance, the popular blog Boing Boing (we love you, Cory!) announced that, under the proposed ACTA provisions being drafted by the US, "ISPs have to proactively police copyright on user-contributed material. This means that it will be impossible to run a service like Flickr or YouTube or Blogger, since hiring enough lawyers to ensure that the mountain of material uploaded every second isn't infringing will exceed any hope of profitability."

It also asserted that "ISPs have to cut off the Internet access of accused copyright infringers or face liability."

The EFF said that "contrary to current US law and practice, the US text apparently conditions the safe harbors on Internet intermediaries adopting a Graduated Response or Three Strikes policy ISPs would be required to automatically terminate a customer upon a rightsholders' repeat allegation of copyright infringement at a particular IP address."

The leak



The statements are strong, but the document they are based on is not. As the ACTA countries (Australia, Canada, the EU, Japan, Korea, the US, etc.) meet in South Korea this week to hash out the provisions of the treaty dealing with the Internet, multiple reports began to circulate based on "sources" and a leaked document from the EU. Turns out, though, that all of these sources were actually the same one: the leaked EU document, which is now widely available for download (PDF).

The US ACTA delegation is drafting the Internet provisions that were debated this week, but they briefed the Europeans on the draft's progress when an EU delegation was in Washington back in September. The Europeans then wrote up an account of that discussion, which became the leaked document. So, what we're left with is a written account of an oral report on a draft document that was itself still being altered. In fact, we know it was still being altered at the time because lawyers for groups like CCIA and Public Knowledge were invited to see the draft, comment on it, and later see it again when some changes had been made.

The leaked EU document is short, only two pages of text, and most of the first page explains how the document came to be written. The document describes the US draft text as having five sections, and the problems begin with section two: "ACTA members have to provide for third-party liability." In other words, ISPs can be held liable for copyright violations committed using their networks, in at least some circumstances.

Section three says that "safe harbor" limits on this liability will be available, but to benefit from them, ISPs have certain obligations. "To benefit from safe harbors," says the document, "ISPs need to put in place policies to deter unauthorized storage and transmission of IP infringing content (ex: clauses in customers' contracts allowing, inter alia, a graduated response)."

Taken together, sections two and three sound terrifying, conjuring up the nightmare world described above, in which every ISP is required to adopt "three strikes" provisions and will be liable for copyright violations on its network. So, long, YouTube, Flickr, and every other user-generated content site on the Web!

This may be the eventual result of ACTA, but it's not what the EU document says. In fact, for US Internet users, the document sounds a whole lot like existing law—specifically, the Digital Millennium Copyright Act (DMCA), rather than a big new power grab.That's not a coincidence; the EU document actually says that the section on "safe harbors" for ISPs is "based on Section 512 of the Digital Millennium Copyright Act (DMCA), including a preamble about the balance between the interests of Internet service providers (ISPs) and rights-holders."

The DMCA has big problems—most notably, no anticircumvention of DRM even for fair use purposes—but Section 512 actually made sites like Flickr and YouTube possible by shielding them from most lawsuits.

But what about the mandated "three strikes" policies? Again, that's not what the document says. It says that ISPs must "put in place policies to deter unauthorized storage and transmission of IP infringing content" and that three strikes rules are one option among many (hence the "inter alia" quoted above). This might sound scary, but it's already in the DMCA and all US-based websites already adhere to its provisions.

As Section 512 makes clear, a safe harbor will only be granted to an ISP who has "adopted and reasonably implemented, and informs subscribers and account holders of the service provider's system or network of, a policy that provides for the termination in appropriate circumstances of subscribers and account holders of the service provider's system or network who are repeat infringers." Yet that provision has not created any sort of three strikes regime among the major US ISPs.

The leaked EU document also points out that the US "will not propose that authorities need to create such systems. Instead, they require some self-regulation by ISPs." That is, this won't create any new government mandate, but would leave in place the current system.

The DMCA goes globe-trotting



The ACTA Internet provisions can be better seen not as a call for secret new powers, but a "DMCA for the rest of the world." That's why section four of the US draft brings the "anti-circumvention" principles to the table, though even here the EU notes that "'fair use' will not be circumscribed" and "there will be exceptions to these prohibitions available to ACTA members."

And that's it; the document is remarkably brief, and appears to pose no novel issues to US residents worried that ACTA would come down hard on ISPs and end users. Given that these notes are based on a draft of a draft, however, one that was certainly modified during this week's ACTA meeting in Seoul, it's unclear how this section will evolve; we look forward to seeing a full draft of the relevant sections before passing judgment on it.

The real problem here is not for US residents, but for everyone else. ACTA is clearly an attempt to bring DMCA ideas like "notice and takedown" to other countries that don't currently use them. For instance, some other countries currently use and prefer a "notice and notice" scheme in which an ISP is not required to takedown allegedly infringing material after receiving a simple notice, but only to forward that notice on to the relevant subscriber.

Extending the anticircumvention language to the rest of the world will also be novel (in a bad way) for other countries, which could follow the US path of allowing DRM to trump copyright law and fair use rights. (Which is why it's pleasing to see that the US negotiators are open to fair use and to country-by-country exceptions to such rules.)

When it comes to the Internet provisions, the US clearly intended to show up in Seoul with an outline for "Taking the DMCA on a world tour!" How did this idea fare when presented to the other countries? Hard to say, since the official account of the negotiations is the sort of obfuscatory say-nothingness people hate to hear from bureaucrats.

"The discussions at the meeting were productive and focused on enforcement of rights in the digital environment and criminal enforcement," said the statement. "Participants also discussed the importance of transparency including the availability of opportunities for stakeholders and the public in general to provide meaningful input into the negotiating process. Participants in the meeting agreed that the next meeting would be hosted by Mexico in January 2010. Participants also reaffirmed their commitment to continue their work with the aim of concluding the agreement as soon as possible in 2010."

So ACTA's not coming in the next few months, and the negotiators have suddenly discovered the need for "meaningful input" from the public. Wonderful—but far too late after everything has been drafted, negotiated, and agreed-upon. Also, we've heard that song before.

ACTA is looking a good deal less scary than when it first appeared, but that's no reason for the public to back off its attempts to see what's being negotiated in its name.