When the RIAA targeted CDN provider Cloudflare with an injunction to block access to a known pirate site, the company objected. Cloudflare argued that the DMCA shielded the company from the broad blocking requirements. However, a Florida federal court has now ruled that the DMCA doesn't apply in this case, opening the door to widespread anti-piracy filtering.

Representing various major record labels, the RIAA filed a lawsuit against MP3Skull in 2015.

With millions of visitors per month the MP3 download site had been one of the prime sources of pirated music for a long time. This frustrated many music industry insiders who claimed millions in losses.

Last year a Florida federal court sided with the RIAA, awarding the labels more than $22 million in damages. In addition, it issued a permanent injunction which allowed the RIAA to take over the site’s domain names.

Despite the million dollar verdict, MP3Skull continued to operate for several months using a variety of new domain names, which were subsequently targeted by the RIAA’s legal team.

As the site refused to shut down, the RIAA moved up the chain targeting CDN provider Cloudflare with the permanent injunction. According to the RIAA, Cloudflare should stop offering its services to all MP3Skull websites, arguing that the CDN provider was “in active concert or participation” with the pirates.

Cloudflare disagreed and countered that the DMCA protects it from liability for the copyright infringements of its customers, limiting the scope of anti-piracy injunctions. In an effort to resolve this difference of opinion, the RIAA has asked the Florida federal court for a “clarification” of the existing injunction.

After hearing the arguments from both sides, the court has now ruled against Cloudflare’s DMCA defense, opening the door for an injunction against the CDN provider itself.

In her order, District Court Judge Marcia Cooke notes that Section 512 of the DMCA protects service providers from copyright infringement liability for the actions of others of which they are not aware.

However, this is different from the current case where Cloudflare is not being held liable by the RIAA but is well aware of the copyright infringements, the Judge clarifies.

“Here, Plaintiffs do not allege Cloudflare is directly liable for copyright infringement. Further, CloudFlare has been aware of Defendants’ infringing behavior since at least May 2015 when it first assisted Plaintiffs in identifying relevant online information involving Defendants.

“Simply put, Section 512’s limits to online service provider liability are inapplicable here,” Judge Cooke adds (pdf).

In the present case, the scope of the permanent injunction is guided by Rule 65 of the Federal Rules of Civil Procedure which may apply to any third-party that’s “in active concert or participation” with the offender.

With the ruling, the court has opened the door to broad injunctions which could force Cloudflare to implement a variety of anti-piracy measures. These aren’t limited to terminating existing accounts, as the RIAA also wanted Cloudflare to monitor new clients that use the keyword “MP3Skull” in their domain name.

However, before issuing an injunction against Cloudflare, it still has to be determined whether the CDN provider is “in active concert or participation” with the pirate site.

“Though I have determined Section 512 does not effect the scope of Rule 65 and the Permanent Injunction here, I do not believe I can make a formal ruling on whether Cloudflare was in ‘in active concert or participation’ with Defendants until CloudFlare has had a reasonable opportunity to be heard,” Judge Cooke notes.

The order is a victory for the RIAA and other rightsholders who have repeatedly called out Cloudflare for the services it provides to pirate sites. As such, it is likely to be referenced in similar cases in the future.

While the legal precedent may be important, the case itself will have very little effect. MP3Skull appears to have given up a few months ago. It was last active on the MP3Skull.vg domain but disappeared last October, forwarding the leftover traffic to an unrelated site.