More on January 7th Downtime — The DMCA and Due Process

Surge.sh was down for approximately one hour and twenty five minutes last week. Kenneth initially wrote about it here. This post provides more information as to what happened.

Unfortunately, this is not your typical “our servers crashed” situation. Our network was disabled by DigitalOcean for reasons relating to an unresolved DMCA takedown request that was issued to CloudFlare.

After it was all over DigitalOcean reached out and expressed genuine remorse for disabling the network without speaking first. DigitalOcean said they were committed to establishing better policy on such situations moving forward.

We are providing transparency on this issue so you, the users of surge.sh know how and why your projects were offline for so long yesterday. Additionally, we believe there are lessons to be learnt here.

We are happy with the service DigitalOcean provides and are pleased with their willingness to improve their process. This is an isolated incident and we are optimistic better policies and processes will be developed as a result.

General Info

Here is some basic information…

• surge.sh is a publishing platform for front-end web projects.
• surge.sh is hosted on DigitalOcean.
• As of this writing surge.sh hosts 16,154 projects.
• surge.sh has never received a DMCA takedown request from any copyright holder (or copyright holder representative). DigitalOcean has never received one on our behalf. (yes, we have awesome customers).
• On December 21st, 2015 CloudFlare received a DMCA takedown notice for alleged trademark infringement on 2 domains served from an IP address under CloudFlare’s control. These domains were published on surge.sh and exposed to the public through CloudFronts service.
• The DMCA takedown request issued to CloudFlare was for alleged trademark infringement submitted by a representative specializing in “brand protection”.
• It is presumed that the alleged infringer is a user of both CloudFlare and surge.sh.

Timeline

Here is how things went down (mind the pun)…

• On both December 21st and 27th, CloudFlare forwarded the DMCA notice to DigitalOcean with the assumption that DigitalOcean would take action on the request.
• On both occasions DigitalOcean forwarded the DMCA notice to surge.sh with the assumption that that we would take action on the request.
• After first receiving the forward Surge reviewed the domains in question and neither passed the “red-flag” test for identifying infringing material. It was therefore determined that it would not be appropriate for surge to disable the domains in question without a valid DMCA takedown request form the copyright holder. Therefore no action was taken.
• On December 28 we clarified to DigitalOcean that we had no control over the IP addresses mentioned in the DMCA notice forwarded to us. DigitalOcean replied by pointing out that CloudFlare was fronting to a server in our control (no further comment was made).
• Yesterday at 9:45am without any further notice, DigitalOcean disabled our network availability disabling all 16,154 projects on surge.sh. This was done without the authority of the copyright holder, its agents, the law, the alleged infringer, nor the surge.sh team.
• Yesterday at 10:00am in the interest of getting our customers project back online we agreed to remove the alleged infringing domains. About 1h later DigitalOcean restored our network bringing all surge.sh projects back online.

Removing material from the internet is a very serious action and should not be done lightly. The DMCA provides an important mechanism for removing content in a timely fashion in order to minimize damages from the unauthorized distribution of copy written material. However the interests of copyright holders must balanced with the interests of the public by defending free speech. It is therefore or stance that reasonable effort must be performed to ensure any DMCA notice is valid prior to removing any material from the web.

Surge will continue to protect the rights of publishers as well as copyright holders by following due process on all DMCA notices. However it must be understood that surge can sometimes be at the mercy of policies set by other service providers. In this case DigitalOcean.

We hope this provides some insight to our downtime last week. We’re sorry to those who were affected by this outage. We are now in direct communication with the DigitalOcean customer success team where we will be discussing policies such as these to prevent these situations in the future. Thanks to everyone for their support by reaching out to those who could help.

– Brock & Kenneth from Surge.