The potential for computer users to infringe intellectual property rights using the Internet, specifically copyrights, could expose "intermediary" service providers to claims of secondary liability, such as contributory and vicarious copyright infringement. Concerned about this significant legal vulnerability of service providers, Congress passed the "Online Copyright Infringement Liability Limitation Act," Title II of the Digital Millennium Copyright Act (DMCA) of 1998, in an effort to adapt copyright law to an evolving digital environment. The act added a new Section 512 to the Copyright Act (Title 17 of the U.S. Code), which provides limitations on the liability of OSPs and ISPs against claims of copyright infringement arising from their users' activities on their digital networks. The safe harbors correspond to the following four functional operations that might otherwise constitute copyright infringement: (1) transitory digital network communications, (2) system caching, (3) storage of information on systems or networks at direction of users, and (4) information location tools. Thus the safe harbors have been essential to the growth of the Internet as an engine for innovation and free expression. The Copyright Act provides several civil remedies to the copyright holder that is harmed by infringement, including the possibility of obtaining injunctive relief, actual damages suffered by the copyright owner due to the infringement, statutory damages, and costs and attorney fees. Dropbox, Google Drive, YouTube, Facebook, and Instagram are all examples of such cyberlocker services. § 512, do not confer absolute immunity, but they do significantly limit service providers' liability based on the specific functions they perform. Without a safe harbor for providers of these tools, the human editors and cataloguers compiling Internet directories might be overly cautious for fear of being held liable for infringement. Takedown Notices

One condition common to three of the four categories is the requirement that upon proper notification by the copyright owner of online material being displayed or transmitted without authorization, a service provider must "expeditiously" remove or disable access to the allegedly infringing material. For example, in the case of service providers that provide either (1) system caching, (2) storage of information on systems or networks at direction of users, or (3) information location tools, the court may grant injunctive relief with respect to a service provider in one or more of the following forms:
an order restraining the service provider from providing access to infringing material or activity residing at a particular online site on the provider's system or network; an order restraining the service provider from providing access to a subscriber or account holder of the service provider's system or network who is engaging in infringing activity and is identified in the order, by terminating the accounts of the subscriber or account holder that are specified in the order; such other injunctive relief as the court may consider necessary to prevent or restrain infringement of copyrighted material specified in the order of the court at a particular online location, if such relief is the least burdensome to the service provider among the forms of relief comparably effective for that purpose. The cases often begin by the service provider asserting a DMCA safe harbor as an affirmative defense that limits its infringement liability; as an affirmative defense, the service provider has the burden of establishing that it meets the safe harbor's eligibility requirements. Burden of Policing Infringement

Section 512(m) expressly provides that the DMCA's safe harbor provisions are not conditioned upon a service provider "monitoring its service or affirmatively seeking facts indicating infringing activity." Amazon sought liability protection under the § 512(c) safe harbor. "Red Flag" Apparent Knowledge of Infringement

In the absence of "actual knowledge" that materials or activities on their system or network are infringing, a service provider has an obligation to "expeditiously" remove or disable access to infringing content when it becomes "aware of facts or circumstances from which infringing activity is apparent."
Congress passed the Digital Millennium Copyright Act (DMCA) in 1998 in an effort to adapt copyright law to emerging digital technologies that potentially could be used to exponentially increase infringing activities online. Title II of the DMCA, titled the "Online Copyright Infringement Liability Limitation Act," added a new Section 512 to the Copyright Act (Title 17 of the U.S. Code) in order to limit the liability of providers of Internet access and online services that may arise due to their users posting or sharing materials that infringe copyrights. Congress was concerned that without insulating Internet intermediaries from crippling financial liability for copyright infringement, investment in the growth of the Internet could be stifled and innovation could be harmed.
The § 512 "safe harbor" immunity is available only to a party that qualifies as a "service provider" as defined by the DMCA, and only after the provider complies with certain eligibility requirements. The DMCA's safe harbors greatly limit service providers' liability based on the specific functions they could perform: (1) transitory digital network communications, (2) system caching, (3) storage of information on systems or networks at direction of users, and (4) information location tools. In exchange for the shelter from most forms of liability, the DMCA requires service providers to cooperate with copyright owners to address infringing activities conducted by the providers' customers. The safe harbor thus reflects a "grand bargain" between creative content-producing industries and Internet companies that seeks to both promote investment in the Internet and protect copyright holders' intellectual property rights.
The DMCA expressly states that a service provider is not required to actively monitor its service for infringing activity. However, § 512 requires a service provider, upon proper notification by the copyright owner of online material being displayed or transmitted without authorization, to "expeditiously" remove or disable access to the allegedly infringing material. In addition, a service provider must remove or disable access to material upon acquiring actual knowledge that materials or activities on its system or network are infringing (for example, actual knowledge can be obtained by the copyright holder's notification) or when the service provider becomes aware of facts or circumstances from which infringing activity is apparent (so-called "red flag" knowledge). Service providers that meet the eligibility conditions of the § 512 safe harbor are thus shielded from liability for unknowingly hosting content that infringes copyrights, whereas § 512 provides copyright holders a simple and cost-effective procedural mechanism for remedying online infringement of their intellectual property rights. Courts have found that the burden of actively monitoring online copyright infringement lies on copyright holders.
This report focuses primarily on the third safe harbor functional category, "storage of information on systems or networks at direction of users," which includes any website that stores digital content that users have uploaded for public consumption or for sharing purposes, such as popular social media and online services YouTube, Facebook, Dropbox, Flickr, Google Drive, and Blogger. The report will describe and analyze the statutory language establishing the safe harbor as well as discuss federal court cases that have considered the scope and application of the DMCA safe harbors and the extent to which online service providers can be held indirectly liable for copyright infringement committed by their users.