Lot 2

How Bungie Identified a Mass Dispatcher of Fake DMCA Reports *TorrentFreak

Earlier this year, Bungie and its avid Destiny fan community were plunged into chaos.

Using the DMCA’s takedown process as a weapon, unknown individuals sent copyright notices to YouTube, claiming that the targeted videos had to be removed for infringing Bungie’s rights.

YouTube started removing videos, including some uploaded by high-profile Destiny content creators. Other posts were directed at Bungie’s own channels, causing confusion and frustration within the Destiny community.

While Bungie supports fan-created content and allows videos that had to be uploaded to YouTube, a growing number of fans came to the conclusion that Bungie was somehow to blame. With its reputation on the line, Bungie went on to investigate and later confirmed that the takedown notices were all fraudulent and not responsible.

In late March, Bungie took the unusual step of filing a lawsuit in a Washington court. It revealed in detail how two Google Gmail accounts were created to mimic Bungie’s anti-piracy partner CSC. The accounts were then used to send masses of fraudulent takedown requests to YouTube.

The magnitude of the disruption caused was significant and Bungie’s language in the complaint was unsurpassed. In addition to damages related to the fraudulent notices, the company piled up additional claims for copyright infringement, misrepresentation, business defamation, breach of contract and violations of consumer protection laws.

The immediate challenge to Bungie was that the company did not know or could not prove the identity of the perpetrator before filing the lawsuit. An initial amended complaint filed this week by Bungie moves things forward significantly by designating a single defendant as the person responsible. It also reveals how Bungie tracked down and identified the architect of the DMCA fraud system as one of its own clients.

Bungie goes to work

Bungie’s early attempts to get information from Google/YouTube ran into problems. The company attempted to sue Google using the DMCA, but the mechanism chosen allowed Bungie to identify only an alleged copyright infringer, not the sender of allegedly abusive DMCA notices.

Google initially declined to comply, but after some work, Bungie started getting the information it was looking for earlier this month.

On June 10, 2022, Google handed over “key information” about the accounts used to send the fraudulent messages, including [email protected] (Wiland account) and [email protected] (Reynolds account). Google also provided a list of all takedown requests sent through the accounts, copies of all correspondence between Google and the accounts, plus a log of IP addresses used to gain access.

The logs showed that the Wiland and Reynolds accounts were consistently accessed from a particular IP address (ending in .241), traceable to Consolidated Communications, a residential ISP serving Rocklin, California. On March 22, the Reynolds account logged out of Google and less than a second later, the Wiland account logged in, suggesting the same person was behind both accounts.

But Bungie had more. Much more.

IP addresses conform to official accounts, physical goods

The same .241 IP address mentioned above was also used to send abusive emails to Bungie’s anti-piracy provider CSC. Even more problematic was its association with two official Destiny 2 accounts.

One of those accounts physically purchased the Destiny 2: The Witch Queen OST. That was then delivered to a physical address in Rocklin. The purchase came with a bonus decal download link, which was emailed to the buyer. The recipient clicked the link and Bungie logged in the same .241 IP address.

By now, the net had almost completely shut down, but in terms of evidence, Bungie was far from done. The clickable logo link was sent to: [email protected] and during the chaos of the fake notification campaign, a YouTuber named “Lord Nazo” was hit by a fraudulent DMCA message, sent by the Wiland Google account.

Apparently angered by this injustice, Lord Nazo sent back a DMCA counter-notice on YouTube criticizing the spate of fake posts, claiming that his video did not infringe because it was a “transformative case of fair use.”

Lord Nazo’s counter notice contained his e-mail – [email protected] – match him with the Destiny account at Bungie. It also included a physical address in Rocklin, California. Whether through carelessness or design, it also featured his real name: Nick Minor.

From bad to worse and beyond

As early as December 2021, unaware of the chaos to come, Bungie was already experiencing problems with Nick Minor and his ‘Lord Nazo’ YouTube channel.

Bungie’s anti-piracy supplier CSC targeted the channel with a DMCA takedown after it published The Last Stand, a song from the Taken King OST. It took until January 25, 2022 for the video to be taken down, and on that same day, Minor created the Wiland Google account that was later used to send out some fake alerts.

After purchasing and receiving the Witch Queen OST in Rocklin, Minor began uploading songs from the OST to his ‘Lord Nazo’ YouTube channel. Around March 2, 2022, CSC initiated a series of 41 DMCA takedowns, 23 of which targeted Minor’s uploads. A day later, YouTube terminated its channel for repeated infringement.

Minor took to Twitter and complained directly to Bungie, asking the company to withdraw the copyright complaints so he could get his YouTube account back. On March 16, Minor tweeted again.

“This escalates. Bungie must rectify these copyright takedowns and lock down their brand management,” he wrote.

A day later, a wave of fraudulent reports was sent to YouTube; 36 from the Wiland account and one from another Google account, [email protected] (Averz account). Bungie thinks Minor wanted to use the Reynolds account to send that message, as an identical message was also sent from the Reynolds account shortly after.

Whether the account switching played a role is unknown, but on March 18, Google flagged both reports as fraudulent and asked Minor for documents to prove his identity. Minor then switched to the Wiland account to send more fraudulent notifications, and when Google pressured him to prove his identity on the Wiland and Averz accounts, Minor retracted those specific takedown notifications.

Stirring controversy, playing the victim, making things worse

The day Google Minor requested documents, he used his “Lord Nazo” Twitter account to send messages to Bungie accounts. “It seems that not only the music community is affected. 2 non-music channels can’t be a mistake,” he tweeted. “Either someone is making false copyright claims on behalf of @Bungie or their CSC is out of control.”

On March 20, Minor responded to Bungie’s tweet, informing the Destiny community that the company was not behind the takedown campaign. “I just knew it wasn’t you,” he tweeted back to Bungie. “I just couldn’t believe you were still doing this to us after 8 years. I’m so glad I was right.”

Three days later, Minor directed a tweet on YouTube: “@TeamYouTube People with Destiny 2 content on their channels are being hit by fake takedowns and even Bungie confirms the takedowns aren’t legit. In fact, my channel has been terminated because of all these fake takedowns. Can you do something about this?”

Minor then tweeted to Bungie again, complaining that his videos hadn’t been recovered yet. On March 26, Minor in yet another tweet on YouTube asked for his videos to be reinstated because the DMCA notices in question were fake. They were real, Bungie had sent them before.

VPN implementation came too late

At this point, news of Bungie’s lawsuit began to surface online, leading to Minor accessing the Wiland and Reynolds accounts using a VPN. But of course VPNs can’t undo the mistakes of the past and in this case, Minor probably wouldn’t have helped get away with his campaign, even if he had used one from the start.

For example, Minor’s use of the same email addresses on multiple sites started a long time ago. As part of its investigation, Bungie gained access to data made public after the 2016 breach of the hacking and cheating site Nulled.io. The company found three email addresses in its database that link Minor to the fake DMCA campaign.

The first – [email protected] – was specified in the order for the OST California delivery. It was also used to release the YouTube counter-announcement linking Minor to the “Lord Nazo” channel, which in turn gave Minor’s real name and physical address.

The second – [email protected] – was incorrectly used to send a fake DMCA notice and the third – [email protected] – was the email address Minor used to open his Destiny account with Bungie.

Bungie’s Amended Complaint, Requesting At Least $7.65 Million, Can Be Found here (pdf)

#Bungie #Identified #Mass #Dispatcher #Fake #DMCA #Reports #TorrentFreak

Leave a Comment

Your email address will not be published. Required fields are marked *