back
16 comments
Interesting topic, but it reads like a hastily written article that probably could have been condensed to a single paragraph.

People appear to be writing Tumblr blog posts and backdating them to use as evidence for Google DCMA takedowns.

I needed to read the article several times to understand what is going on exactly.

Yes exactly as you said, scammers doing visa scams and such are copying articles that criticise them, backdate them on tumblr, then use DCMA to take them down, then delete the tumblr post.

1: Why does Tumblr have this feature in the first place? I can think of a hundred ways this is ripe for abuse.

2: Why does Google not have a mitigation/validation strategy in place? They surely know Tumblr timestamps cannot be trusted.

This is the type of obvious gaping vulnerability I expect to see in a personal side project, not on two of largest tech platforms.

Nearly all blogging software offers the ability to edit post dates arbitrarily, and this has been the case since the dawn of blogging. It is very surprising if Google is trusting these as-is.

btw on the social media side of Tumblr (dashboard feed of followed blogs), the user-editable post date is ignored, so it cannot be used for manipulating the dashboard sort order.

I think that site isn't using a familiar Western written journalism style.

Maybe the article is more intelligible to whomever knows how to skim whatever style it is. Or maybe it's LLM-generated and accessible to no one.

How does this work exactly?

1) A blogger publishes an article warning about scammer/fraudster/terrorist known as person Person X. They publish on January 1 2024.

2) Person X wants to get this info out of the Google results.

3) Person X goes to one one of these reputation management companies. They copy verbatim the article and post it to Tumblr. Tumblr has a feature to back-date posts so they back-date their post to December 1 2023. This makes it appear like the content appeared before the blogger published their article.

4) The reputation management company then sends a DCMA takedown notice to Google with the Tumblr post as evidence that the blogger is infringing on their content. Google does their DCMA thing and de-indexes the blog post.

The blog poster's remedy is to appeal the takedown at which point Google would then re-list their post...at which point this process starts over again?

Stuff like this is incredibly frustrating. It's so simple yet effective because of how the DCMA compliance process is implemented.

I was poking around on fiverr the other day and I was kind of floored by the number of ‘dmca for hire’ services. It looked like for a very reasonable fee you could engage these people to spam out fake dmca notices across the internet to remove things you don’t like. Guaranteed fast results and with lots of good reviews.
Are they gray market services? Do they try to sell themselves as legitimate? Like a service to take down the photos your ex posted or are they straightforward about what they’re up to?
They don’t make any claims as to why you’d be making the take down notices. It looks like it’s all web forms so you could use them for anything
It had never really occurred to me that having a backdating facility was this much of a problem.

I guess it is a risk for longstanding hosted services.

Arguably the problem is that copyright enforcement has been farmed out to private middlemen with a fast and loose process.
More than that, they need to clone a website and enter a date in the past. Then they need to fill out a form using DMCA sworn statement language. The must know what they're doing is illegal. That's not much of a deterrent when there's no real enforcement and it's so easy for these outfits to make a quick buck.
One big flaw is that anyone, anything, anywhere can submit a DMCA request/"demand." If they had to be done in person at a US courthouse then there would be a record of exactly who made the false claim. As they are now, they are functionally anonymous.

This might sound wacky, but the more pervasive AI becomes the more important it will become to link any significant requests to real humans. That might be legal requests, but it will also include financial services, etc.

> the more important it will become to link any significant requests to real humans

Remember during the resolution of the mortgage fraud / title insurance issue in the US people were coming forward and being videoed in depositions saying 'I was hired at this bank, my job was to sign forms, I had no idea what or why I was signing, I was just told these forms required a human signature, I signed thousands per week.'

Unfortunately it seems the legal system has already baked in a 'yes, a person signed, but they were too stupid to recognise what they were doing wasn't legal because they worked at a big company and assumed it must have been okay.'

I don't really know how you work around that sort of institutional acceptance of what must be some type of fraud.

The 'system' doesn't really when people seem to have decided 'well, if we break enough laws on a large enough scale there's nothing they can really do.'

It was already a serious problem for google search results for years with many sites reporting that their content is older than it is, making the date options in advanced search much less useful.

I can see it being useful for for re-hosted content like usenet posts, but as far as I could tell it's more commonly used as some sort of SEO meta.

I've seen some evidence of 'reputation management' that inserts completely innocent URLs in long lists of URLs reported for what appear to be legitimate copyright violations of adult content -- resulting in total suppression in google search.

Might be a nice bit of side income for people who are in an already pretty shady industry, take a payment to insert a percent or two in their otherwise legitimate reports.