Eliminalia behind yet another technique to silence investigative media


– How does Google handle DMCA take-down requests?

On August 21st, the Canadian Domain Registrar easyDNS, Qurium’s trusted domain registrar, received a “DMCA Takedown Notification” from a person claiming to come from Esquerda.net, an alternative information portal from Portugal (Portal de informação de todas as lutas). The “DMCA Take Notification”, submitted in the name of Esquerda, demanded the removal of an article from investigative news site Maka Angola.

Qurium has recently reported on fake lawyer firms claiming copyright (DMCA) or data protection legislation (GDPR) to take down sensitive information published by the investigative media Maka Angola. Therefore, the request to EasyDNS did not come as a surprise. Looking into the Lumen database, we found a take-down request to Google on the same article.

This report focuses on the two DMCA takedown requests and how the two recipients (EasyDNS and Google) handled the cases.


Take down request to domain registrar (EasyDNS)

The following fake DMCA Takdown Notification was received by easyDNS from someone claiming to represent Esquerda.net.

Subject: DMCA Takedown Notification https://www.makaangola.org,
This e-mail is a notification under USC 17 §512, the Digital Millennium Copyright Act (DMCA), of instances of copyright infringement operating on site(s) under your control.
The copyrighted work at issue is as follows:
https://www.esquerda.net/artigo/monumental-burla-do-filho-de-jose-eduardo-dos-santos/53998
The unauthorized, and infringing copy is available the following URL(s):
https://www.makaangola.org/tag/teodoro-bastos-de-almeida/
I have a good faith belief that use of the copyrighted materials described above as allegedly infringing is not authorized by the copyright owner, its agent, or the law.
I swear, under penalty of perjury, that the information in the notification is accurate and that I am the copyright owner or am authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.
I demand that you expeditiously remove or disable access to the material in question.
The following should be considered my electronic signature for the purposes of §512(c)(i):
O Esquerda.net
Portal de informação de todas as lutas.

The article, titled “The monumental mockery of the son of José Eduardo dos Santos” reads in English:

Esquerda’s reprint of Maka Angola’s article.

Once Qurium received a copy of the DMCA Takedown Notification, we reached out to Esquerda.net that quickly responded that the outlet was not the author of the notification. Luis Branco, director of the portal “Esquerda.net”, also clarified that the article was a reprint of a Maka Angola’s article and not the opposite.

Mail from Luís Branco, Director at Esquerda.net to Qurium.




Using legal copies to claim copyright violation

In a previous article we have described a technique where articles that are desired to be removed from the Internet are copied into fake websites and then back-dated to claim copyright. This technique has been used by several “reputation companies” including Eliminalia that registered hundreds of domains for building up pools of fake news sites for this purpose.

This new technique is different as it does not use fake websites. To avoid the hassle of creating fake websites, the “reputation company” looks for legitimate articles similar or identical to the ones that they want to remove and claim ownership of them.

Finding complete copies online of journalist investigations dealing with corruption and human rights violations is not uncommon as the articles often are published under Creative Commons (CC) license.

So who is behind this new attempt? Our internal forensics evidence suggests that this new technique is one more attempt from Eliminalia to remove content related to the son of former president of Angola José Eduardo dos Santos: José Filomeno dos Santos aka Zenu.

DMCA Take down request to Google

Looking into the Lumen Database, containing DMCA Takedown Notifications to Google, Qurium found a bunch of fake DMCA complaints concerning the article about Zenu.

  • [25 Jun 2021] #24360852 Complaint impersonating “Esquerda” to remove the article of Maka Angola
  • [30 Jun 2021] #24406476 Complaint impersonating “O Globo” to remove the copy of Esquerda.net.
  • [13 Jul 2021] #24529477 Complaint impersonating “Global News” to remove the article of MakaAngola.
  • [29 Jul 2021] #24685662 Complaint impersonating “TVI” to remove the copy of Esquerda.net.
Fake DMCA request in Luman database (submitted to Google).

To confirm weather Google complied to the fake DMCA requests, we did a Google search for the article “A Monumental Burla do Filho de José Eduardo dos Santos” . This search did not return the original article of Maka Angola. Did Google remove the results as a result of the fake DMCA Complain?

The Google search result of the title of the article, does not show the Maka Angola’s report.

Submission of DMCA Counter Notification Form

Qurium decided to submit a “DMCA Counter Notification Form” in order to oppose the DMCA take-down request submitted by the imposer of Esquerda. Due to the limited space (1,000 characters) to describe the case, we could only present the case briefly, not include any additional questions to Google. The following information was submitted to Google on September 16th 2021:

DMCA Counter Notification

On September 21st 2021, we received this answer from Google, explaining that they had not acted on those DMCA take-down requests.

Google’s answer on the DMCA Counter Notification

Since the response from Google did not match our findings, we wrote back to them asking for clarifications around their internal process for DMCA take-down requests. Unfortunately, we never heard back from Google, and we can therefore not explain how Google handles and verifies take-down requests.

Qurium’s answer to Google’s “removals” team (removals@google.com). The screenshot attached was the very same Google search presented earlier in this article.

Conclusions

The fake DMCA request to EasyDNS was not successful as the domain registrar notified the client for an explanation.

Google’s claims that they did not comply with the fake DMCA request but evidence shows that the Maka Angola was not listed in the search results. However, on September 21 and thereafter, a Google search on the reported URL does list Maka Angola as the first hit. How come?

One possible explanation is that Google removed the URL from their search in June when the take-down request arrived, and brought it back in September after our counter notification.

Another explanation is that Google’s search algorithm is so complex that they can not even understand it themselves. We are certain though, that our clients will be the target of many more fake take-down requests to Google, and we will continue investigating them.