A deficient notice attempting to trigger c.1.C doesn't get to use c.1.A as a fallback. This is guaranteed by c.3.B:
> [...] a notification from a copyright owner or from a person authorized to act on behalf of the copyright owner that fails to comply substantially with the provisions of subparagraph (A) shall not be considered under paragraph (1)(A) in determining whether a service provider has actual knowledge or is aware of facts or circumstances from which infringing activity is apparent.
Additionally, you say:
> Also note that the infringed and infringing material are to be specified separately (c.3.a.ii,iii). In this case, the infringed material is a list of movies owned by the claimant that are distributed via PopcornTime. The infringing material is the PopcornTime software itself.
Contributory liability for infringement is not the same as the infringement itself. PopcornTime software does not include any of the movies (or portions thereof) owned by the studios complaining. PopcornTime software itself is not an infringing work on those movie copyrights. It is a tool intended to be used to commit infringement, so they will get in trouble when this goes to court, but it's a different kind of trouble from direct infringement.
Consider this thought experiment: PopcornTime points users to a site that lists torrents of movies. If that's the same thing as infringing on the movie copyright itself, then PopcornTime infringes on every movie listed on that site, provided a PopcornTime user has at some point actually followed the links. Now let's assume PopcornTime development halts, but Hollywood carries on and a new movie is added to the site PopcornTime links to. Now PopcornTime is infringing on another copyright despite the PopcornTime software work not changing, and that movie copyright actually post-dates PopcornTime.
If that’s the case, then a notice based on a theory of contributory infringement should be legitimate. If it isn’t, service providers are potentially liable for contributory infringement of which they were not aware, and will thus need to preemtively evaluate content they are hosting to detect that situation.
Two asides: iTunes is a contributory infringer in the UK as format shifting is not allowed here.
A similar situation to that you describe does arise in Germany, IIRC. The law was changed (last year?) to make hosting of software that is intended for criminal activity to be a crime itself.
There was a flurry of interest at the time, and I'm not sure if the German government followed through. But, that would make GitHub potentially liable for hosting "nefarious" applications (and with no safe harbour arrangements, AFAIR).
> Anyone who violates any of the exclusive rights of the copyright owner as provided by sections 106 through 122 or of the author as provided in section 106A(a), or who imports copies or phonorecords into the United States in violation of section 602, is an infringer of the copyright or right of the author, as the case may be.
( https://www.law.cornell.edu/uscode/text/17/501 )
At least one of the following exclusive rights have to be violated:
> (1) to reproduce the copyrighted work in copies or phonorecords;
> (2) to prepare derivative works based upon the copyrighted work;
> (3) to distribute copies or phonorecords of the copyrighted work to the public by sale or other transfer of ownership, or by rental, lease, or lending;
> (4) in the case of literary, musical, dramatic, and choreographic works, pantomimes, and motion pictures and other audiovisual works, to perform the copyrighted work publicly;
> (5) in the case of literary, musical, dramatic, and choreographic works, pantomimes, and pictorial, graphic, or sculptural works, including the individual images of a motion picture or other audiovisual work, to display the copyrighted work publicly; and
> (6) in the case of sound recordings, to perform the copyrighted work publicly by means of a digital audio transmission.
( https://www.law.cornell.edu/uscode/text/17/106 )
Contributory infringement isn't listed.
The Supreme Court held in the Grokster case:
>[...] One infringes contributorily by intentionally inducing or encouraging direct infringement, and infringes vicariously by profiting from direct infringement while declining to exercise the right to stop or limit it. Although “[t]he Copyright Act does not expressly render anyone liable for [another’s] infringement,” Sony, 464 U.S., at 434, these secondary liability doctrines emerged from common law principles and are well established in the law
( https://www.law.cornell.edu/supct/html/04-480.ZS.html )
So I don't think it is justified to say that contributory infringement is covered by the statutory DMCA takedown notice procedure, and if it is justified, the source would be a court precedent from the past 15 years which we haven't found yet.
Back to the question of the validity of this particular DMCA takedown notice: None of the works or actions found at the GitHub URLs in the complaint were movies. Nobody was performing a movie at the GitHub URL for a JS source code file. None of those files were a reproduction of a movie, in whole or in part. The only action happening at those particular URLs was public display and distribution of files, and the thing being publicly displayed at each of those URLs was JS source code, which is not a match for the works that the studios claimed ownership of. This DMCA complaint does not provide "information reasonably sufficient to permit" GitHub to find movie piracy on GitHub, unless the studio wants to claim that the source code is a rip-off inspired by something out of a movie. But if that were the case, they could have been a lot more specific about which movie.
GitHub is probably safe regardless. But the studios will only win a lawsuit by making a substantially different claim from the claim that the JS code is infringing on multiple movies.
The whole clause reads "Identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed or access to which is to be disabled, and information reasonably sufficient to permit the service provider to locate the material."
The material that the claimant alleges is in violation of copyright law is clearly identified in a way that allows GitHub to locate it. The theory under which it is in violation may be dubious, but it's not GitHub's responsibility to evaluate whether this claim has any merit -- that's the court's job.
That is extremely good to know; I hadn’t spotted that provision while skimming through things. I still believe that this was a non-deficient notice, though. Shall we take a look at the required elements as they apply here?
(i) A physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.
The MPA claims to be authorized to act on behalf of the listed movie studios. I see no reason to suspect this claim, and presume the redacted signaturesvare legitimate.
(ii) Identification of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works at that site.
Exhibit A (redacted) contains the titles and presumably other identifying information of movies owned by the studios represented by the MPA that are allegedly infringed by the Popcorn Time software.
(iii) Identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed or access to which is to be disabled, and information reasonably sufficient to permit the service provider to locate the material.
Two specifc GitHub repositories are specifically identified by URL, and further clarified by the statement “ Our request is specifically aimed at the aforementioned repositories and does not concern any other related repositories.” Though not required, they provide some justification as to why they believe these repositories infringe their copyrights in the listed movies.
(iv) Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number, and, if available, an electronic mail address at which the complaining party may be contacted.
This is presumably contained in the redacted signature block at the bottom of the notice.
(v) A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law
“ We are providing this notice based on our good faith belief that the use of motion pictures and television programs owned by the MPA Member Studios in the manner occurring via the Project is not authorized by the copyright owners, their agents, or the law.”
(vi) A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.
“The information in this notification is accurate and, under penalty of perjury, we are authorized to act on behalf of the MPA Member Studios, which own or control exclusive rights under copyright that are being infringed in the manner described herein.”
My (possibly incorrect) interpretation of this is that notices of the form described in c.3 represent a sufficient de jure form of providing the information in c.1.A.iii that would void immunity if not acted upon. Other means of providing this information to the service provider also require them to act, but will need to be examined on a case-by-case basis in court.
Also note that the infringed and infringing material are to be specified separately (c.3.a.ii,iii). In this case, the infringed material is a list of movies owned by the claimant that are distributed via PopcornTime. The infringing material is the PopcornTime software itself.
Though they needn’t cite anything to justify their “good-faith belief” that the software itself is in violation of copyright law wrt. their IP, nothing prevents such a statement being present, either.