Judge orders Google to hand over IP addresses of all YouTube users

A New York judge this week has ordered Google to hand over the IP addresses of all YouTube users to Viacom. In a 25 page ruling with good and bad news for both Google and Viacom, the judge concluded:

"(1) The cross-motion for a protective order
barring disclosure of the source code for the
YouTube.com search function is granted, and the
motion to compel production of that search code is
denied;
(2) The motion to compel production of the
source code for the Video ID program is denied;
(3) The motion to compel production of all
removed videos is granted;
(4) The motion to compel production of all data
from the Logging database concerning each time a
YouTube video has been viewed on the YouTube website
or through embedding on a third-party website is
granted;
(5) The motion to compel production of those
data fields which defendants have agreed t o produce
for works-in-suit, for all videos that have been posted
to the YouTube website is denied;
(6) The motion t o compel production of the
schema for the Google Advertising database is
denied ;
(7) The motion to compel production of the
schema for the Google Video Content database is
granted; and
(8) The motion to compel production of the
private videos and data related to them is denied at
this time except to the extent it seeks production
of specified non-content data about such videos ."

The EFF are appalled at the ruling, particularly item (4) and are claiming it:

"erroneously ignores the protections of the federal Video Privacy Protection Act (VPPA), and threatens to expose deeply private information about what videos are watched by YouTube users. The VPPA passed after a newspaper disclosed Supreme Court nominee Robert Bork's video rental records. As Congress recognized, your selection of videos to watch is deeply personal and deserves the strongest protection...

The VPPA protects “personally identifiable information,” which is defined to include “information which identifies a person as having requested or obtained specific video materials or services.” This is exactly what is in the Logging database.

Accordingly, pursuant to this federal law, the Court may not order the production of “personally identifiable information”:

in a civil proceeding [except] upon a showing of compelling need for the information that cannot be accommodated by any other means, if—

(i) the consumer is given reasonable notice, by the person seeking the disclosure, of the court proceeding relevant to the issuance of the court order; and
(ii) the consumer is afforded the opportunity to appear and contest the claim of the person seeking the disclosure.

Today’s court order made no finding that Viacom could not be accommodated by any other means, nor were the YouTube users provided with notice and an opportunity to contest the claim...

In any event, the court ordered production of not just IP addresses, but also all the associated information in the Logging database. Whatever might be said about 'an IP address without additional information,' the the AOL search history leak fiasco shows that the material viewed by a user alone can be sufficient to identify the user, even with neither a login nor an IP address.

The Court's erroneous ruling is a set-back to privacy rights, and will allow Viacom to see what you are watching on YouTube. We urge Viacom to back off this overbroad request and Google to take all steps necessary to challenge this order and protect the rights of its users."

Thanks to Glyn at ORG for the alert via the Wired blog.

Update: The Lib Dems have noticed the judgment and expressed concern.