Update, 10/16/2019: YouTube has settled its lawsuit against Christopher Brady, with Brady apologizing for his conduct and admitting to sending dozens of false takedowns. Brady will also pay $25,000, which YouTube says it will donate to a nonprofit to be named later.

YouTube has taken a stand against a particularly pernicious copyright troll who was not only abusing the takedown system to remove content but was also using it in an extortion scam. While this gives the weight—and resources—of a large corporation in a fight that will benefit users, it also serves as a reminder of how flawed part of the DMCA is.

The “safe harbor” provision of the DMCA protects platforms like YouTube from liability for copyright infringement done by users. As long as these services do certain things, they cannot be liable for damages. These requirements include having a registered agent to receive copyright complaints, promptly removing content after receiving a complaint, a counter-notice system where the person who’s content has been removed can get it back up, and—most at issue in YouTube’s case—a way to deal with “repeat” infringers.

YouTube’s way of fulfilling that last requirement is its copyright strikes system. Getting DMCA complaints filed against you means accumulating strikes. If an account accumulates three strikes at once, YouTube will terminate the account and remove all of the videos. People who make their living through their videos, and have worked hard to build an audience there, will suddenly find their lives ruined. Unsurprisingly, videomakers will go to a lot of effort to avoid getting strikes.

In this case, YouTube v. Brady, Christopher Brady is alleged to have filed false DMCA claims—claiming he either owned things he did not or claiming videos were infringing that were not. That alone is prohibited by the DMCA, which requires the person sending the takedown to affirm that they either own the work or are an agent of the owner and that the notice is being sent in good faith—that is, that they actually believe it is infringement. Someone who thinks a video is fair use but doesn’t like what it’s saying is not allowed to send a DMCA claim. And people who send DMCA claims can’t pretend that fair use rights don’t exist—they have to consider whether the uploader may have been protected by fair use.

Brady’s scheme is also alleged to go further than false claims. Brady apparently sent messages to the people he filed claims against, promising to withdraw the claims in exchange for money. For those targeted, going along with it might seem better than chancing ending up with a copyright strike. Under YouTube’s system, strikes only go away if they are withdrawn, after 90 days and completion of “copyright school,” or going through the DMCA’s counter-notification requirement. And counter-notifications can be quite intimidating, as they require users to turn over identifying information. Plus, resolving a situation this way can take a lot of time, during which YouTubers can’t upload or monetize their existing videos. Three strikes can cause YouTube to suspend a person’s account, which can be a serious blow to YouTubers’ livelihoods.

YouTube claims that Brady not only filed false notices, not only extorted users, but also abused the personal information contained in the counter-notices.

According to YouTube’s complaint [pdf], shortly after of the users Brady targeted did the thing they are supposed to do in the face of a bogus claim—send a counter-notice—they were swatted. (Swatting is harassment technique that consists of calling in a fake emergency to 911, resulting in a large number of police officers, often with guns drawn, showing up to the target’s home.) In other words, it’s suspected that Brady was able to swat someone only because of the information contained in the counter-notice. Personal information from a counter-notice being used for harassment purposes even further disincentivizes people from taking advantage of their legal right to respond to bad takedowns. And counter-notices have been shown to be fairly rare.

DMCA abuse is not a new problem, obviously. EFF has long documented and fought instances where takedown notices were sent erroneously, misused to silence criticism, or using a process, automated or otherwise, that doesn’t take fair use into account. And then there are complaints from copyright holders of improper counter-notices [pdf] and cases of counter-notices being in likewise bad faith or, frustrating the ability of the rightsholder to sue.

There’s a provision of the DMCA that’s supposed to provide a disincentive for abuse. It’s section 512(f). This is the basis for YouTube’s lawsuit.

If someone knowingly misrepresents information in a notice or counter-notice, 512(f) allows the sender of the notice, the receiver of the notice, or the service provider to sue, if they’ve been injured. Successful 512(f) suits, on behalf of people who have received bogus notices or bogus counter-notices, are thin on the ground. Ones by service providers? Basically nonexistent.

YouTube makes clear that trying to investigate and stop the abuse of the DMCA by Brady cost it “substantial” sums. Moreover, some of the DMCA claims were filed under false identities, making it even hard for YouTube to track that they were coming from a troll, impeding its ability to put a stop to future abuses.

While the YouTubers that Brady may have targeted don’t have the resources to go to court, YouTube does. It’s taking a stand against the worst kind of abuse a copyright troll can do.

However, for small creators, it’s hard to fund this kind of lawsuit. Unlike copyright holders claiming infringement, who can receive automatic “statutory damages,” people defending against takedown abuse have to prove the extent of their harm. Therefore, whether 512(f) is an effective deterrent is very much up for debate. YouTube is going after someone who isn’t simply alleged to have used the DMCA to take down a legal video they don’t like. The extortion and harassment elevate this case, and it’s great to see YouTube standing up for its users in court. But, 512(f) needs to have real teeth and real enforcement, not just for extreme cases, but the more typical abuse cases. Until it does, it’s not working as intended.