The eco Association supports the DNS resolver Quad9 in its legal dispute against Sony. In this interview Klaus Landefeld, member of the eco board, explains why.
Quad9 vs. Sony – what has this case been about since it first went before the Hamburg Regional Court in May 2021?
Landefeld: Basically, it’s once again about ‘Störerhaftung’, a legal construct that only exists in Germany that translates into English as ‘interference liability’ or, alternately, as ‘liability as a co-liable partner’. We are already familiar with this. In the case of WiFi use, content providers wanted to make a claim against access providers because they grant people access to the Internet, which they then use to download films or music illegally from the Internet. The case is similar here, but instead of a provider, Quad9, a so-called DNS resolver, was targeted. Sony had Quad9 prohibited by injunction from resolving a domain name into an IP address so that a website, which in turn contains links to copyright-protected content, can no longer be accessed.
Quad9 is the operator of an open, recursive DNS resolver. What kind of service is it, and how does it differ from other, similar offerings?
Landefeld: Quad9 is a foundation in Switzerland and a service that is part of the Internet infrastructure. You need these DNS resolvers to make the Internet work. Recursive DNS queries are standard queries from users or from DNS servers. These services resolve DNS names to IP addresses. A typical example of such a standard request is calling up a URL such as www.eco.de in the address line of a browser. Simply put, DNS resolvers are the address books of the Internet that translate Internet addresses into IP addresses in the browser and thus guide users to the right website.
Unlike the access providers, however, the DNS resolvers never know where the requests come from. Local access providers, on the other hand, for example in Germany, know exactly where their customers are located. Therefore, they can be sure that German law is also applicable here. And if a German authority, such as the German Federal Network Agency (BNetzA), has agreed to block certain Internet addresses, they can do so. An independent resolver like Quad9 can barely distinguish technically where in the world the request comes from and what the legal situation is in that country, i.e., whether it is allowed to resolve the DNS request or not. Quad9 must, therefore, expend considerable effort to implement the requirements of the preliminary injunction.
On 30 November 2021, the Hamburg Regional Court rejected Quad9’s appeal against an interim injunction issued last May. How did the Regional Court justify its decision?
Landefeld: The Hamburg Regional Court’s reasoning for upholding the injunction is very interesting. Quad9 had argued that in order to implement the blocking request, they would have to carry out a resource-intensive geolocation to check where the users of their service come from in order to then apply the injunction to users from Germany. The Regional Court simply ignores all related technical issues completely, arguing that Quad9 could avoid higher costs if the resolver would simply apply German law globally and block the site worldwide. The costly procedure of geolocalisation would not be necessary. This is a very interesting argument. Quad9 is not a standard resolver that is provided to end customers pre-configured by their access providers. In order to be able to use Quad9 as a resolver service, Sony had to manually enter it in order to even achieve resolution of this website.
Likewise, users can, of course, also manually configure other resolver services to bypass locks. A block on Quad9 is of no use if thousands of other DNS resolvers, such as Google, Cloudflare or OpenDNS, continue to resolve the domain. For the higher courts, the point just mentioned, which the Hamburg Regional Court considers not to be relevant, is certainly very exciting.
If the blocking of an Internet address is to be ordered by a court, then this blocking must also be effective. They cannot demand this great technical effort from Quad9 if the hoped-for effect for Sony is practically non-existent. The regional court sees it differently, because some users, namely those who use Quad9, would be denied access to the domain and the website behind it. However, the court considers it irrelevant that users can simply use other services. The block is effective for users who do not change the service and, moreover, the offer would no longer be accessible if all DNS resolver operators blocked the address.
We consider this argumentation to be completely misguided. After all, you have to consider what the legislator wants. And here, analogous to WiFi interference liability, the political goal is that basic Internet services, such as access providers and DNS resolvers, should have privileged liability. They do not hold content on their infrastructure and do not act on behalf of the content provider, but merely provide access. However, the court does not consider Quad9 to be an operator of a telemedia service, so it does not apply the liability privileges set out there. If Quad9 were treated like an access provider, then there would be no ‘Stoererhaftung’ (interference liability) at all.
The district court points out that the government would have to take action if it wanted to extend the privilege with regard to ‘Stoererhaftung’ (interference liability) to DNS resolvers. This is presumably what the politicians will do. This has not yet been implemented in German law, but there are already plans at EU level to do so within the framework of the Digital Services Act.
Sony is exploiting this loophole in combination with the abstruse construct of ‘Stoererhaftung’ (interference liability) in order to attack basic services. Historically, however, DNS resolvers have been around not just for a few years, but for as long as DNS has existed. It’s more or less an embedded service that access providers offer to their customers on the basis of technical necessity as part of Internet access in order to be able to use the Internet (WWW, email, etc.). It did not occur to anyone that these services need to be privileged at all. However, DNS resolvers must also be privileged as independent services, otherwise no one would want to provide these services, which are actually fundamental to the functioning of the Internet. At the same time, it is not possible to casually check millions of domains to see whether they point to legal or illegal content.
Quad9 will take legal action against the decision. What do you expect from this next step?
Landefeld: The Hamburg Regional Court has repeatedly attracted attention in the past with very rights-holder-friendly rulings. I assume that no other court in Germany would go so far as to extend ‘Stoererhaftung’ (interference liability) to DNS resolvers. Quad9 will take action against the decision, because the ruling directly endangers their business model. It is simply not reasonable that DNS resolvers have to comply with all claims of rights holders and block domains globally. One must also consider that Quad9 is a service that users are allowed to use for free and that also has no revenue. This foundation cannot do that and must fight back.
That is why we, the eco Association, and other organisations are supporting Quad9 in this legal battle. The problem Quad9 is facing concerns the entire industry. Internet services should not be held liable for things that have nothing at all to do with the disputed service: Quad9 does not host the content, does not give access, and has no other business relationship with the disputed website. The only thing they do is translate a call to a domain name into a machine-readable IP address. To deduce from this that Quad9 would be elementarily involved in the provision of illegal content is not in any way reasonable from the point of view of the eco Association.
In addition, the liability privilege of the access provider under the German Telemedia Act (TMG) would be undermined. Rights holders could simply make claims against liability-privileged access providers in their capacity as operators of DNS resolvers – after all, every access provider is also an operator of DNS resolvers.
We should do more to ensure that illegal content is actually deleted and disappears from the Internet. Rights holders have a legitimate interest in this, which no one wants to deny them. However, they should enforce their rights in the right place. Intermediaries like DNS resolvers are the wrong contacts. Since the concept of ‘Stoererhaftung’ (interference liability) only exists in Germany, German courts would have to deal with thousands of international cases. It is also unrealistic to enforce blocking worldwide via the auxiliary construct of ‘German law’.
A number of organisations are supporting Quad9 in the proceedings. Who are the supporters and why?
Landefeld: In addition to the eco Association, which wants to avert a threat to the entire interplay of actors in the industry, the supporters also include the Gesellschaft für Freiheitsrechte (GFF – Society for Civil Liberties). The GFF sees the case from the user’s point of view: services that actually protect users and are elementary for them must not be held liable in this way. Quad9 offers its users protection against malware in addition to DNS resolution. The Hamburg Regional Court even interprets this security service negatively for the users. Since Quad9 can block websites with cyber threats, this service could also be applied to websites with copyright infringements. The GFF defends itself against this argumentation, since copyright infringements and malware cannot be equated at this point. Quad9 takes sources of malware unchecked from third-party organisations such as CERTS, but has no way of determining whether rights are being violated on any given website.
The Internet thrives on services working together, links working, and data and content being connected. If infrastructure providers have to worry about being hit with claims and lawsuits, which are also associated with costs, this would tear the market apart. According to German ‘Stoererhaftung’ (interference liability), after the first “free” notice, warning costs must also be borne by the person being warned. The consequence would certainly be that many small providers would simply block offers unchecked in order to avoid a cost risk or would discontinue their service because the risk is too high for them. Such a culture of blocking Internet content in anticipatory obedience without a legal basis must be prevented.
Mr Landefeld, thank you for the interview.
