American nonprofit OCLC is known globally for its leading database of bibliographic records, WorldCat. A few months ago, many of these records were posted publicly by the shadow library search engine, Anna's Archive. OCLC believes that this is the result of a year-long hack and, with a lawsuit filed at an Ohio federal court, it demands damages.
WorldCat Sues Anna’s Archive
It is no secret that publishers fiercely oppose the search engine’s stated goals. The same also applies to OCLC, which has now elevated its concerns into a full-blown lawsuit, filed this month at a federal court in Ohio.
The complaint accuses Washington citizen Maria Dolores Anasztasia Matienzo and several “John Does” of operating the search engine and scraping WorldCat data. The scraping is equated to a cyberattack by OCLC and started around the time Anna’s Archive launched.
“Beginning in the fall of 2022, OCLC began experiencing cyberattacks on WorldCat.org and OCLC’s servers that significantly affected the speed and operations of WorldCat.org, other OCLC products and services, and OCLC’s servers and network infrastructure,” OCLC’s complaint notes.
“These attacks continued throughout the following year, forcing OCLC to devote significant time and resources toward non-routine network infrastructure enhancements, maintenance, and troubleshooting.”
The non-profit says that it spent roughly $68 million over the past two years developing and enhancing WorldCat records, which are an essential part of its operation. Having a copy of the data publicly available through Anna’s Archive is a direct threat to its business.
OCLC claims that Anna’s Archive unmasked itself as the “perpetrator of the attacks on WorldCat.org” when it publicly announced its scraping effort. This includes a detailed blog post the operators published on the matter, encouraging the public to use the scraped data.
In addition to harvesting data from WorldCat.org, the defendants are also accused of obtaining and using credentials of a member library to access WorldCat Discovery Services. This opened the door to yet more detailed records that are not available on WorldCat.org.
OCLC says that it spent significant time and resources to address the ‘attacks’ on its systems.
“These hacking attacks materially affected OCLC’s production systems and servers, requiring around-the-clock efforts from November 2022 to March 2023 to attempt to limit service outages and maintain the production systems’ performance for customers.
“To respond to these ongoing attacks, OCLC spent over 1.4 million dollars on its systems’ infrastructure and devoted nearly 10,000 employee hours to the same,” the complaint adds.
Honest question: if you connect to say an FTP server, and there's no dialog claiming a EULA, would you be bound by one?
I don't know how they got the data, but the whole EULA thing would rely on there being proof Anna agreed to one, right? That seems a bit tricky. As for "unauthorized access", if a path is available, and Anna used it, again with no warnings, where's the legal line?
Having been in civil court a few times, judges will ask people "do you have a document proving there was an agreement?", over any circumstance that could be misconstrued, or is a verbal claim.
No doc, verbal claim is dismissed unless other party admits to the verbal claim in court, to the judge.
Just seems to me EULAs are terribly hard to enforce.
Again, I'm more thinking out loud. I have no idea how these cases tend to proceed.
That is going to depend on what type of access the ftp server allows. If it's anonymous then I would argue that no, you cannot be bound by a EULA if no dialog is presented. But the article mentions "In addition to harvesting data from WorldCat.org, the defendants are also accused of obtaining and using credentials of a member library to access WorldCat Discovery Services." Now it's just my speculation, but if they used someone else's id to scrape the data, then WorldCat can just produce any documents that id agreed to, and it will apply here. Sounds like they done goofed.
I think that would depend on how intentional the open port was.
If it's something there and advertised, even if mentioned in one place in some archaic document, they'd probably be fine just for accessing it.
Though that would only absolve them of acquisition issues. If they're using someone else's work for profit, there is almost certainly enough room for the lawsuit.
Only a select few licenses even allow for open and unrestricted commercial use. Especially if the data itself is the licensed thing, since valuable data is far easier to convert than something like source code.
You are generally required to put up unauthorized access warnings.
Similar to how you have to post "no trespassing" signs if you don't want to be trespassed.
That's not true. Trespass works like that because big corporations don't get trespassed much, but they lobbied for copyright to be automatic.