How to Take Down a Corporation's Facebook Page with a Fake Email Account
Interested in a little corporate sabotage? Thanks to a newly-discovered loophole in Facebook's copyright enforcement policies, anyone with an axe to grind can easily take down the Facebook page of a corporation or group. All it takes is a fake email address and a form filled out to Facebook accusing the corporation of misappropriating your copyrighted work on its Facebook page. It doesn't even have to be true. Upon receiving the letter, Facebook will take down the company's Facebook page with little to no verification of the claim and send the page's administrators the following letter:
We have removed or disabled access to the following content that you have posted on Facebook because we received a notice from a third party that the content infringes or otherwise violates their rights:
Fbpage: [xxxx]
We strongly encourage you to review the content you have posted to Facebook to make sure that you have not posted any other infringing content, as it is our policy to terminate the accounts of repeat infringers when appropriate.
If you believe that we have made a mistake in removing this content, then please visit http://www.facebook.com/help/?page=1108 for more information.
The discovery of the loophole comes from Read Write Web's Sarah Perez, who investigated the shutting down of Ars Technica's Facebook Page today. It's a dirty trick and we don't recommend exploiting it but it does demonstrate a flaw in Facebook's administrative policies the company should address. "The social network does not validate the identity of anyone submitting a DMCA takedown notice, nor does it check to see if the report was sent from a legitimate email address," writes Perez. She notes that this has happened to other companies as well, including RedmondPie, Rewriting Technology and Neowin.
RELATED: Is Facebook Turning Us Into Lonely Robots? Or Worse?
In the case of Rewriting Technology, a technology blog based in Pakistan, a scam artist had filed a bogus complaint to Facebook, which promptly shutdown Rewriting Technology's Facebook page. The scam artist then reached out to the site's owner, Hamard Dar, asking for money in exchange for dropping the complaint. Instead, Dar said he would report the scammer to U.S. cyber crime enforcement and it scared him off and the page was returned. When asked why Facebook doesn't verify whether the copyright claim is accurate or even coming from the actual holder of the copyrighted work, the company responded to Perez with the following statement:
When a rights holder properly completes our notice form alleging intellectual property (IP) infringement, we will take appropriate action including removing or disabling access to the relevant content. When we do this, we notify the person who shared the content so he or she can take appropriate action, which may include contacting the reporting party or following up with Facebook.
Submitting an IP notice is no trivial matter. The forms in our Help Center require statements under penalty of perjury, and fraudulent claims are subject to legal process.
Essentially, Facebook is relying on the fear of perjury to prevent people from filing bogus complaints. Perez recommends ways Facebook could improve its system, like rejecting letters from email accounts like Gmail, Hotmail and Yahoo and insisting on corporate email accounts associated with the brand that was infringed upon. That makes sense. What's even worse, page owners who don't have enough money for legal representation often have no recourse because Facebook does not "adjudicate disputes between third parties." Occasionally this results in groups, business or people never getting their pages back. We've written to Facebook asking if this description of their enforcement system is accurate and will report back when they respond.
