This is a post-Mortem of the DMCA takedown notice that hit Gadgetbridge in June 2017, written by two core developers of the project.

First things first: We would like to thank all the people who sent us their support via mail, social networks, chat and other means.

As everyone does in this case, let's start with the:

tl;dr: We were surprised to have been hit by a DMCA takedown notice on Github. We decided to file a counter notice because we stand firm in our belief that no content in our repository ever violated US or EU laws including but not limited to the DMCA. We are happy the project is back online and available for the community.

Reaching the conclusion of the story was an interesting journey that we would like to share with our supporters. We also learned a lot in the process, and we would like to share our experience in the spirit of open knowledge that always permeated Gadgetbridge.

About us

We are three persons spread across Europe: each with his own job, family and hobbies. We share a passion for solving problems and strive to keep our "digital footsteps" as private as possible: hence we never quite liked the fact of being forced to rely on services outside of our control to manage our personal devices. That's why Gadgetbridge was started in January 2015 and that's why it attracted two more core developers and many contributors to the source code, the graphical assets and the documentation (wiki).

We were not expecting this

The whole Gadgetbridge project - code, communication and documentation - has always been in the open and publicly accessible: hence we were assuming that also criticism would have been disclosed, discussed and solved in the open. Instead the copyright holder of a third party app (that supports a subset of the devices supported by Gadgetbridge) felt that our work was in violation of his IP and filed a DMCA takedown notice to Github. For reasons inexplicable to us, despite the takedown notice containing only references to content posted to our issue tracker, it included the main repository URL among the problematic URLs. This fact triggers a peculiar behavior in the way Github addresses the notice, namely the immediate shutdown of the whole repository (code, issues, wiki, etc.) for the public and for the owners. In other words the Github DMCA takedown process - if the notice targets the whole repository - leaves no place to confrontation: it's a sword of Damocles stealthily hanging over your head.

The Gadgetbridge repository was closed in the early morning of Saturday June 3rd.

Now what?!?

After the takedown notice hits, you can't do anything but file an official counter notice to Github. Some of us core developers and some of our users tried to contact Github support to signal that the takedown of the whole repository was possibly an error, receiving only standard replies back: we believe that once the takedown process is initiated, the "normal" support isn't able to do anything; for sure it didn't in our case.

If you want your repository back you have to go through the filing of a counter notice. Before taking this step Github advises to get in touch with an lawyer, and since one of the prerequisites is consenting to the jurisdiction of a US Federal Court we took that advice very seriously: we are (fortunately) not familiar with courts and laws, on either side of the pond.

Our reactions, others' reactions

We had - and still have - a clear conscience and while we were looking for legal advice we were also reaching out publicly - on twitter and reddit - to explain why we thought that takedown was exaggerate and also highlighted that who initiates a takedown notice can also send a retraction to Github. Meanwhile already several people reached out to us via mail offering support and financial help for handling this situation. In the next days our case was mentioned as "Another Good Reason not to use Github" and also a big German news site wrote about it.

We were fortunate enough to get the help of a very competent lawyer in a timely manner (first contact was established during the weekend) and we were reassured by him that our feeling of clear conscience was indeed backed by hard facts, and we could proceed with the counter notice. So we decided to proceed.

Filing the counter notice

We read carefully the guide provided by Github and prepared the contents of the counter notice together with the lawyer, the result was submitted by our lawyer at first using the web form provided by Github. Apart for a confirmation message, we didn't get any further acknowledgment.

A few days later - not having heard anything back - our lawyer submitted the counter notice again, via mail. This time an email reply came back, stating that personal information of at least one of the repository owners must be included in the counter notice. We didn't do it in the first place given the following passage of the guide:

If you are concerned about your privacy, you may have a lawyer or other legal representative file the counter notice on your behalf.

We agreed upon adding the contact information of one of us in order to speed up the process, despite the text cited above. The amended version was promptly submitted. One week later, not having heard anything back, we reached out to Github to understand if things were somehow progressing or if there were other issues in processing out counter notice. We had to wait a couple of days before getting an acknowledgment.

Fast forward to June 27 when the counternotice was published in the DMCA repository on Github. At the same time we received a reply from Github to our mails, where they basically announced to us that the counter notice was published.

The repository is available again

After 10 business days the repository was suddenly made available again without further notices from Github. As we agreed to the removal of the issues mentioned in the takedown notice despite there is no copyright infringement involved we closed the issue tracker as soon as we got access, this way we can check if Github cleaned the offending URLs or if we should do it. The issue tracker will be re-opened again as soon as this check has been completed.

We were also surprised because almost immediately upon its availability some Pull Requests were submitted to the repository. We believe this is quite telling on how strong and motivated the community around the project is.

The future

In the few weeks when our repository was unavailable we thought about future scenarios: on the one hand we could have moved our code anytime anywhere (the code was actually safe on each of the developers' machines) on the other hand we realized how much value the metadata of the project is worth. In two and a half years a lot of knowledge was put in our wiki by various contributors, same for the discussions that took place in the issues / pull requests. Github is a valuable resource for free software projects, because it allows to reach a huge community and provides useful tools. We underestimated the "lock-in" effect though.

We are currently establishing an online presence that goes beyond Github, without requiring too much efforts to be maintained. So far we have set up:

• a static homepage available under https://gadgetbridge.org (which is an automatically updated copy of the project's README.md file)
• the blog you are currently reading: https://blog.freeyourgadget.org (where content is manually written, hence could be updated less often)
• automatic procedures to back up the entire content of our Github repository (this includes the wiki, issues and pull requests) thanks to the great github-backup tool

We also contacted some git hosting providers outside of the U.S.: we neglected the distributed nature of git by relying on a single hosting provider and we intend to act differently in the future. More details will follow.

We also realized how vulnerable a small free software project maintained by few individuals in their free time could be: we contacted a variety of free software organizations - from a very local level to Europe-wide - and have found great support in them. There are so-called umbrella organizations which take care also of the legal side of free software development, including enforcing the source code license and representing a project in courts. Also to this end more details will follow.

You can reach the core developers via mail at all [at) freeyourgadget·org if you have questions, suggestions or criticism. (yes, the address is formatted weirdly but a human should be able to parse it)

Lessons learned

• Despite the wording, when a Github repository is closed due to a DMCA takedown notice, the access is not only disabled for the public, but also for the owners.
• The counter notice is processed by Github internally without giving any information about its progress: you submit the counternotice and wait - in our case 12 days - until it's public.
• Github does not give visibility to a submitted counter notice on the repository, only the original takedown notice will be linked from the repository until it opens again.
• At the end of the 10-business-days window, it's best to monitor the repository constantly, as it will be opened again without any notice. This is true especially if some content must be removed.
• A local copy of the whole repository is invaluable, even though every developer has the full history of the code base there is so much more to keep a backup of. There are free software tools that make this easy and there's no reason to not be using those.

Timeline of the events and reactions

• June 3rd: Takedown notice published, access to repository disabled
• June 6th: First version of the counter notice drafted together with the lawyer
• June 7th: A blog post by Adam Hide is published
• June 8th: Web submission of the counter notice
• June 12th: Email submission of the same counter notice due to lack of feedback from Github
• June 13th: An article in German about our case is published
• June 14th: Email reply from Github: the counter notice must contain the details of one of the owners
• June 15th: Email submission of the amended counter notice
• June 20th: A podcast in Spanish about our case is published
• June 27th: Counter notice published
• July 11th: Gadgetbridge repository opens again
• July 12th: Post-Mortem published