Automated backups of my clients websites to cloud storage, who is legally at fault if the backup contains illegal/copyrighted material?

Question

I am currently working on a new backup service for all of my clients, where every day an automated system will take a copy of all of the website files, as well as a copy of the database. This will then be zipped and sent to a cloud storage server such as DigitalOcean, Amazon etc, all under one account which would be owned and paid for by me/my business.

These backups can't be viewed or edited by the client, they are just used to restore a site to a previous state if something goes wrong. The client has access to a control panel on my website where they can click to restore a backup, but they don't have direct access to the files of the backup or the cloud storage itself.

If for whatever reason, one of my clients websites contained illegal images or copyrighted material and the cloud storage system detected this, would I/my business be legally responsible or accountable for them?

If I am, does this mean I'm expected to develop a system that detects these type of files, if so, what if my system fails to detect these files and the cloud storage system doesn't, is that also my fault?

Is there a way that I could explain my system to the law if I was questioned about it, that it's merely backing up my clients website and we don't know what the files contain? I feel like that's not good enough grounds as a defence.

Is there a required practice that I'm unaware of for companies that offer a backup services?

I basically don't want to get screwed over because one of my clients is an idiot.

Answer 1

There are many jurisdictions in the world, and many types of "illegal material", so it is impossible to give a short universal answer. It is most likely that your business would not have liability. The main class of "illegal material" is files that violate copyright protection. A distinction is made between copyings made with clean hands, and those made with dirty hands, in particular when a party knows or should know that the material infringes copyright, that person may be liable. If Smith's hard drive is full of pirated movies, Amazon might trivially be exposed to risk in storing Smith's drive. The provisions of 17 USC 512 a.k.a. DMCA provide immunity to a "service provider" if certain conditions are satisfied. The main conditions are that the transmission of data is automatic, you don't do anything to thwart copy-protection technology, and you have a system for "taking down" allegedly infringing material.

In addition, as I understand your business, you are basically a router that facilitates transmission of data. "Service provider" has two definitions under the law, the narrower one which applies to you in 17 USC 517(k)(1)(A), where your concern is just with subsection (a), Transitory Digital Network Communications. The five conditions that have to be satisfied for immunity are that the transmission is initiated by the user, it is automatic, if you select the recipient, it is done automatically in response to someone else's request, you don't keep copies beyond what is required for the transmission, and you transmit the content unmodified. You should read the details of subsection (a) to see if you qualify (or can make yourself qualify).

§512(c) provides general immunity as would be applicable to the online cloud service. The basic logic of that safe harbor provision the ISP should be unaware of infringing material (not "willfully disregarding", so the question is whether they should know that the material is infringing). Then a person claiming infringement would notify your designated agent (which means you have to have a "designated agent" and you have to make certain information about that agent available). There is a procedure to be followed regarding you getting notice, responding and notifying the user, "taking the material down", the user responding (you may have to put the material back up) and so on. You do not, repeat do not, evaluate the legitimacy of the claims, you just evaluate whether the claims are made in the prescribed form.