Deep Linking Legal in Germany

BlueWonder writes "German news site Heise Online reports a recent decision of the Bundesgerichtshof, the highest court in Germany: Deep linking is not illegal. Newspaper company Verlagsgruppe Handelsblatt had sued the news search engine Paperboy for deep linking to their articles. According to the Bundesgerichtshof, the public interest in a well-working Internet takes precedence over the commercial interests of the newspaper company, even if the advertizing of the company is bypassed. The Bundesgerichtshof has clarified that users can access any page if they know the URL, and deep linking is just a technical simplification for entering the URL manually. (Warning: links go to German sites - use the fish...)"

Comments

Why all the fuss?

[Stackster]

If a site doesn't want anyone to "deep link" to them, why not just check the HTTP_REFERER HTTP header, and send those requests that come frome a "deep link" (anything outside their own site, probably) to the front page?
Sure, you can set your own referer header and fool such things, but "ordinary users" wouldn't bother doing that.

(Or do Big Evil Compaines always try to take legal action first, and if that fails, go for a technical solution?)

Re:Why all the fuss?

[janda]

Well, most larger companies hire their own laywers, they might as well keep them busy...

Seriously, I think this is (mostly) another example of the marketing department doing the design work, and not understanding the technology. Then, when they find out that people can bypass their ads, they talk to the programmers.

The programmers tell them that this is the way the protocol is supposed to work, so there's no real way around it without recoding everything to use cookies, registration, headers, and other stuff, which will make the marketing department look bad for not giving good requirements in the first place.

It will make the marketing department look even worse if the programmers said it should be done with cookies, headers, etc and the marketing department did the "we don't have time" routine.

So, drag them to court first.

Note: You can substitute any department/person for "marketing" here, I'm just using them as an example from personal experience.

Re:Why all the fuss?

[SCY.tSCc.]

If a site doesn't want anyone to "deep link" to them, why not just check the HTTP_REFERER HTTP header, and send those requests that come frome a "deep link"

Unfortunally, that approach is inherently flawed. Some proxies remove the HTTP_REFERER header or change it to something else (ever seen those XXX_REFERER removed by SoftwareXYZ in your logs?).

In addition, caches (built into your browser or proxy) in general might get confused by different content that comes with the same URL because it depends upon the HTTP_REFERER header.

bye,
Settel

Re:Why all the fuss?

[JimDabell]

Some proxies remove the HTTP_REFERER header or change it to something else (ever seen those XXX_REFERER removed by SoftwareXYZ in your logs?).

As far as I am aware, no software spoofs the Referer header by changing it to another URI. So simply block the people whose referring URI begins with 'http://' and does not come from your domain. Log the ones you block, and whenever any new ones come up, send an email to the webmaster. If a new "privacy enhancer" or whatever appears that does spoof the referrer with a false URI, simply exempt those from your checks.

Remember, you aren't aiming to catch everybody who may possibly come from elsewhere, you are just making it unlikely anyone will deep-link to you.

In addition, caches (built into your browser or proxy) in general might get confused by different content that comes with the same URL because it depends upon the HTTP_REFERER header.

Not if you send a Vary header. Anything that gets confused by multiple objects available at the same URI when a Vary header is present is deeply broken, and will break in lots of different ways on lots of different sites.

Re:Why all the fuss?

[i_really_dont_care]

There are a bunch of other possibilities to avoid "deep linking", for example by using dynamic content. I assume, they are already using cookies or session IDs to track their users. The same technology can be used to assure that a user has to view the main page before a subpage can be shown.

It's also important to note that the ruling was about deep linking "per se" and not about accessing content that is protected. The press text reads:

"Ein Berechtigter, der ein urheberrechtlich geschütztes Werk ohne technische Schutzmaßnahmen im Internet öffentlich zugänglich mache, ermögliche dadurch bereits selbst die Nutzungen [...]."

Which means (sorry for my bad English, emphasis mine):

"A benificiary who publicy publishes a copyrighted work without technical protection on the Internet, thereby already permits its use [...].

This makes perfect sense for me.

Please consider

[BlueTrin]

arresting Google, they provide deep-linking and even CACHE !!!

Oh wait ... you are too lazy to put a robots.txt in your root ?

And in Denmark

[Snaller]

...it was ruled illegal. Because they said, because of EU rules. Which of the countries will have to change?