Who owns a post? Intellectual property, data ownership and content licensing on Steemit

TLDR

1. Every Internet company wants data about you, and the data you create.
2. If you agree to use their service you are invariably losing control of this data.
3. Steemit does not modify your native IP rights, and will defend as required by law.
4. The blockchain however does not inherently respect data ownership, though it may be a useful record.
5. Steemit does collect information on and about users which becomes its property, as is standard practice today.
6. My personal request is that Steemit, Inc. limit their data capture on user habits, etc. and anonymise it where they do, particularly by striping IP addresses and usernames from logs.

But if you want the details, read on! 🤓 🤓 🤓

Foreward

It's often not easy to get the most out of Internet services while protecting your information. And it's always a compromise. On Steemit, the compromise is different than on other social media platforms and this is what is investigated in this article.

Steemit uses a different paradigm than other platforms in that it does not actually control the information database, i.e. the STEEM blockchain, rather it accesses it in a read / write capacity. Thus the usual licensing requests, and protections, are different.

You can never be absolutely certain your information is only accessible to those whom you explicitly give that permission to if you allow Internet services to process and store your data, even with privacy settings. Other social networks rely on the familiar ideas of digital rights management, and access permissions. These do not exist on Steemit, though there is a benefit to this which I will discuss below.

It's up to you to assess the risk and judge how you want to share information on the Steem blockchain and to Steemit, Inc. I hope this article furthers the larger understanding of the risks and benefits of the system as I myself was not able to find this information readily.

But remember, there's no one-size-fits-all approach to information protection. Internet-based companies thrive on our personal data, both in their ownership of it or a broad license to use it (which can often be practically the same thing in effect), and of our willingness to make it available for others to access. We are provided with communication platforms but there's always a catch. This article investigates what that catch is for Steemit.

Intellectual property

Intellectual property rights are generally automatically granted once an original work becomes "fixed", which covers the actual act of writing, painting, recording, etc. a work.

Steemit, Inc. does not make an ownership claim of the blockchain in any part of their Terms of Service, or Privacy Policy. It seems to be viewed as one of several third party sources of content included in their definition of "Steem Content", defined in section 3 (Copyright and Limited License) in the Terms of Service.

Steemit contains data, [...] and other content supplied by us, the Steem blockchain [emphasis mine] or our licensors, which we call “Steemit Content.”

As a poster, your automatic intellectual property rights are not transferred to Steemit by any explicit claim on ownership. The converse is true: they do not state that posters retain ownership of that content.

Steemit asserts a respect for intellectual property rights in accordance with the law. In its Terms of Service, section 3 (Copyright and Limited License) in the Terms of Service

Steemit Content is protected by intellectual property laws, including copyright and other proprietary rights of the United States and foreign countries. Except as explicitly stated in these Terms, Steemit does not grant any express or implied rights to use Steemit Content.

While they will not remove content, in the capacity of the Steemit, Inc. services they pledge to not read it from the blockchain. (in section 20, Copyright Complaints)

Steemit respects the intellectual property of others by not reading infringed content from the Steem blockchain [emphasis mine]. If you believe that your work has been copied in a way that constitutes copyright infringement, you may notify Steemit’ s Designated Agent by contacting:

[email protected] / mailto:[email protected]

It is legal procedure, involving lawyers and several back and forward notices. An example of it is laid out in here. It is plain that Steemit, Inc. will go by the letter of the law but nothing short of it. Unlike other platforms, they do not provide an on-platform system.

In the Steem White Paper, as a last thought on the second last page, the authors propose a benefit of the Steem blockchain for content creators. They say

Under blockchain-based social media, a creator or author would always be able to point to a public record and timestamp showing proof of their content origination. In a circumstance where a creator would like to address those who have re-shared without permission or attribution, blockchain-based records provide public proof that the content was posted by a particular user at a particular time. In the future, blockchain-based attribution could come to be recognized by governments for its authenticity and could hold weight in court, which would give content creators greater powers to control their work. [1]

I'm surprised this subject did not receive more consideration in the white paper, which mostly deals with the particularities of the cryptocurrency. However this paragraph suggests to me that their intention is to let users decide how best to deal with the problem of ownership and not to make technical provisions for the protection of ownership, bar not reading anything which infringes on it [edited this line].

Perhaps this is obvious to seasoned blockchain users and developers, but I doubt it would be to the newly introduced. I think that the ambiguity and relative silence is intentional, and allows us all to debate it ourselves.

The salient points for me are:

1. Anyone can potentially have a copy of anything you post on the blockchain via (or not) Steemit.com. This makes the walled garden, or limited access method of digital rights management inapplicable.
2. Steemit, Inc. does not modify your native IP rights, nor actively protect them, but will not read infringing content from the blockchain to make available via Steemit.com or any other service they may provide.
3. This does not affect in any way the ability of anyone else from reading infringed content from the blockchain [edited this line to add not]
4. Infringements must be reported to Steemit, Inc. using US Copyright office procedures

Licensing

Steemit does not invoke the legal process of licensing in reference to their usage of data from the blockchain, but they do in reference to data they provide to us, as stated in section 3 of the Steemit ToS, paragraph 2:

You are granted a limited, nonexclusive, non-transferable, and non-sublicensable license to access and use Steemit and Steemit Content for your personal, non-commercial use. [...]

This is in contrast to the way that other social media networks operate. For example, Instragram's Terms of Use, in "Rights", section 1, they state:

Instagram does not claim ownership of any Content that you post on or through the Service. Instead, you hereby grant to Instagram a non-exclusive, fully paid and royalty-free, transferable, sub-licensable, worldwide license to use the Content that you post on or through the Service, subject to the Service's Privacy Policy

Steemit seems to reverse the licensing direction, by granting users a limited license to use "Steem Content" (including posts on the blockchain) as opposed to licensing content from users, as in the Instagram example, above.

While they use similar terminology, the key distinction here is that they do not presume that visitors of the website are posters. Compare Instagram's "...you hereby grant to Instagram..." with Steemit's "You are granted...".

In this way, they appear to distance themselves from the blockchain in a way, as not under the control of Steemit.com, only as an independent data source, which they can read and write to. Again, this may be obvious but worth stating outright here, if only because it is not stated outright in the terms.

They only pledge to defend the usage of the blockchain, under the umbrella of "Steem Content", through Steemit services and their license granted to users. From section 3 of the ToS, to continue from the quote above:

This license is subject to these Terms and does not include any right to: (a) distribute, publicly perform or publicly display any Steemit Content; (b) modify or otherwise make any derivative uses of Steemit or Steemit Content, or any portion thereof; (c) use any data mining, robots or similar data gathering or extraction methods; and (d) use Steemit or Steemit Content other than for their intended purposes. Any use of Steemit or Steemit Content other than as authorized in these Terms is strictly prohibited and will terminate the license granted herein. This license is revocable at any time.

I believe that this does not interfere with the possibility of someone with access to the blockchain (potentially anyone) to do any of these things. They are simply covering their liability through the portal of their services. So the blockchain technically is there to be mined, separately, and at the risk of that party. Derivative works would obviously violate a license, if permission was not given.

Advertising, i.e. monetizing unlicensed, captured data

The Privacy Policy outlines the various ways in which Steemit, Inc. will use information about service users to make money. From our reading so far, I expect this to include Steemit.com users only, not necessarily posters to the Steem blockchain.

There is no mention of a license here because, like virtually every other internet company, they do not feel the need to mention it as information they collect about you is their property, by virtue of them as the actively collecting party. Steemit is not doing anything unusual here, but it is doing something which I deeply object to, as I have detailed elsewhere as "data capture".

In this way, Steemit is very similar to most social media in it's intention to use user accounts and content to generate money through advertising. As we all know by now, the Internet world turns on the advertisers dollar.

The Steem white paper seems to contradict the Privacy Policy somwehat in that it is plainly recognised that advertising is, at the very least, problematic:

Advertising represents a double-edged sword: With ads, a creator can make money most easily. Without ads, monetization is difficult but the content is richer. [2]

Anyone who uses Steam know that they do not currently display advertising. However, the creators of Steemit have expressed a monetisation strategy of using promoted content, much like Instagram. From the FAQ, "How does Steemit, Inc. earn money?":

Over time, Steemit will allow advertisers and bloggers to promote content by buying and burning Steem. Steemit can benefit from sales of Steem to advertisers in the cryptocurrency markets or offer advanced services to these advertisers and bloggers.

I speculate that "advanced services" could include an analysis of user activity on Steemit.com, on their analytics, and though they might not, they could start using targeted ads, as is clear from the privacy policy:

We may partner with third-party advertisers, ad networks, and analytics providers to deliver advertising and content targeted to your interests [emphasis mine] and to better understand your use of the Services. These third parties may collect information sent by your computer, browser, or mobile device in response to a request for content, such as unique identifiers, your IP address, or other information about your computer or device.

The only way to target individual users is to track them, which is to say, monitor their usage. And while Steemit state that they do not at this time "[...] not share your individual account browsing habits with advertisers", they do say that "[our] ad partners and network may use cookies and use related technologies to collect information when ads are delivered to you on our Services" [3]. Facebook and Google do not need much help figuring out your habits with their own tracking systems, which are already granted access on the site if not blocked, and tie these in with what they already know about you from their main sites, plus the countless other sites using analytics and information from data brokers.

It's also disappointing but not surprising that Steemit Inc. does not support Do Not Track (DNT) requests, citing a lack of standardized method for implementation as their reason.

My take in summary

Clearly there is the potential for the usual cost to using Steemit.com as there is to using many sites on the internet, certainly many of the most popular: silent, covert (yet not secret) tracking. But Steemit is not just another tracking system dressed up as a messaging and content sharing platform. Everyone gets a share of the value created. In fact, posting is itself intrinsically valuable by design. This is an amazing concept and I'm looking forward to seeing more about how it works in practice. I commend them for this, and for implementing this a modern, well designed interface. It's a really cool experiment. ❄️💯

I have outlined that there is a loss of data ownership and protection, and certain risks associated with using Steemit services. When used with the appropriate safe practices, I think this looks like one of, if not the best social networks around. The challenge is that it's up to you as a user to inform yourself well.

But finally, I would like to make a request to Steemit, Inc. I think it would be better ethically if extraneous and personally identifying information about users was not logged, such as "IP address, user-agent string, browser type, operating system, referral URLs, device information (e.g., device IDs), pages visited, links clicked, user interactions (e.g., voting data), the requested URL, hardware settings, and search terms", cookies and location information [4]. A progressive platform should have a progressive data protection policy. In addition, I would like to see the privacy policy expressly state that any information collected be anonymised, and this policy implemented. IP addresses in particular are extremely identifying.

Closing

Thanks for reading this article. If you have any additional information or wish to correct me on a point, please do! My goal here is to understand the ecosystem and contribute to it. 🎄 🌳 🍂 🌻 😁

References

• [1] Steem White Paper, pg 43, "Shifting Toward Blockchain-based Attribution"
• [2] Steem White Paper, pg 43, "Replacing Advertising with Blockchain-Based Content Rewards"
• [3] Steemit.com Privacy Policy, sections 17
• [4] Steemit.com Privacy Policy, sections 7, 8, and 9

Edits

• I made a few simple mistakes by omitting words, these have been corrected and clearly marked.
• Corrected a reference number