The United States Copyright Act enables the holders of properly registered copyrights to sue for statutory damages and recover between $750 and $30,000 in damages for each copyright infringed without the need to prove any actual damage or monetary loss to such copyright holder. In the event willful infringement is proven, this number can be increased to $150,000 per work. Therefore, an individual who intentionally downloads 10 songs from a P2P service could be liable for $1,500,000 damages in a copyright infringement suit despite the fact that the actual retail value of the 10 copies of the songs may be less than $100.

Recently, the RIAA sued four individual college students for hundreds of millions of dollars in statutory damages for downloading and distributing copyrighted music files via P2P networks. The students settled the cases for amounts ranging from $12,000 to $17,000. These cases emboldened the RIAA and others to step up lawsuits against P2P end users, including those that enable such end users to access the services.

While Internet Service Providers that provide end users with access to P2P networks are insulated from liability as a result of the Digital Millennium Copyright Act, companies that provide Internet access to their employees enjoy no such protection. With Congress openly criticizing universities for permitting illegal activities via P2P networks and the RIAA sending letters to Fortune 1000 companies warning them that they could be exposed to significant liability, it would seem that lawsuits against deep-pocketed companies that turn a blind eye to illegal file sharing on their networks are just around the corner and that the damages could be high if the infringing works downloaded are used in connection with the primary business of the company rather than mainly for the individual entertainment of the rogue employee.

Therefore, it is incumbent upon every company that permits Internet access in the workplace to take firm measures to stop illegal file sharing, lest the company become subject to millions of dollars in liability. It can safely be assumed that any employee accessing a P2P network is either uploading or downloading copyrighted materials. No employee needs to ever access KaZaa, Morpheus or any other P2P service. The sole exception may be if the employee is searching for public domain works, but such access should be limited and closely supervised. If an employee needs to share a permitted file with another party, then the file can be attached to an email without using a P2P service. In addition, P2P software often has other programs bundled with the download unbeknownst to the end user, and P2P networks have seen an increase in the number of computer viruses.

With this background, the following are a list of suggested steps and best practices to take to deter and eliminate illegal file sharing on your corporate network and to protect the company from liability:
Adopt employee policies, and send employees reminder notices, which prohibit the downloading of any materials from the Internet of a software or entertainment nature for storage or use on company equipment, unless specifically authorized by senior management.

• Restrict Internet access to web sites that provide P2P services unless absolutely necessary for a legitimate and documented business purpose;
• Regularly search network drives for common file extensions of potentially illegal files such as *.mp3, *.mov, *.mpg, etc…
• Conduct random inspections of employees’ computers for the presence of file sharing software or illegal multimedia files and arrange for the orderly deletion of any prohibited materials after documenting the contents discovered;
• Take disciplinary action against any employee that violates the company policies regarding copyrighted materials and software; and
• Document all policies, procedures and enforcement actions in connection with the foregoing.

It is no longer a risk-free alternative to ignore the actions of employees using the corporate network. By taking a proactive approach to prevent the use of the corporate network for infringing purposes, a company can minimize the risk of inviting a lawsuit which would be costly to defend and potentially even more costly in a settlement or adverse judgment.

© 2001 Davis & Gilbert LLP