Someone secreted video cameras in the locker rooms, bathrooms, and showers of several sports teams. Tapes showing undressed players were compiled, given titles such as "Voyeur Time" and "Between the Lockers," and sold by entities calling themselves "Franco Productions," "Rodco," "Hidvidco—Atlas Video Release," and other names designed to conceal the persons actually responsible. All of this happened without the knowledge or consent of the people depicted. This suit, filed by football players at Illinois State University, wrestlers at Northwestern University, and varsity athletes from several other universities, named as defendants not only the persons and organizations that offered the tapes for sale (to which we refer collectively as "Franco"), plus college officials who had failed to detect the cameras (or prevent their installation), but also three corporations that provided Internet access and web hosting services to the sellers. The sellers either defaulted or were dismissed when they could not be located or served. The college officials prevailed on grounds of qualified immunity. The only remaining defendants are the informational intermediaries—large corporations, two-thirds of them solvent. The solvent defendants are GTE Corp. and Genuity Inc. (formerly known as GTE Internetworking), both of which are subsidiaries of Verizon Communications. (The third, PSInet, has been liquidated in bankruptcy. As plaintiffs did not file claims in that proceeding, PSInet has been discharged from any liability.) The district court dismissed all claims against them in reliance on 47 U.S.C. § 230(c). See 2000 U.S. Dist. LEXIS 8645, 2000 WL 816779 (N.D.Ill. June 22, 2000) (reiterating an earlier opinion dated April 20, 2000). After the judgment became final with the resolution or dismissal of all claims against all other defendants—the defaulting defendants were ordered to pay more than $500 million, see 2002 U.S. Dist. LEXIS 24032 (N.D.Ill. Nov. 25, 2002), though there is little prospect of collection—plaintiffs filed this appeal in order to continue their pursuit of the deep pockets.

Plaintiffs commenced this litigation in state court. Three defendants employed by public universities removed it to federal court under 28 U.S.C. § 1441(b), observing that the claim against them rests on 42 U.S.C. § 1983. Neither the parties nor the district judge noticed that removal requires the consent of all defendants. See Hanrick v. Hanrick, 153 U.S. 192, 14 S. Ct. 835, 38 L. Ed. 685 (1894); Torrence v. Shedd, 144 U.S. 527, 12 S. Ct. 726, 36 L.Ed.528 (1892); Phoenix Container, L.P. v. Sokoloff, 235 F.3d 352 (7th Cir.2000). This defect in the removal process could have justified a remand, but because 30 days passed without protest—and the problem does not imperil subject-matter jurisdiction—the case is in federal court to stay. See 28 U.S.C. § 1447(c).

What GTE and Genuity (collectively GTE) sought, and what the district court granted, is dismissal under Fed.R.Civ.P. 12(b)(6) for failure to state a claim on which relief may be granted. Yet the reason behind the district court's ruling is not failure to state a claim, but an affirmative defense provided by § 230(c). Affirmative defenses do not justify dismissal under Rule 12(b)(6); litigants need not try to plead around defenses. See Gomez v. Toledo, 446 U.S. 635, 100 S. Ct. 1920, 64 L. Ed. 2d 572 (1980). Plaintiffs do not protest the district court's use of Rule 12(b)(6), however, perhaps because the decision could have been recast as a judgment on the pleadings under Rule 12(c). Nor do they seek better notice or a crack at discovery. Their only argument is that § 230(c) does not assist GTE. We turn to that question without fussing over procedural niceties to which the parties are indifferent.

According to the complaint, GTE provided web hosting services to sites such as "youngstuds.com" at which the hidden-camera videos were offered for sale. GTE did not create or distribute the tapes, which were sold by phone and through the mail as well as over the Internet. Although the complaint is not specific about just what GTE did, we may assume that GTE provided the usual package of services that enables someone to publish a web site over the Internet. This package has three principal components: (1) static IP (Internet protocol) addresses through which the web sites may be reached (a web host sometimes registers a domain name that corresponds to the IP address); (2) a high-speed physical connection through which communications pass between the Internet's transmission lines and the web sites; and (3) storage space on a server (a computer and hard disk that are always on) so that the content of the web sites can be accessed reliably. Advertisements about, and nude images from, the videos thus passed over GTE's network between Franco and its customers, and the data constituting the web site were stored on GTE's servers. Franco rather than GTE determined the contents of the site, though the complaint raises the possibility that GTE's staff gave Franco technical or artistic assistance in the creation and maintenance of its web site. Sales occurred directly between Franco and customers; communications may have been encrypted (most commercial transactions over the Internet are); and GTE did not earn revenues from sales of the tapes. Franco signed contracts with GTE promising not to use the web site to conduct illegal activities, infringe the rights of others, or distribute obscenity (a promise Franco broke). GTE thus had a contractual right to inspect each site and cut off any customer engaged in improper activity. We must assume that GTE did not exercise this right. Some domain administrators and other personnel maintaining GTE's servers and communications network may have realized the character of Franco's wares, but if so they did not alert anyone within GTE who had the authority to withdraw services. Managers were passive, and the complaint alleges that GTE has a policy of not censoring any hosted web site (that is, that GTE does not enforce the contractual commitments that Franco and other customers make).

The district court's order dismissing the complaint rests on 47 U.S.C. § 230(c), a part of the Communications Decency Act of 1996. This subsection provides:

(c) Protection for "Good Samaritan" blocking and screening of offensive material.

(1) Treatment of publisher or speaker. No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

(2) Civil liability. No provider or user of an interactive computer service shall be held liable on account of—(A) any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or (B) any action taken to enable or make available to information content providers or others the technical means to restrict access to material described in paragraph (1).

These provisions preempt contrary state law. "No cause of action may be brought and no liability may be imposed under any State or local law that is inconsistent with this section." 47 U.S.C. § 230(e)(3). But "[n]othing in this section shall be construed to limit the application of the Electronic Communications Privacy Act of 1986 or any of the amendments made by such Act, or any similar State law." 47 U.S.C. § 230(e)(4). We therefore start with the question whether plaintiffs have a claim under the Electronic Communications Privacy Act.

Plaintiffs rely on 18 U.S.C. § 2511 and § 2520, two provisions of that statute. Under § 2511(1), "any person who—(a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication; (b) intentionally uses, endeavors to use, or procures any other person to use or endeavor to use any electronic, mechanical, or other device to intercept any oral communication" faces civil liability. Section 2520(a) creates a damages remedy in favor of a person "whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter". Franco and confederates intercepted and disclosed oral communications (the tapes have audio as well as video tracks) and thus are liable under § 2511 and § 2520. But what could be the source of liability for a web host?

GTE did not intercept or disclose any communication; and though one could say that its network was a "device" to do so, plaintiffs do not make such an argument (which would be equally applicable to a phone company whose lines were used to spread gossip). Instead plaintiffs say that GTE is liable for aiding and abetting Franco. Yet nothing in the statute condemns assistants, as opposed to those who directly perpetrate the act. Normally federal courts refrain from creating secondary liability that is not specified by statute. See Central Bank of Denver, N.A. v. First Interstate Bank of Denver, N.A., 511 U.S. 164, 114 S. Ct. 1439, 128 L. Ed. 2d 119 (1994). Although a statute's structure may show that secondary liability has been established implicitly, see Boim v. Quranic Literacy Institute, 291 F.3d 1000 (7th Cir.2002), it is hard to read § 2511 in that way. Subsection 2511(1)(c) creates liability for those who wilfully disseminate the contents of unlawfully intercepted information. See Bartnicki v. Vopper, 532 U.S. 514, 121 S. Ct. 1753, 149 L. Ed. 2d 787 (2001). A statute that is this precise about who, other than the primary interceptor, can be liable, should not be read to create a penumbra of additional but unspecified liability.

What is more, GTE's activity does not satisfy the ordinary understanding of culpable assistance to a wrongdoer, which requires a desire to promote the wrongful venture's success. See generally United States v. Pino-Perez, 870 F.2d 1230 (7th Cir.1989) (en banc). A web host, like a delivery service or phone company, is an intermediary and normally is indifferent to the content of what it transmits. Even entities that know the information's content do not become liable for the sponsor's deeds. Does a newspaper that carries an advertisement for "escort services" or "massage parlors" aid and abet the crime of prostitution, if it turns out that some (or many) of the advertisers make money from that activity? How about Verizon, which furnishes pagers and cell phones to drug dealers and thus facilitates their business? GTE does not want to encourage the surreptitious interception of oral communications, nor did it profit from the sale of the tapes. It does profit from the sale of server space and bandwidth, but these are lawful commodities whose uses overwhelmingly are socially productive. That web hosting services likewise may be used to carry out illegal activities does not justify condemning their provision whenever a given customer turns out to be crooked. Franco did not demand a quantity or type of service that is specialized to unlawful activities, nor do plaintiffs allege that the bandwidth or other services required were themselves tipoffs so that GTE, like the seller of sugar to a bootlegger, must have known that the customer had no legitimate use for the service. Just as the telephone company is not liable as an aider and abettor for tapes or narcotics sold by phone, and the Postal Service is not liable for tapes sold (and delivered) by mail, so a web host cannot be classified as an aider and abettor of criminal activities conducted through access to the Internet. Congress is free to oblige web hosts to withhold services from criminals (to the extent legally required screening for content may be consistent with the first amendment), but neither § 2511(a) nor § 2520 can be understood as such a statute.

Section 230(c)(2) tackles this problem not with a sword but with a safety net. A web host that does filter out offensive material is not liable to the censored customer. Removing the risk of civil liability may induce web hosts and other informational intermediaries to take more care to protect the privacy and sensibilities of third parties. The district court held that subsection (c)(1), though phrased as a definition rather than as an immunity, also blocks civil liability when web hosts and other Internet service providers (ISPs) refrain from filtering or censoring the information on their sites. Franco provided the offensive material; GTE is not a "publisher or speaker" as § 230(c)(1) uses those terms; therefore, the district court held, GTE cannot be liable under any state-law theory to the persons harmed by Franco's material. This approach has the support of four circuits. See Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir.1997); Ben Ezra, Weinstein & Co. v. America Online, Inc., 206 F.3d 980 (10th Cir.2000); Green v. America Online, 318 F.3d 465 (3d Cir.2003); Batzel v. Smith, 333 F.3d 1018 (9th Cir.2003). No appellate decision is to the contrary.

If this reading is sound, then § 230(c) as a whole makes ISPs indifferent to the content of information they host or transmit: whether they do (subsection (c)(2)) or do not (subsection (c)(1)) take precautions, there is no liability under either state or federal law. As precautions are costly, not only in direct outlay but also in lost revenue from the filtered customers, ISPs may be expected to take the do-nothing option and enjoy immunity under § 230(c)(1). Yet § 230(c)—which is, recall, part of the "Communications Decency Act"—bears the title "Protection for `Good Samaritan' blocking and screening of offensive material", hardly an apt description if its principal effect is to induce ISPs to do nothing about the distribution of indecent and offensive materials via their services. Why should a law designed to eliminate ISPs' liability to the creators of offensive material end up defeating claims by the victims of tortious or criminal conduct?

True, a statute's caption must yield to its text when the two conflict, see Trainmen v. Baltimore & Ohio R.R., 331 U.S. 519, 528-29, 67 S. Ct. 1387, 91 L.Ed.1646 (1947), but whether there is a conflict is the question on the table. Why not read § 230(c)(1) as a definitional clause rather than as an immunity from liability, and thus harmonize the text with the caption? See Carlisle v. United States, 517 U.S. 416, 421, 116 S. Ct. 1460, 134 L. Ed. 2d 613 (1996). On this reading, an entity would remain a "provider or user" — and thus be eligible for the immunity under § 230(c)(2)—as long as the information came from someone else; but it would become a "publisher or speaker" and lose the benefit of § 230(c)(2) if it created the objectionable information. The difference between this reading and the district court's is that § 230(c)(2) never requires ISPs to filter offensive content, and thus § 230(e)(3) would not preempt state laws or common-law doctrines that induce or require ISPs to protect the interests of third parties, such as the spied-on plaintiffs, for such laws would not be "inconsistent with" this understanding of § 230(c)(1). There is yet another possibility: perhaps § 230(c)(1) forecloses any liability that depends on deeming the ISP a "publisher"—defamation law would be a good example of such liability—while permitting the states to regulate ISPs in their capacity as intermediaries.

We need not decide which understanding of § 230(c) is superior, because the difference matters only when some rule of state law does require ISPs to protect third parties who may be injured by material posted on their services. Plaintiffs do not contend that GTE "published" the tapes and pictures for purposes of defamation and related theories of liability. Thus plaintiffs do not attempt to use theories such as the holding of Braun v. Soldier of Fortune, 968 F.2d 1110 (11th Cir.1992), that a magazine publisher must use care to protect third parties from harm caused by the sale of products or services advertised within its pages, and we need not decide whether such theories (if recognized by state law and applied to ISPs) would survive § 230(c). Instead, they say, GTE is liable for "negligent entrustment of a chattel," a tort that the Restatement (Second) of Torts § 318 encapsulates thus:

If the actor permits a third person to use ... chattels in his possession otherwise than as a servant, he is, if present, under a duty to exercise reasonable care so to control the conduct of the third person as to prevent him from intentionally harming others ... if the actor (a) knows or has reason to know that he has the ability to control the third person, and (b) knows or should know of the necessity and opportunity for exercising such control.

See also Restatement (Second) of Torts § 308. The idea is that if A entrusts his car to B, knowing that B is not competent to drive, then A (if present) must exercise reasonable care to protect pedestrians and other drivers. Plaintiffs want us to treat GTE's servers, routers, and optical-fiber lines as chattels negligently "entrusted" to Franco and used to injure others. But GTE did not entrust its computers, network, or any other hardware to Franco; it furnished a service, not a chattel.

Plaintiffs do not cite any case in any jurisdiction holding that a service provider must take reasonable care to prevent injury to third parties. Consider the Postal Service or Federal Express, which sell transportation services that could be used to carry harmful articles. As far as we can discover, no court has held such a carrier liable for failure to detect and remove harmful items from shipments. That likely is why plaintiffs have not sued any delivery service for transporting the tapes from Franco to the buyers. Similarly, telephone companies are free to sell phone lines to entities such as Franco, without endeavoring to find out what use the customers make of the service. See, e.g., Anderson v. New York Telephone Co., 35 N.Y.2d 746, 361 N.Y.S.2d 913, 320 N.E.2d 647 (1974) (no liability for phone company that furnished service to someone who used the connection to play a defamatory recording to all callers). Again plaintiffs have not sued any phone company.

Yet an ISP, like a phone company, sells a communications service; it enabled Franco to post a web site and conduct whatever business Franco chose. That GTE supplied some inputs (server space, bandwidth, and technical assistance) into Franco's business does not distinguish it from the lessor of Franco's office space or the shipper of the tapes to its customers. Landlord, phone company, delivery service, and web host all could learn, at some cost, what Franco was doing with the services and who was potentially injured as a result; but state law does not require these providers to learn, or to act as Good Samaritans if they do. The common law rarely requires people to protect strangers, or for that matter acquaintances or employees. See generally Stockberger v. United States, 332 F.3d 479 (7th Cir.2003). States have enacted statutes to change that norm in some respects; Dram Shop laws are good examples. Plaintiffs do not identify anything along those lines concerning web hosts. Certainly "negligent entrustment of a chattel" is not a plausible description of a requirement that service providers investigate their customers' activities and protect strangers from harm. Nor does the doctrine of contributory infringement, see Hard Rock Cafe Licensing Corp. v. Concession Services, Inc., 955 F.2d 1143 (7th Cir.1992), offer a helpful analogy. A person may be liable as a contributory infringer if the product or service it sells has no (or only slight) legal use, see Sony Corp. of America v. Universal City Studios, Inc., 464 U.S. 417, 104 S. Ct. 774, 78 L. Ed. 2d 574 (1984); In re Aimster Copyright Litigation, 334 F.3d 643 (7th Cir.2003), but GTE's web hosting services are put to lawful use by the great majority of its customers. (This is why ISPs are not liable as contributory infringers for serving persons who may use the bandwidth to download or distribute copyrighted music—and indeed enjoy safe harbors under the Digital Millennium Communications Act, discussed in Aimster, unless the ISP has actual notice that a given customer is a repeat infringer.) For the same reason, plaintiffs' invocation of nuisance law gets them nowhere; the ability to misuse a service that provides substantial benefits to the great majority of its customers does not turn that service into a "public nuisance."

Maybe plaintiffs would have a better argument that, by its contracts with Franco, GTE assumed a duty to protect them. No third-party-beneficiary argument has been advanced in this court, however, so we need not decide how it would fare. None of the arguments that plaintiffs now make shows that any of the states where their colleges and universities were located requires suppliers of web hosting services to investigate their clients' activities and cut off those who are selling hurtful materials, so the district court's judgment is

AFFIRMED.