Help! We just got a very scary "cease and desist" notice from a company claiming to own the copyrights to some videos that were posted on our web site and used internally. They want $2,000 to "settle" a copyright claim, and they say we have 10 days to reply or they will sue! This notice is sitting in my in-box like a ticking time bomb, please let me know what we should do. 
 In the interest of transparency, please know that this question is an amalgam of several we've received, and not attributable to any one institution.
As the use of online tools for tracking use of copyright-protected content becomes more widespread, this is happening to schools, libraries, museums, and other cultural/educational institutions with greater frequency.
While these threats will vary based on the circumstances, here is a step-by-step "Copyright Threat Diffusion Guide" to help you de-escalate the tension and figure out what to do, from the moment an infringement threat hits your in-box.
Breathe. It's going to be okay. Make some tea, or go for a walk if you feel nervous.
Print the threat, and save a copy as a PDF with the document name "CopyrightClaim[DATE]." DO NOT FORWARD IT.
DO NOT REPLY to the threat.
DO NOT take any of the steps it demands (removal of content, paying money, saying you’re sorry, etc.). Just stay cool for a few more steps, first.
Within one business day of its arrival, appoint a "copyright claim buddy" to work with you on this. If you are a director, this is a good role for your second-in-command. If there is no other employee who can help out, loop in a board member (all of this should be over the phone, no e-mails). Just "Hello, we got a claim of copyright infringement we need to assess, I read this thing that says an organization should always have at least two people work on that type of thing, can you work with me on it?"
Hopefully, you now have a "copyright claim buddy" and you are ready to make your first decision: alert your institution's lawyer, or alert your institution's insurance carrier. Either is good.
Here's how you notify your attorney: If you have lawyer, e-mail them the pdf of the threat (cc your buddy), and write "The [library] received this on [DATE]. [NAME] and I are responsible for handling it. Are you available to help us this week on this, and if so, can you propose a budget for helping us with this? And if you can't help right now, can you recommend someone who can? We know we need to handle this promptly."
Here's how you notify the insurance carrier: If you have an agent or broker, e-mail them the pdf of the threat, and say "The [library] received this on [DATE]. [NAME] and I are responsible for handling it. Is there coverage for this, and if so, does the carrier want to respond?"
It is reasonable to expect replies within three business days.
With Step 6 done, the matter is either out of your hands as the driving force of resolution (you and your buddy will remain engaged with the carrier or the lawyer, but they will be the interface with the claimant...if they decide the threat is even worth responding to), OR you have confirmed you have no insurance coverage for this, and you haven't found a lawyer who can help you. Which brings us to...
Step 8 is the time for all the initial responses that likely hit you in an adrenalized rush when you first opened the threatening message. It includes things like:
Whenever possible, everything in "Step 8" should be either conducted by an investigation by your insurance carrier, or with the participation of your library's attorney so the findings are protected by attorney-client privilege.
Step 9 is the course of action developed based on the information established in Step 8.
Because so many variables impact it, there is no one answer or outcome to Step 9, but here are some real-world resolutions I have seen:
Taking a close look at the content, it was determined that the material in the threat and the material used by the institution weren't actually the same thing. Result: case closed with no credible threat of litigation having been made.
Taking a close look at the content, it was determined that the Copyright was not registered, and thus there was no credible threat of litigation at that time. Also, there was some room to claim fair use. Result: to be cautious, the institution removed the content, but without acknowledging the threat and with no money paid.
Taking a close look at the content, it was determined that...Oops, this institution made a mistake and used someone's content without permission to advertise a small, free event. Further, the content was properly registered, so the threat of litigation was credible. Result: insurance carrier took over and negotiated a very small settlement.
These are just a few examples, but they show the range of resolution possible when a systematic analysis of threatened copyright infringement is conducted in a calm and rational manner.
I do want to emphasize the importance of bringing in your institution's attorney. Determining the facts that position an institution to take Step 9 requires a full and frank discussion of what might have happened during Step 8. That means that unless the process is protected by attorney-client privilege, getting to Step 9 can create discoverable evidence that would have to be turned over during a lawsuit. Depending on what happened, that could be to your institution's disadvantage.
Finally: I know I started this with the admonition to "stay calm," but then included some fairly alarming things in this answer! For anyone who has read this and is now worried about content your institution has posted on its website or on social media, a nice way to allay a panic attack is to casually reach out to your insurance carrier or agent and say: "Hey, do we have coverage for alleged copyright infringement? We don't plan on infringing anybody, but it would be good to know what to do if someone claims we have."
That way, you know who to call just in case you get one of these letters.
Call it "Step Zero."
 Why do I recommend a "copyright claim buddy?" Several reasons. First, this type of thing is no fun. Second, this is a chancy world, and any one of us can suddenly get sick, in an accident, or win the lottery and quit our job. For critical matters like threatened litigation, an organization's response team should be at least two people deep. Further, it is a good development opportunity for future leadership.
 If your lawyer does not regularly handle copyright matters, they are welcome to call my office at (716) 464-3386.
 Keep trying! Don't go it alone.
 Are the facts asserted in the letter even accurate?
 If you are a state institution, there are certain protections you have; if you are a not-for-profit educational institution, there are certain protections you have; if a third party posted the material, there are certain protections you might have.