It's Official: Registrars Cannot Hold Domains Hostage Without a Court Order 112
Stunt Pope writes "Back when the City of London Police issued those 'takedown requests' to domain registrars, most complied. However, as previously reported here, easyDNS didn't. A bunch of the taken-down domains wanted to move to easyDNS. One problem: their registrar wouldn't let them. It took awhile, but easyDNS fought it. They've finally gotten a ruling (PDF) under the ICANN policy that ordered the hostage domains transferred."
hmm.... (Score:4, Interesting)
how about like when whole domains are being used for malware, phishing, or fraud?
do we have to go thru a court to get a registrar to do something? that isn't reallllly that good of news.
namesearchhere.com is being used for botnet clickfraud. along with probably hundreds of others... now the registrar can just sit on their hands and say... welp. nothing i can do but charge fees. my hands are tied!
registrars are making money of DGA, clickfraud, and all manner of shitty activities. now they can really drag their feet.
Re: (Score:2)
how about like when whole domains are being used for malware, phishing, or fraud?
Couldn't the browsers handle that?
Re: hmm.... (Score:2, Informative)
That is done with court orders and warants dipshit.
Re: hmm.... (Score:4, Insightful)
If you break the law then, to quote you, it's your own damn fault.
How can you tell if a website is breaking the law? An illegal activity in the United States may be legal in the country that the website is located in. Thus making it a legal website.
Re: (Score:2)
I wish America understood this when it's ICE domain seizures took down the domains of legitimate overseas gambling businesses.
Did you think this through? (Score:3)
Re: (Score:1)
So you think it should be allowed to seize your stuff without a court order? As in, the police claims you did something illegal, and then can legally take your possessions away?
I certainly don't want to live in such a country. There always has to be a judge in the loop if your fundamental rights are concerned.
Re: (Score:2)
It wouldn't just have a chilling effect, but would also saddle the hosting with the expenses of actively policing the site on their own dime.
Law enforcement should be funded by tax dollars, not corporate budgets.
Re: (Score:2)
The internet is not a single country and there are no laws which apply globally.
You're trying to explain that on a website full of americans. Good Luck.
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
no, there's more than just 'muricans here.
I think you're trying to respond to this guy http://tech.slashdot.org/comments.pl?sid=4655149&cid=45923469 [slashdot.org]
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3)
Ahh. So with Google safe-browsing in Firefox and Chrome, and MS whateverthefuck filter, clearly there are no successful phishing attacks involving websites.
No, I've reported phishing domains that stayed up for over 48 hours. Google (stopbadware, opendns anti-phishing) and Netcraft respond pretty quickly to phishing reports but people still end up at the sites trying their damnest to log in.
Maybe hosting providers should be the same way when you report one of their servers as hacked and being used for a botn
Re:hmm.... (Score:5, Insightful)
Better 100 idiots without a scanner installed get infected than one innocent site get shut down by an asshole with an agenda.
Re: (Score:1)
Better 100 idiots without a scanner installed get infected than one innocent site get shut down by an asshole with an agenda.
Is it? What metric are you using? Economic cost? Human suffering? I'm sure you have a sophisticated analysis and aren't just pulling a pithy expression out your ass.
Re:hmm.... (Score:5, Funny)
Re: (Score:1)
It's a specific case of Blackstone's Formulation, which you're highly advised to go away and study at length. It's a really good principle.
Re: (Score:2)
Hosting a site and having a domain name are different things.
Re: (Score:3)
No, Ive got it, they should take the domains down immediately with no verification and no court order whenever someone presses the "report domain" button!
Seriously, what are you proposing?
Re: (Score:2)
hand over all your evidence of malicious activity to the registrar, they can decide if the domain should be deleted or not.
but they shouldn't get an easy "my hands are tied" excuse to do nothing.
Re: (Score:2)
Im sure the registrar totally has the workload bandwidth to deal with the number of bogus domains that pop up every day.
but they shouldn't get an easy "my hands are tied" excuse to do nothing.
Yes they should, i dont want my registrar deciding whether he likes the content Im hosting on my domain. If theres an issue with the content, talk to the host, the ISP, or a judge.
Re: (Score:2)
Evidence, aka your word. Why should a provider simply take the word/evidence of someone who isn't even prepared to back their allegations in court.
Re: (Score:1)
And what, please, is the problem with handing all your evidence to a court that can then decide to order the registrar to delete the domain? Given a court order, the registrar certainly doesn't have a "my hands are tied" excuse to do nothing. Quite the contrary, he has a "my hands are tied" excuse against the domain owner, that is, he has protection against being sued by the domain owner because of the deletion.
Re: (Score:2)
Ahh. So with Google safe-browsing in Firefox and Chrome, and MS whateverthefuck filter, clearly there are no successful phishing attacks involving websites.
No, I've reported phishing domains that stayed up for over 48 hours. Google (stopbadware, opendns anti-phishing) and Netcraft respond pretty quickly to phishing reports but people still end up at the sites trying their damnest to log in.
Maybe hosting providers should be the same way when you report one of their servers as hacked and being used for a botnet check-in or malware hoster. Do nothing until a court order. That should work well!
Assuming they acted immediately, the root DNS servers would still retain their cache for a long time. Perhaps as much as 24 hours.
Re: (Score:2)
Root DNS is not involved here at all unless its a TLD.
The roots don't cache? I always assumed they did. Learn something new every day.
Re: (Score:2)
Authoratative namesevers (including the root nameservers) just serve up the information they are authoratative form.
The process of collecting the data needed to resolve a name from multiple disparate nameservers and then caching those results is the job of a "recursive resolver". Generally your ISP provides a recursive resolver for your use.
Re: (Score:2)
... but people still end up at the sites trying their damnest to log in
You mean there are people out there that don't take advantage of those sites to poison their data, by submitting hundreds of bogus "logins" via a script?!?
Re: (Score:2)
Very few abuse reports are genuine. A common complaint I get is from people who are offended and simply want the site gagged. Whant to shut down someones site get a court order.
Re:hmm.... (Score:5, Insightful)
how about like when whole domains are being used for malware, phishing, or fraud?
do we have to go thru a court ....
How about when Anonymous Cowards like you are murdering babies? Do I have to go through the whole judicial thing to stop it? Shouldn't my word just be enough to come over and judicially execute you and have all your property transferred into my name as compensation for my time? I think all this "judicial stuff" is just getting in the way of my killing off idiots^W^W^W protecting the family.
Re:hmm.... (Score:4, Insightful)
Mod parent up.
Not saying I haven't wanted to bypass the legal system myself from time to time, but given the choice, don't you want to live in a world with laws?
Sure, I'd like to live in a world that doesn't need laws, but since ours does need them, then having people forced to follow them is the best we can hope for.
Re: (Score:2)
If the laws are reasonably fair, then yes. There are plenty of examples, however, of cases where this doesn't happen. Still, the downside cost of living without laws is pretty high, so it needs to be egregious before that seems like a good idea.
Re: (Score:2)
Re:hmm.... (Score:5, Insightful)
Why should he registrar be responsible for content? Is the phone company responsable for publishing phone numbers of unscrupulous businesses? The responsibility for mal-content is that of the host, not the directory.
Re: (Score:3)
Why should he registrar be responsible for content?
Because they have made themselves responsible through their Acceptable Use Policy agreement. For example, EasyDNS [easydns.com] includes these conditions upon the registree:
Re: hmm.... (Score:2)
Re: hmm.... (Score:4, Informative)
This should be clear from the very beginning of the ruling:
easyDNS Technologies Inc. v. PDR Ltd. d/b/a PublicDomainRegistry.com
It's easyDNS vs. another registrar, not easyDNS vs. City of London.
I've also read the "takedown order", which is quoted in part in the ruling itself. Maybe you should read it. It is rather clear in asking the registrar to review the conduct of the customer to see if it violates the registrar's acceptable use policy, and for the registrar to make a decision what action is appropriate.
The City of London did NOTHING that you or I could not do, and I have done many times in the past when trying to get spammers and such shut down. I've even been more forceful by saying that the registrar SHOULD shut them off, not just that they ought to review the policy to see if they think the customer is breaching it.
Yeah, the CoL went further by asking the registrar, once they had made a decision to shut the domain off, to take certain steps that would help the CoL maintain evidence of the activity for later legal action. That's not out of line, either, and it still is based on the registrar making a decision, not a demand from the CoL.
Re: (Score:2)
Re: (Score:3)
Right, so now they deny you service if you are breaking the law, but the arbiters of whether you are breaking the law or not is the court. Not themselves and not any other body.
Quoting the easyDNS terms of service:
Such determination on what constitutes a violation of the above or whether a domain has or is "likely" to violate the above is solely at the discretion of easyDNS.
"The above" includes "unlawful or illegal activities of any kind (this includes ponzi schemes and HYIPs)". I don't know where you get the idea that "now" it has to be a court. That wasn't what the ICANN ruling dealt with. The ICANN ruling dealt with transfer of domains being held hostage by other registrars, not whether the City of London needs a court order to ask a registrar to review a customer's activities for a potential violation of the registrar's terms. They do
Re: (Score:2)
The point is that that's a quite dangerous way to set things up, not that it wasn't legal, or that it didn't match the terms of service. I agree, it's a quite dangerous way to set things up. And the danger is born by then end users (both the web site builder and the user of said site.) ...I can't thi
I'm quite dubious about letting a web site host have the ability to hold my data. In my case this is academic, as I don't have a web site, but were I to do so I'd be reluctant to trust it to a host that could
Re: (Score:2)
While they can refuse to supply service at their discretion, where does it say they have the right to refuse to honor a request for a domain transfer? Are you even following the chain of events here or are you just making things up as you go?
Re: (Score:2)
While they can refuse to supply service at their discretion, where does it say they have the right to refuse to honor a request for a domain transfer?
It doesn't, and I didn't claim it did. I was answering the question "Why should the registrar be responsible for content?" Then someone made the claim that "the arbiters of whether you are breaking the law or not is the court", which is contradicted by the same terms.
You might also note that I am quoting the easyDNS terms. I would never expect anyone to read a quote from easyDNS terms and think it was a justification for PDR holding on to domains, so I am at a loss why you are trying to read such a justif
Re: (Score:2)
That's not how an acceptable use policy works. Having an Acceptable Use Policy does not make EasyDNS responsible to third parties to enforce that Acceptable Use Policy.
Re:hmm.... (Score:5, Insightful)
Protecting the good guys from abuse often protects the bad guys to some degree.
Its all about what kind of internet you want to deal with: One where someone can trivially take your content down, or one where you know that theres bad stuff out there.
Re: (Score:2)
Re:hmm.... (Score:5, Insightful)
Registrars can takedown domains for net abuse, the main thing is their terms of service are between them and their registrants, they enforce their policies.
The easyDNS Plain English terms of service state domains will be taken down for net abuse, but if you want to compel a takedown from the outside because *you* say it's illegal, you need a court order.
Re: (Score:2)
but if you want to compel a takedown from the outside because *you* say it's illegal, you need a court order.
And if you want to ask a registrar to review the activities of one of their registrees to see if they're violating the AUP, you don't. I've done it before, I'm not going to start getting a court order to report abusers and spammers and bears, oh my!
Re:hmm.... (Score:4, Insightful)
Registrars can voluntarily do something when asked, so no, you don't have to get a court order to get a registrar to do something. They are absolutely supposed to let people move their domains when people want to also, but some of them weren't following the rules. Having them follow the rules is a good thing.
If, however, you want to force a registrar to do something which isn't part of the rules, then yes, you should have to get a court order.
Did you like the scenario where companies don't have to follow the rules you both agreed to? Most of us don't.
Re: (Score:2)
Re: (Score:2)
do we have to go thru a court to get a registrar to do something? that isn't reallllly that good of news.
It's called due process. I'm guessing you're the type of person who would also complain if they were locked up without a trial.
Re: (Score:2)
Yes you SHOULD have to go through court for this.
Same as with anything else that seeks to compel the behavior of another.
Godaddy (Score:5, Informative)
As someone who had godaddy hold my domain hostage, this is great news.
GoDaddy had received a single complaint from an anonymous source, which was apparently enough for them to threaten to revoke my domain if I didn't pay their $200 extortion fee.
Re: (Score:2)
NoDaddy: for all your hosting "needs."
Domain Registars to avoid (Score:4)
As someone who had godaddy hold my domain hostage, this is great news.
GoDaddy had received a single complaint from an anonymous source, which was apparently enough for them to threaten to revoke my domain if I didn't pay their $200 extortion fee.
Buried in the ruling the offending registar is named: PublicDomainRegistry.com (PDR Ltd) wouldn't let EasyDNS do the transfer. Add GoDaddy to the list, what other registrars should we be voting with our wallets and abandoning?
Re: (Score:3, Informative)
GoDaddy, oh man. Hard to believe that I used to actually recommend them to clients for hosting. Then they started in with those ad campaigns that made Hooters ads look like church bulletins. That alone guaranteed that I would never recommend them again, even without the accompanying rumors of assorted other sleazy practices. It's a shame too. Their hosting was reasonably-priced and pretty reliable in its day.
Re: (Score:1)
The information is very well hidden in the FA, but this applies to Canada. The "City of London" will be the one in Ontario. Do decisions of this kind apply in other countries? - I'd guess not.
Re: (Score:1)
You're half right. The City of London police in the UK sent emails to registrars round the world asking them to take down domains. A surprisingly large number complied.
This case is in Canada, but the original request came from the UK.
Re: (Score:3)
The city of London, or the City of London?
http://en.wikipedia.org/wiki/City_of_London [wikipedia.org]
Up next, a discussion of "United Kingdom"
Re: (Score:1)
Re: (Score:2)
Probably. It's an ICANN ruling, so as far as I can tell it applies to all ICANN registrars.
What doesn't apply worldwide is the "court order". If an American court tries to issue a court order for a Chinese registrar to hold a name, the Chinese company is probably not required to follow the order, so per ICANN they'd have to release the name. On the other hand, a Chinese order would have jurisdiction, so the registrar would be able (and likely required) to hold the name.
Re: (Score:3)
The information is very well hidden in the FA, but this applies to Canada. The "City of London" will be the one in Ontario.
The "City of London" being referred to is the one in the UK. It says as much in the linked ruling:
On September 24, 2013, the City of London Police issued a Domain Name Suspension Request regarding a large number of domain names, including the three at issue in this case. The Request asked the relevant registrars to do the following: We request that you review your processes to see if you provide a service for the identified domain(s). If so, we would ask you to review the terms and conditions on the basis of which that service is provided and withdraw or suspend the service if you are satisfied that the terms and conditions have been breached.
This is the infamous "takedown order" that asks a registrar to review a customer's actions with respect to the registrar's own acceptable use policy and make their own decision. The ruling continues:
This request was for the following reason: "The owners of the aforementioned domains are suspected to be involved in the criminal distribution of copyrighted material either directly or indirectly and are liable to prosecution under UK law."
which makes it clear that it is the City of London in the UK. But this ruling actually has nothing to do with the City of London, it applies to domain registrars.
Re: (Score:2)
No, this is the City of London that is a country-within-a-country in the the UK, and England's smallest city.
Re: (Score:2, Interesting)
I also had GoDaddy hold my domain hostage, it was for a web security site, mostly used to find security holes in OSS as a hobby. Someone reported my site to GoDaddy and said it was a "hacking website" so I had to pay GoDaddys "penalty fee" to get control of my domain again so I could transfer it to someone else. I read through all their ToS and there was nothing about this "penalty fee" anywhere, which I pointed out to them, they replied with something along the lines of tough shit (they used nicer language
Re: (Score:2)
File in small claims court for the extortion fee.
Good, my domain & domain server will stay onli (Score:2)
There's money at stake (Score:5, Insightful)
The rest of us, of course, can all go to hell as far as ICANN is concerned.
Re: (Score:2)
Give them their due - they did some significant good recently by nailing the creator of the Blackhole Exploit Kit (http://threatpost.com/viable-blackhole-successor-could-take-years-to-emerge/103492)
Re: (Score:2)
The frightening thing is that Microsoft has done more to fight botnets in any given month than the collective law enforcement of the world ever.
Re: (Score:3)
But the private sector can always do it better! The Libertarians say so!
I'm not entirely sure which way you're arguing here, as a lot of people errantly assume that ICANN is somehow a part of the US government. You may already know that the colossal fuck-ups known as ICANN are actually a nonprofit private organization [wikipedia.org]. Personally I take exception with their "nonprofit" status as clearly they are, at the very least, driven by interest in producing profit for their members.
Re: (Score:3)
But the private sector can always do it better! The Libertarians say so!
They can.
The problem is there are 7,000,000,000 different opinions on this planet about what "better" means, exactly.
Thanks EasyDNS. (Score:3)
I have used EasyDNS in the past, and found them a very pleasant company to deal with.
Re: (Score:2)
Its a pity they didn't fix their DNS record management system until after I had to bitch about them on twitter. Other than that, happy with them for over a decade.
Re:Thanks EasyDNS. (Score:5, Interesting)
EasyDNS is a great registrar. Some years ago I had an issue with one of my domain names because a law firm in North Carolina registered a very similar name. The only difference was that they inserted a hyphen in their name and I didn't have one. Naturally some of their clients omitted the hyphen in the address and I received the emails instead, which I passed on to them.
That was a mistake. The law company was very angry at me, and they accused me of intercepting their mail, using my domain in bad faith, etc. They ignored the fact that my domain name was registered over 5 years before they registered their name. They attempted to get EasyDNS to lock my domain and transfer it to them. They attempted to harass both me and EasyDNS. Eventually they attempted to take my domain through ICANN name dispute resolution proceedings, which failed. They even attempted to get the FBI involved, which resulted in an interesting interview with two agents, but nothing else.
EasyDNS was wonderful. They investigated and they decided there was no reason to interrupt my domain service. They supported me through the resolution proceedings. I would not use any other domain registrar for any domain name I really care about.
EasyDNS isn't the least expensive registrar, but they aren't the most expensive either. The fact they in Canada (and therefore outside USA jurisdiction) is an added bonus.
Re: (Score:2)
Naturally some of their clients omitted the hyphen in the address and I received the emails instead, which I passed on to them.
Yes, doing anything beyond reading the errant email and laughing, and then deleting it, is begging for trouble. I used to have the .com version of an ISP's .net and it is remarkable the number of people who think the only TLD is .com. And that when they send their email to the wrong place, it's your fault for getting it.
That includes a rather large software/OS company located somewhere in Washington state, that kept sending me email they intended for a partner at the .net address.
Re: (Score:2)
EasyDNS isn't the least expensive registrar, but they aren't the most expensive either. The fact they in Canada (and therefore outside USA jurisdiction) is an added bonus.
Surely by using a registrar in a jurisdiction other than the one the TLD in question is based in you are increasing your vulnerability to court orders forcing transefer of the domain. If you registrer a .com domain with a canadian register then surely a US court could order ICANN to transfer it while a canadian court could order your registrar to transfer it.
Re: (Score:2)
Stop linking that shit every time someone mentions DNS. If you actually research the writer, you'd never - EVER - lend any credibility to anything he ever wrote again. Basically some registrars cut him off for spam, child pornography, and in one case not paying the bill, and he complains that they're the corrupt ones? Yeah, nah.
City of London = Privately owned Corporation (Score:4, Interesting)
the City of London is a privately owned corporation. I would imagine their police are also.
Do not mistake London the city with the City of London.
http://www.theguardian.com/commentisfree/2011/oct/31/corporation-london-city-medieval [theguardian.com]
Re: (Score:3)
They exist in another time-space, I'm certain of it...
Midsummer Day? Are you effing kidding me?
Re: (Score:1)
Midsummer Day and Michaelmas are two of the Quarter Days (the other two are Christmas Day and Lady Day - https://en.wikipedia.org/wiki/Quarter_days). A lot of significant events used to happen on the Quarter Days, though they don't have much significance nowadays.
namecoin to the rescue (Score:2)
Alternative summary? (Score:2)
The summary and some of the replies seem a little misguided. I've probably got it wrong as well, but here goes.
Essentially, the City of London (the borough, not Londinium itself) emailed or wrote to domain registrars asking that they suspend the domain of what they alleged to be copyright infringing sites. This was a request, not an order. As we know a lot of domain registrars really don't give a toss and suspended the domains, probably without investigating whether the takedown request was accurate at all.
Re: (Score:2)
The big question I have is what happens next? Do icann ask the losing registrars nicely to folow policy and transfer the domains or do they actually force the transfer?
National Association of Boards of Pharmacy (Score:5, Interesting)
I don't understand /. here (Score:2)
You villify the MPAA/RIAA mafiaa, agree with Voltaire on defending the right to free speech, hate NSA and RSA,
AND YET
you say that EasyDNS is in the wrong here?!? I don't get it. I just don't. Regardless that the defendant here was another registrar rather than the City of London itself, the question remains the same: can a police department authorize the seizure of property without so much as a court order? If so, why not do away with the courts altogether since police agencies now play the roles of ju