WIPO Gives EFF Control Over Bogus Domain Used To Distribute Keyloggers And Other Malware

from the more-than-mere-cyberquatting dept

The World Intellectual Property Organization (WIPO) has actually used its powers for good, stopping an Indonesian citizen from spreading malware while taking the name of the EFF in vain.

The Electronic Frontier Foundation's website is eff.org. The squatted-on domain was electronicfrontierfoundation.org. As the real EFF vigorously fights against exactly the sort of thing being distributed by the fake site (spyware and malware), it had a legitimate complaint against the cybersquatter that went far deeper than mere trademark-related confusion.

The disputed domain name was registered on August 4, 2015.

On August 13, 2015, the Complainant was informed that the disputed domain name was being used to confuse consumers by redirecting them to the Complainant’s official website only after surreptitiously installing malicious software on the computers of unsuspecting visitors. According to an affidavit of a Staff Technologist of the Complainant, the malicious code exploited a known vulnerability in the computer programming language Java, by disabling Java security settings which allows it to execute arbitrary Java code without having to ask for the user’s permission.

The incident was reported in the media, for instance in an article published on August 28, 2015 on the website of Ars Technica under the title “Fake EFF site serving espionage malware was likely active for 3+ weeks”.

The EFF's complaint against the cybersquatter also pointed out that the URL was being used in bad faith, implanting computers with keyloggers and being used as a backdrop for a spear phishing campaign.

The Complainant contends that these facts strongly suggest that the disputed domain name was registered for the purpose of supporting a phishing campaign, i.e. an attempt to discover sensitive information such as usernames, passwords or personal details, by confusing consumers into believing that the attacker, to whom information is actually being provided, is in fact a different, trustworthy entity to whom consumers desire to provide information.

WIPO found that the EFF's complaint satisfied multiple prongs of its domain name dispute resolution process. The trademark on the name itself dates back to 1993 and the use of the bogus site to deliver malware payloads added up to "bad faith" use.

The domain has been taken from Shawanda Kirlin of Bali, Indonesia, and given to the EFF for its own use. This will kill off one arm of a sophisticated malware campaign with possible ties to the Russian government and prevent further abuse of internet users looking for information on privacy and security.

Filed Under: cybersquatting, domains, keylogger, malware, wipo
Companies: eff

Motion Picture Academy's Five-Year Quest To Make GoDaddy Pay For 'Infringing' Websites Ends In A Loss

from the we're-still-big,-it's-the-courts-that-got-small dept

Back in 2010, the notoriously-litigious Motion Picture Academy sued GoDaddy for allowing a bunch of "infringing" domains to be registered. According to the Academy, anything that might use the word "Oscar" is under its control, thanks to several registered trademarks. Trademark infringement doesn't fall under Section 230 protections, which is basically the only reason this lawsuit managed to stay alive for five years.

Now, it's finally over. (Well, pending appeal…) Kieren McCarthy of The Register is reporting that the court has found in favor of GoDaddy.

The Academy was seeking $31m in damages for 293 domain names that it identified as being registered with and hosted by GoDaddy. An original list of 151 domains in 2009 was subsequently added to as the complaint progressed through the courts.

However, a significant number of the names registered were either found not to infringe the Academy's trademarks or were being used legitimately (usually by people called Oscar).

Far too many trademark holders believe holding a registered wordmark gives them veto power on any use of that word. This simply isn't the case, but acts of faith predicated on this belief have resulted in multiple bogus lawsuits and an even greater number of baseless legal threats.

The court found that GoDaddy had a significant number of domain-squatting deterrents built into its system. And, even if it didn't, the sheer number of domains registered with the company makes it impossible to police thoroughly, or at least not to the extent the Academy would like.

GoDaddy is the largest domain name registrar in the world with approximately 60 million domain names under management. GoDaddy has registered more than 150 million domain names since becoming an ICANN-accredited registrar in 2000, averaging over 25,000 domain registrations per day. On average, GoDaddy registers a domain name every 0.7 seconds.

[...]

Requiring GoDaddy to subject each domain registration to a costly, manual legal review is not commercially practical and would dramatically increase GoDaddy’s costs, which would in turn be passed on to the consumer.

The Academy further claimed that GoDaddy violated its trademarks with relevant ads (from Google) running on parked domain pages.


GoDaddy pointed out that it had no control over what ads would be run by Google on parked domain pages. It further pointed out that the Academy could have contacted Google to prevent the placement of Oscar-related ads on parked domain pages, but chose not to.

Google has implemented a comprehensive trademark protection policy for those domains participating in AdSense for Domains.

Despite being aware of the protections afforded by Google’s trademark policy, AMPAS (Academy of Motion Picture Arts and Science) chose not to avail itself of the policy in relation to any of the domain names at issue.

AMPAS never contacted Google to object to the use of the AMPAS Marks in Google’s AdSense program, nor has AMPAS complained to Google that the use of the AdSense or AdWords programs infringe on the AMPAS Marks.

The court also noted that GoDaddy makes several proactive efforts to protect trademark holders -- like warning prospective registrants against registering domains using trademarked terms as well as shifting the liability to registrants, who must agree they are not knowingly committing infringement before a registration is granted. On top of that, GoDaddy strips ads from any domain being disputed to ensure no one is capitalizing on possible infringement.

Beyond its internal constraints, GoDaddy is forbidden by ICANN from unilaterally cancelling registrations. To do so without the permission of the registrant, a court order must be presented to GoDaddy. Obviously, this is what the Academy was seeking, but it skipped a step by taking GoDaddy to court for not immediately killing registered domains the moment the Academy started getting grumpy about it.

Because this is a trademark case, the Academy's arguments revolved around GoDaddy profiting from allowing the registration of "infringing" domains. As noted above, GoDaddy stripped all ads from the parked domains the Academy complained about. Even the sites that remained active hardly generated any money for GoDaddy or the registrants themselves. Over the years, the Academy has claimed anywhere from $6 to $31 million in damages. The court does the math and finds that if anything was actually owed to the Academy, the check amount wouldn't even reach four digits.

GoDaddy received approximately $107 in total revenue from popunder and Google-provided, third-party pay-per-click advertisements on seventy-two (72) of the 293 domain names at issue. The pop-under revenue accounted for less than $1 of the total revenue.

Of the 293 domain names at issue, 221 domain names generated no revenue from Google-provided, third-party pay-per-click advertisements. The most revenue generated by any domain was $13.67.

The total page impressions recorded from 2005 to 2014 for the 293 accused domains was 48,763: (a) 60 accused domains had less than or equal to 10 impressions, (b) 244 accused domains had less than 100 impressions. Some of the recorded impressions were made by AMPAS’s counsel and consultants. The 48,763 recorded impressions on the accused domains represent 0.00044% of all impressions (10,997,067,487) on all domain names participating in one of GoDaddy’s Parked Page programs.

The court finds that GoDaddy made significant good faith efforts to resolve the issues brought to its attention. Not only did it proactively strip ads from offending domains, but it instituted additional keyword blacklists for future use. But this wasn't good enough for the Academy, which still believed the only reason anyone would use the word "Oscar" in a domain name was to siphon profit away from the Academy.

As Kieren McCarthy points out, the Academy long thought it had an open-and-shut case. That's the sort of misconception often accompanies inflated senses of self-worth. To the Academy, the word "Oscar" only refers to one thing. But on the internet, it can mean thousands of things -- most of them entirely unrelated to its annual bloated act of self-congratulation.

Taken overall, the five-year court battle highlighted an enormous clash of cultures. The Academy Awards believes that anything at all to do with its name represents a calculated effort to extort millions of dollars, while GoDaddy as a company that deals with the broader internet and millions of web addresses barely registers the Oscars existence in their systems.

The decision will undoubtedly be appealed, but there's not much in this decision that points to a more favorable outcome. The Academy threw it weight around and expected that would be all it ever needed to do. It failed to provide anything that backed up its claims that an internet entity was (yet again) screwing a legacy out of its "rightful" earnings. GoDaddy, on the other hand, showed the court it had done everything it could to assist the Academy in its ridiculous trademark protection efforts, and got thanked for its efforts with five years of litigation.

Filed Under: domain registration, domains, oscars, secondary liability, third party liability, trademark
Companies: godaddy, motion picture academy, oscars

Walmart Not Horsing Around With Parody Domain Site

from the neigh dept

Walmart. Just saying the company's name is usually enough to evoke unbidden brain-sounds of terrifying organ music and images of pitchfork-wielding devil-imps. But, hey, it's a large business that's been around for quite a while, so I guess it's doing alright. It seems to me that somebody might want to call a meeting with the Walmart legal brain trust, because the company's campaign against a silly and simple parody website isn't achieving much of anything at all, and is in fact Streisanding the parody site into national views.

This story starts back in 2012, when ICANN saw fit to hold a firesale on domain extensions. Buying them up was all the rage for reasons unfathomable to this author. Still, that was the impetus for how we arrived at Walmart going after a site with a .horse extension.

That explains why, for the mere price of $29, you can now purchase a .horse domain name, if you want to do such a thing. "With .HORSE, there are no hurdles between equine enthusiasts on the Internet," says United Domains. "Giddy up and register .HORSE today!" It doesn't seem like too many people have been receptive to this pun-based sales pitch, but a 34-year-old named Jeph Jacques saw the opportunity for what he calls an "art project."

"I thought, 'Alright I'm gonna buy this and do something stupid with it and see what happens," he told me. And readers, he did just that.

This grand art project? Buying up the domain www.walmart.horse, slapping a picture of the front of a Walmart store with a, you guessed it, horse superimposed over the top, and declaring the whole thing a monumental artistic success. Seriously, this is the only thing at the website if you go there.

Monet it might not be, but the image is suddenly competing with the likes of famous artists for attention and views thanks to Walmart freaking the hell out about it. In its infamous wisdom, Walmart and its crackerjack legal team have demanded that the whole shebang be taken down, claiming infringement of trademark. The C&D letter Walmart helpfully sent along suggested that Jacques' website would confuse customers into thinking that Walmart, who is not in either the business of horses nor in the business of having a sense of humor, might have some affiliation to walmart.horse. Interestingly, the letter targets the domain name, rather than the image on the site itself. I'm not personally aware of any infringement claim on domain name being refuted by the actual extension used, but this would seem to be a ripe candidate for that argument, given that Walmart is not in the horse business.

But this really shouldn't even get that far, given the whole purpose of the site itself and the artistic nature of the creator.

Jacques argues that his site is "an obvious parody and therefore falls under fair use." He also told Walmart in his response that he'd be happy to put a disclaimer on his site to let visitors know he is not actually affiliated with the Waltons. And although he doesn't want to bow to the company just yet, he says he's already proved his original hypothesis: that corporations spend an absurd amount of time policing their trademarks.

Point proven, I suppose. Meanwhile, a tiny joke site has been Streisanded into the national conversation because Walmart just couldn't resist.

Filed Under: domains, horse, jeph jacques, parody, streisand effect, trademark
Companies: walmart

5,000 Domains Seized Based On Sealed Court Filing; Confused Domain Owners Have No Idea Why

from the that-seems-problematic dept

In the past, we'd been fairly worried about governments seizing website domains with little or no notice, but it's perhaps equally, if not more, troubling when it's done by private individuals and companies. This was one of our concerns with the original version of SOPA, which included a "private right of action." But, even though SOPA never became law (and the private right of action was dropped fairly early on), it appears that some courts are still allowing this to happen. Just a couple of months ago, we wrote about a troubling ruling in an Oregon district court that let a Filipino entertainment company seize a bunch of domains, in a process that was done under seal. In the past, we've seen other brands, like Chanel do the same thing. Louis Vuitton has also tried seizing domains.

The latest such example seems especially troubling because no one has any idea what's fully happening, but it appears to involve Chan Luu, a jewelry and clothing retailer. The Internet Commerce Association notes that approximately 5,000 domains appear to have been seized, handed over to a private "receiver" who is now trying to sell those domains -- for no clear reason. One of the victims, Michael Berkens, who lost some of his domains, has explained what little details he's been able to find out:

Overnight I received a notice that several domain names I owned were transferred by a sealed court from Verisign without notice and of course without the court order.

The domain names just were transferred by Verisign to another domain and are now listed for sale at another marketplace.

Another domainer sent me an identical notice he received overnight on domain names he owned.

The Domain names are now all owned by COURT APPOINTED RECEIVER – ROBERT OLEA and have been moved to Uniregisty as the registrar and are now listed for sale at domainnamesales.com

The only information that Berkens received was the following email:

Please be advised that Verisign has changed the registrar of record for certain domain names pursuant to a ***SEALED*** court order.

The domain names identified below were affected by this action.

Alexander the Great, LLC
—————————————————————————–
RETRACTIT.COM

If you have any questions relating to these actions, please contact:

David J. Steele
Partner, Christie, Parker & Hale LLP
Adj. Professor of Law, Loyola School
18101 Von Karman Ave, Suite 1950
Irvine, CA 92612-0163
office: +1 (949) 476-0757
direct: +1 (949) 823-3232
fax: +1 (949) 476-8640
email: david.steele@cph.com

Thank you very much,
The Verisign Transfer Dispute Team””

transfers@verisign-grs.com

Others have tracked down that it has something to do with this case, but with the details under seal, it's all a bit of a mess. Here's Phil Corwin from the Internet Commerce Association:

The only other available facts that we are presently aware of are that a copy of the “Clerk’s Certification Of A Judgment To be Registered In Another District” issued by the U.S. District Court for the Central District of California in the case of Chan Luu Inc. v. Online Growth, LLC et al is available at the Justia website, and the order was registered in the Florida Middle District Court. The other defendants in the case are “Grant Shellhammer et al”. There was a considerable time lag in this proceeding, with the original judgment entered in California on May 23rd, the certification dated September 8th, and the domain transfers occurring around October 2nd. The damages granted to plaintiff are $200,000 plus interest, court costs and attorney fees; we note that there is a strong possibility that the domains transferred in this case may have an aggregate market value far in excess of that total judgment, and that is likewise disturbing. The California court document covers domains that are identical or confusingly similar to Plaintiff’s CHAN LUU mark – but we’re not sure if the domain cited by Mike in his article, RETRACTIT.COM, or any of the other transferred domains fit in that category. Chan Luu is a retailer of jewelry, accessories, and ready-to-wear clothing based in Los Angeles, and so far as can be discerned makes no commercial use of the term “retractit”, so it is unclear why that domain was covered by the court order.

This is problematic on many, many levels -- and is exactly why we've been so concerned about any process that allows for domain seizures without any sense of due process. In this case, with all the details under seal and the domain owners having their websites simply ripped away from them with no explanation at all, it should raise serious questions about why courts are allowing this to occur. To take domain names away from people who aren't even parties to a lawsuit, based on a sealed document, and then to immediately put them up for resale seems sketchy beyond belief.

Filed Under: domain seizures, domains, due process, michael berkens, secrecy, trademark, transparency, under seal
Companies: chan luu, verisign

Big Pharma Given Control Of New .pharmacy Domain; Only Available To 'Legitimate' Online Pharmacies

from the guess-who-they-will-be dept

Just over a year ago, Techdirt reported on big pharma's application to run a new .pharmacy domain, and later on an attempt by Canadian pharmacies to prevent that happening. They failed, apparently (found via Intellectual Property Watch):

As the registry operator of the new .pharmacy domain, the National Association of Boards of Pharmacy (NABP), under a contract with the Internet Corporation for Assigned Names and Numbers (ICANN), will soon provide a means for identifying safe online pharmacies and resources. Under the Association’s Registry Agreement, executed with ICANN on June 19, 2014, the new .pharmacy generic Top-Level Domain (gTLD) will be available only to legitimate online pharmacies and related entities located in the United States or other countries. The Registry Agreement also includes a number of safeguards intended to protect consumers around the world.

The question is: what will "only available to legitimate online pharmacies" and "intended to protect consumers" mean in practice? The concern is that these are euphemisms for big pharma shutting out those competitors offering lower-cost products, particular foreign pharmacies, and manufacturers of generics. That fear is not assuaged by the following comment from the NABP in its response to such concerns (pdf)

the .PHARMACY TLD will provide a powerful tool to educate consumers, distinguish legitimate Internet pharmacies from the thousands of rogue Internet drug outlets, and reinforce the value of purchasing medications only from trusted online sources.

Big pharma is clearly as keen as the copyright industries to "educate" consumers about what they ought to be doing. The danger here is that such "education" will include not trusting perfectly safe pharmacies outside the US (in Canada, for example), and not using much cheaper generics. Since NABP now controls this entire domain it will have a free hand to block any outfit that does not subscribe to those views, and thus to attempt to delegitimize them in the eyes of the consumer.

This is something new. Hitherto, there has been no danger of this kind of discrimination against particular classes of Internet users, since registry operators were focused on maximizing profits by getting as many domains issued as possible. That won't be the case for .pharmacy, where the aim is to police the online pharmacy world, and to protect the generous profits of big pharma -- not make a few dollars selling a domain or two. Assuming that happens, we can probably expect other industries to follow suit in creating and controlling new domains, and for the Internet to become less free and neutral.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: .pharmacy, big pharma, domains, generic drugs, online pharmacies, pharmacies, tlds
Companies: icann

Key Sony Gaming Websites Go Down Because They Let Their Domains Expire

from the spare-some-change? dept

As online gaming becomes more and more popular, we're of course beginning to hear stories of occasional missteps in how the online infrastructure is handled. The reasons for this can vary. For instance, maybe you're Electronic Arts and you've both made your game require a connection to your servers but you misjudged the load that would be on those servers. Or maybe you're Electronic Arts and you decide to shut down an online game without refunding the money people have spent to play it. Or, hey, maybe you're Electronic Arts and you decide to pull the plug on online gaming servers extremely soon just to push gamers into buying the next annual sports title. The point is that these reasons tend to be things that could be avoided.

Sony appears to be learning that lesson now, what with the gaming universe both shouting and laughing at them for forgetting to renew the domains on several popular gaming sites they run.

Sony Online Entertainment (SOE) sites www.soe.com and www.sonyonline.net were sometimes redirecting users to generic holding pages from Network Solutions. Some SOE-related sites for games such as Everquest, Everquest 2, Landmark and H1Z1 were also apparently affected.

The reason became quickly apparent: the domains of the sites expired. The details are basically that the renewal emails all went to a junk mailbox set up for an employee that had left the company a while back and were never actually seen by whoever had taken over their duties. SOE President John Smedley, to his credit, isn't even attempting anything besides an admission and an apology.

“The payment notifications went to a junk email box,” Smedley tweeted, adding, “Someone left and it got caught in the replacements junk filter. Simple as that. Embarrassing as that. No point dodging. DNS problems could take up to 48 hours to resolve,” he wrote, adding, “We are really really sorry on this one folks. Embarrassing and preventable. We screwed up.”

Look, it's unfair to expect anyone to never make a mistake, but this all comes off as bush-league stuff that we just shouldn't be reading about when it comes to a company like Sony, with all their experience in running an online gaming platform. Get it together guys. I mean, granted, I have no skin in the game, because I game the way God intended: in a dark room, playing alone, and with a cold craft beer next to me. But, you know, for all the other people.

Filed Under: domain expiration, domains, junk mail, registration, sony games, spam
Companies: sony

City Of London Police Keep Shutting Down Websites With No Court Order

from the how-is-that-legal? dept

We've highlighted a number of stories recently about the City of London Police, who have partnered with a few legacy players from the entertainment industry, and are using a bunch of taxpayer money to try to shut down websites the copyright industry doesn't like -- based on no clear legal reasoning or authority. They often seem to just rely on their name and bogus threats to get registrars to kill sites -- a process that has been found to violate ICANN policies for registrars. However, most registrars just give in, because the City of London Police just look so damn official.

Over the weekend TorrentFreak noted that a few more sites have been shuttered based on no court order, no judicial findings, but just the City of London Police's say so. This includes FileCrop, a site that hosted no infringing files at all, but which is just a search engine. Once again, the police make no effort whatsoever to hide the fact that they're doing the bidding of the legacy entertainment industry -- directly linking to their favored sites and flat out saying that they're supported by BPI, IFPI, FACT and the Publishers Association. Whether or not the sites that are being taken down are, in fact, violating the law, everything about this process is highly questionable. Taking down websites without a court order is a blatant attack on free speech. And, yes, while the UK does not have the same free speech traditions as the US, it does still hold itself out as being a believer in free speech. It is difficult to see the shuttering of a website without any due process as little more than blatant censorship.

Perhaps even more troubling is the fact that this censorship is proudly done to support legacy industries who see the internet as something to be shunned and attacked. How would people respond if the City of London Police suddenly, with no court order, shut down BSkyB and proudly announced it was doing so with the support of the BBC? Or shut down AirBnB and announced it was doing so with the support of the British Hospitality industry? Or shut down EasyJet and did so with the support of British Air? Wouldn't people be outraged?

Filed Under: city of london police, domains, restistrars, search engines, takedowns
Companies: bpi, fact, filecrop, icann, ifpi, publishers association

Sen. Rockefeller Wants ICANN To Block '.Sucks' TLDs

from the a-sanitized-internet...-for-the-corporations dept

Another legislator has weighed in on governing the internet. This time, it's not so much for "the children" as it is for the poor, oppressed corporations of the world.

Sen. Jay Rockefeller, the West Virginia Democrat, strongly suggested that the Internet Corporation for Assigned Names and Numbers, better known as ICANN, the body in charge of approving Web site domain names, should reject a proposal to allow ‘sucks’ as a new generic top level domain, referred to as gTLD.

In a letter to the organization, Rockefeller, who is chairman of the Senate Commerce Committee, argued that the .sucks domain name could be abused by parties “to unfairly defame individuals, non-profit organizations and businesses.”

First off, simply saying a person, NPO or business "sucks" isn't defamation. The content of those sites may meet that bar, but a domain name utilizing .sucks isn't defamatory in and of itself. And it's routinely been found that sites such as walmartsucks, etc. are covered under the First Amendment.

But Rockefeller goes even further than just assuming .sucks domains will be filled with defamatory content. He also assumes that anyone/anything confronted with a .sucks site will be forced to spend money fighting to keep their reputations from sliding into the internet toilet.

“I view it as little more than a predatory shakedown scheme,” Rockefeller said. “The business model behind this gTLD seems to be the following: force large corporations, small businesses, non-profits and even individuals to pay ongoing fees to prevent seeing the phrase ‘sucks’ appended to their names on the Internet.”

What Rockefeller fails to consider is that these entities could also do nothing. Fighting a "sucks" site rarely makes the situation better. But this is the way those to seek to govern the internet view things: as worst case scenarios played out against a Wild West background. There's no room for subtlety in the debate and there's no "fostering" of "conversations," as those marketing these domains state in their defense.

And every new gTLD can be viewed as a "shakedown scheme." Businesses rush to secure (or to block off) new TLDs in order to prevent domain squatters, competitors and critics from snatching them up. Singling out ".sucks" as nothing more than a predatory scheme ignores the reality -- a new gTLD will always be a combination gold rush/shakedown.

Rockefeller points to one registration site, Vox Populi Registry, which is marketing .sucks domain names as "defensive" purchases -- with a starting price of $2,500 which will escalate to $25,000 once the "sunrise period" hits. From this, he extrapolates a "shakedown scheme" across all registration entities, even as others have denied viewing this gTLD as an easy way to hoover up defensive corporate funds.

A spokesman for the other firm, Donuts Inc., said the company “carefully considered the utility of each gTLD for which we applied.”

He also defended Donuts’ business model which he said “is focused on providing Internet users around the world with real choice in how they craft their online identities. We are not soliciting, and have no plans to solicit, ‘defensive registrations.’”

So, there are those who facilitate an open internet, one that will certainly bring out the worst in some people. And there are those who assume only the worst kind of people exist and try to route the internet around them. But Rockefeller, like many other legislators who set their sights on making the web "safe," fails to realize that it's the internet itself that does the "routing," and it views censorship as nothing more than damage to be avoided.

(Rockefeller may be more concerned than most, considering some of his biggest donors -- AT&T, Time Warner and Verizon -- are often referred to in phrases that end with "sucks.")

Rockefeller envisions an internet where corporations and individuals seldom hear discouraging words, but that notion is entirely unrealistic. If he gets his way, the internet (as it were) will simply find another outlet for its frustrations with corporations, non-profit organizations and aggravating people -- and it will still be composed (nearly) entirely of protected speech that "forces" these entities to play defense. And there won't be a thing he can do about it.

Filed Under: domains, jay rockefeller, shakedowns, sucks sites, tlds, top level domains
Companies: icann

Domain Registrars And ISPs: The Soft Underbelly Of Coercive Control

from the know-your-domain-right dept

When I first got into this business I frequently wondered why the domain-policy mailing lists I was getting involved in attracted a lot of activist types.

Over the years it became apparent to me very quickly, that in an emerging era of global communications and transparency (what Anthony Wile calls "The Internet Reformation") - that "the name" (the domain name) along with the ability to "locate it" (DNS) was a central, all-important "secret sauce" to the entire internet.

But it was only gradually that I became aware that it would take centre stage politically and and become the battleground between forces for liberty, free speech and emerging civil & business models on one hand and entrenched reactionary, authoritarian, cronyist kleptocrats on the other.

Hence those passionate activist types (some of whom I used to tirelessly argue with) were getting so worked up over the high-intensity Orwellianism that they could sense coming somewhere over the event-horizon.

While the co-opting of this marvellous internet into an all pervasive surveillance apparatus is a paramount issue, it is outside the scope of this article. Consider it one side of a dual-pronged approach of modern-era repression and totalitarianism.

The other side of that vice is the DNS and naming system of the internet which is the "choke point", where control can be exerted, censorship implemented and protection rackets flourish.

In a world where news travels over the internet before the traditional media is even aware of it, where non-sanctioned, unofficial sources can audaciously disseminate the truth without central planners massaging, spinning or heavily redacting it; the domain name, or the DNS that powers them is basically the dial tone of the entire global communications medium. Take out a domain or its DNS, you shut down it's voice, it's message or it's economic activity. You make it go away.

Without getting too detailed with the technical specifics (although I'll happily talk the ear off of anybody who asks me about it), the "inverted tree" structure of the DNS naming system distributes power in the following pattern:

1. The Root < -- ICANN
2. The Top Level Domains (com, net, org < ---- Verisign, Afilias, Public Interest Registry, Neulevel and soon all the new ones, Donuts, etc)
3. Second level domains (registrars, DNS providers, web hosting providers, ISPs)

ICANN is conspicuously absent from curating the interests of global stakeholders within the overall naming scheme. Because of this, US law applies across most of the internet, and in the absence of a concerted effort to address global interests (no, not globalist interests, I mean "also considering interests from outside the USA") there will eventually be a root level net split and won't be pretty (yes, I'm fully aware how crazy that sounds now, I always sound crazy about 5-years in advance.)

At Level 2, the registry operators are themselves, pretty big and pretty bureaucratic - if a vested interest wants to compel them to do something they know they have to get a legal basis to do it, like a court order.

So the soft underbelly of coercive control starts at Level 3, which is rife with myriad third parties falling over each other to "serve" registrars, DNS providers, web hosts and ISPs with various facades of "legalese" designed to baffle unwitting abuse desks into submissive compliance with purely "made up" takedown rationalizations.

If you remember the Simpsons episode where Monty Burns is being committed to a mental institution against his will for becoming inordinately enthralled with the difference between "Ketchup" and "Catsup", he is informed by Chief Wiggum as he is being dragged up the steps to the asylum: "Relax…you've gone off your nut and you're being committed to a mental institution…. those grocery store clerks signed the commitment papers".

That's about the best description there is of today's "takedown request" racket that is overrunning the internet.

Quite literally "some guy", in England or "someplace" (often times in England tho), will email a registrar or a DNS host in some other country entirely and will tell them "Hi! I'm an 'internet investigator' here in some place in some official capacity, and the following domain names are operating in contravention to some laws here. So, uh, take the domains down. Ok?"

And more often than not, the recipient will simply AGREE and just do it.

If they do not comply right away the "official guy somewhere" will tell the recipient that if they do not comply then they are themselves in some sort of legal trouble (or in violation of some contractual obligation which some official guy somewhere is not even a party to) and there will be trouble.

Recipient usually agrees and shuts down the domain. Which, absent some obvious network abuse issue, I find mind-boggling. Some of the letters we get from private, non-governmental, self-appointed "regulatory" bodies with no legal or enforcement powers anywhere on earth contain claims and make leaps of logic which are on par with fantastic narratives spun in Nigerian 419 scams.

That some of the largest ISPs and registrars in the world actually take them seriously and shut down entire businesses on this basis is nothing short of criminally negligent.

But shut down they will. Somebody with a badge out of a box of Cracker Jacks can probably email your registrar right now and tell them to unplug your domain name from the internet and there's a good chance they'll do it.

People may tell me to calm down, because right now the most common targets seem to be "dodgy" websites (like "rogue" pharmacies), but as we've noted elsewhere, the script we laid out in First They Came For The File Sharing Domains is playing out nearly verbatim in the three years hence. And there was an extra-judicial attempt to take out Wikileaks for the crime of egregious truth telling.

All of this begs the fundamental question of due process, something these ersatz enforcement agencies are happy to throw overboard and replace with their own Calvin-ball interpretations of reality.

So if or when it happens to you, you should know this:

Unless there is a court order in the jurisdiction of the Registrar who shuts you down - they CANNOT stop you from transferring your domain out to another Registrar.

That is your basic domain right (notice it's in the singular). It was just upheld by an NAF panel under an ICANN TDRP proceeding. We're in the process of doing this again right now for another client who had their fully compliant Canadian business, doing business from and in Canada was shut down entirely when literally "some guy in England" emailed their US-based registrar and told them to shut down their domain - which they promptly did, no questions asked (watch our blog as this unfolds).

Hopefully before long Registrars are going to wake up and realize that Chief Wiggum can't compel them to take down, hijack and lock your domain name unless he has a court order from some place other than Springfield.

Mark Jeftovic is CEO of easyDNS

Filed Under: dns, domain transfers, domains, mark jeftovic, web hosting
Companies: easydns

Pharmacy Group Lies To Registrars: If We Complain About A Site, It Must Be Taken Down No Questions Asked

from the that's-not-how-it-works dept

This is incredible. Just yesterday we wrote about how EasyDNS won its arbitration case, saying that a registrar cannot takedown and block the transfer of a domain name just on the say so of law enforcement or anyone else not carrying a court order. And, the very next day, EasyDNS is reporting on an absurd letter it has received from the National Association of Boards of Pharmacy, which argues exactly the opposite of what the arbitration panel told EasyDNS.

Incredibly, it says that if it complains about a domain, the registrar must take it down:

"Upon receipt of an abuse notification, some Registrars claim that a court order is required or that they are not violating the laws of the Registrar’s country. Both assertions are wrong."

Except, as EasyDNS points out, the arbitration ruling says that it's the NABP that's wrong, and that a court order is required. Similarly, the NABP claims that registrars must freeze the domains, even without a court order.

You should not allow domain names engaged in the illegal sale or distribution to transfer to another Registrar: the question of legality does not relate to where the Registrar is located, but rather to the activity of the Web site.

But, again, the arbitration ruling, which merely read from ICANN's own rules, says the exact opposite -- noting that you clearly need a court order

The NABP also tries the same direct misreading of ICANN's rules that Public Domain Registry used, to pretend that "fraud" is a reason to deny transfer, but as the arbitration ruling found, that claim is simply incorrect. The "fraud" referenced in the rules is only fraud concerning transfers not fraud in terms of what the website was used for.

There's much more in the letter as well. There is some history here. The NABP is basically an organization designed to artificially inflate the price of drugs in the US, cynically using highly questionable claims to pretend that they're focused on "public safety." For years, the NABP has worked hard to keep legitimate but cheaper versions of drugs outside the US, so that US pharmacies (and the drug companies they work with) can charge increasingly insane prices for drugs. Because they can use the specter of "fake drugs killing people!" they're able to do all sorts of nasty attacks on foreign pharmacies that are selling perfectly legitimate drugs to willing buyers, by claiming that they put people's lives at risk.

And, now, it appears they're going even further in trying to basically create a "SOPA-like" setup, whereby registrars are required to pull down any domain based solely on NABP's say so without any judicial review at all. The fact that this is happening at the same time that City of London Police are doing the same exact thing (at the urging of the legacy music/movie industries) isn't an accident. While the supporters of SOPA insist that there's no new legislation coming, they're all trying to do an end run around all of it, creating something that's even more extreme than SOPA by getting registrars to simply kill sites they don't like based on nothing but a complaint.

EasyDNS's Mark Jeftovic says it all in his blog post about it, noting that this is why they fought back against COICA/SOPA/PIPA:

It really is getting creepy out there.

We now know that we live in a total surveillance society, governments are printing money, going broke, manufacturing consent and lying about nearly everything; while quasi-governmental agencies all over the world are now asserting they have the authority to overturn legal process and basically dictate everybody else's business.

This script is playing out almost verbatim what we wrote only three years ago in "First They Came For The File Sharing Domains".

Who will be the next batch of clowns who tell us they can use liberally interpreted language in a couple of agreements that they aren't even party to to compel us to takedown your website? Let's start a betting pool.

This is why pushing back and standing up for internet freedom is so important. The attempts to control, to censor, to block and to silence are only increasing. The legacy players who can't stand competition or innovation are looking for any way to hold back the future, and that means attacking the public's ability to make use of the internet and to speak freely.

Filed Under: censorship, domains, mark jeftovic, registrars, takedowns
Companies: easydns, icann, nabp