Yesterday, Wired ran a story on the Cayman Islands bank that got Wikileaks.org blocked. This story said, in part:
When the bank’s lawyers indicated they would be filing a suit, she asked them to tell her where so that Wikileaks could find an attorney in the appropriate jurisdiction to represent it. She says the lawyers refused to tell her. Two and a half weeks later, the bank filed a restraining order against Dynadot and Wikileaks in San Francisco. Wikileaks received notice only a few hours before the case went to a judge who accepted the agreement between Dynadot and the bank.
(emphasis mine)
Now, Dynadot and this Cayman Islands bank apparently had an agreement to block wikileaks.org already. Not only did Dynadot effectively take wikileaks.org down, but also they “lock(ed) the wikileaks.org domain name to prevent transfer of the domain name to a different domain registrar.” The U.S. Disctrict Court for Northern California issued this injunction without ever giving Wikileaks a chance to respond. The bank only filed the request against Dynadot. Apparently Wikileaks received notification that this was going to happen only 6 hours before the hearing (an incredibly short time in legal terms), nowhere near enough time to prepare a case.
Now, the reason I post this is because I have looked at Dynadot as a registrar before. They have good prices and a whois privacy service that makes sense: where you remain the owner of record, making it easier if you need to transfer the domain or prove your ownership of it.
But before signing up, I read their AUP carefully. Among many alarming things, I noticed this paragraph:
You further agree that Dynadot, in its sole discretion and without liability to You for any resulting loss or damages, may take immediate corrective action, including, but not limited to, removal of all or a portion of Your domain services and/or deletion, suspension, cancellation, termination, or other interruption of domain services or Your customer account with Dynadot, at any time during the term of this Agreement, in the event of notice of any possible violation of this Agreement by You or Your end users, or if such service or account is used in association with morally objectionable activities, or for any reason whatsoever. In such cases, any and all fees paid to Dynadot will be non-refundable and ineligible for account credit.
So, I thought I would write to them about it. Here is an excerpt from their response:
We always conduct an investigation before taking action against a domain. We will give you a chance to respond to the complaints.
From Wired’s story, it doesn’t look like that really happened. The US Government has already issued advisories about Cayman Islands banks, and it is unclear (to me at least) what law Wikileaks broke, or how Dynadot could find their actions of exposing fraud “morally objectionable”. What’s more, collaborating with the bank to get a takedown order written, but not talking to Wikileaks, seems to go against their statements to me (assuming again that the Wired story is accurate).
Here is my entire mail. You may also find archive.org’s copy of the AUP from last July to be helpful. (I wrote the email in November, and they’ve added some sections since then, so the section numbers don’t necessarily match up)
| Subject: Re: SITE: Questions about your AUP |
| From: Dynadot Info <info@dynadot.com> |
| Date: Sat, 3 Nov 2007 13:42 -0800 |
| To: jgoerzen@complete.org |
Hello, Thank you for your email. Responses are below. Best Regards, Dynadot Staff -------------------------------------------------- DYNADOT... $8.99 domain names... $1/mo. web hosting http://www.dynadot.com
Hi, I currently have several domains being hosted with Gandi. I have long been looking for someone that can provide a level of privacy for my whois data in a sane way. I think Dynadot is the first I've seen that looks like it can do that and still be affordable. In preparation to transfer over a first test domain, I read your AUP and frankly am quite troubled by what I saw. I hope that you can allay my fears. In section 4 of part 2, the last paragraph states that Dynadot "for any reason whatsoever" may delete, cancel, or terminate my domain services or customer account. It also lists "notice of possible violation" as a justification for that. That makes me even more nervous -- any random person could send you an email claiming something nefarious is happing with my domain name, and I'm agreeing to just let you delete it because of that?
We always conduct an investigation before taking action against a domain. We will give you a chance to respond to the complaints.
A very similar clause appears in section 7 of part 1 ("cancellation of services"). It goes on to cast a very broad net around objectionable material and says that Dynadot decides what's objectionable. Now, if you go to my website at www.complete.org or blog at changelog.complete.org, you'll see I'm an upstanding netizen. But the AUP says that things that "are designed to or effectively... embarrass" third parties could get my domain cancelled. So if I post a review of Vista that says I think Microsoft did a poor job of engineering, would my account be yanked if one of their engineers complained? What if I (legally!) linked to a Comedy Central sketch using real TV footage to mock George W. Bush or Hillary Clinton?
The cases you described above would never happen with us. Complaining about Microsoft or making fun of George Bush are protected free speech. The service agreement is designed to give us some flexibility in dealing with customers that break the law.
I'm particularly concerned about this because apparently DynaDot felt it worthwhile to try to take down the website of someone that found a security hole: http://www.jhuskisson.com/friends/dynadot-fights-back-bans-nick-from-everything While I wouldn't condone step-by-step cracking instructions in most cases, this is concerning to me.
He was posting a step by step guide to hacking our website, which is illegal. The hack did not work, but we noticed an upsurge in strange activity in our logs, so we requested the hacking guide be taken down.
Finally, item (i) under the Domain Privacy Service section says that you could immediately reveal all my information upon the receipt of merely a *claim* (not even a court order), even if it's invalid. But I thought that NOT doing this was what you were saying made your service better, over at http://www.dynadot.com/resource/article/qa.html?aid=0
Once again we need to build some flexibility into our service agreement to deal with people who use their domains for criminal activity. Otherwise we could be liable for the damages that they cause to others. So far, we have never dropped anyones privacy except in the few cases we were forced to by a FBI subpoena.
I know this is a long message, and I appreciate your time. I really do want to use your service, but -- no offense intended -- I want to make sure I'm not dealing with scammers first, and from reading the AUP, I'm not so sure!
No offence taken. I will email our counsel to see if we can tighten up the agreement a bit.
-- John Goerzen
Its odd that they attacked the DNS and did not affect the server in the US (vs the ones in other countries). So the DNS company can ‘take hostage’ your DNS records? Its seems like their needs to be a ‘Pirate party’ DNS so that folks can know that this type of website can not be beholden to DNS companies that don’t want to challenge a takedown request even a little and keep the legal process hidden despite their claim to the contrary. I guess these cases are tests that digital free speech advocates need to go through and learn how to ‘route around’.
Out of curiousity: why were you thinking of moving away from Gandi? I always thought their “Terms and Conditions” to be very good (or has there been a change recently?)
They are, and that’s why I’m still there.
Gandi doesn’t provide whois privacy, which is annoying. Companies that do — if you find a good one like register4less — will still keep your name as the owner. But your address and phone number will be replaced with a service that the registrar operates, in which they typically forward anything non-spammy to you and trash the rest. It is annoying to get physical junk mail just because I own a domain.