"How to kill a website with one email"
Chris Croughton
http://www.theregister.co.uk/2004/10/14/isp_takedown_study/
According to the article, an organisation put up Public Doman text, then
sent a 'complaint' via a Hotmail adress to the Dutch ISPs hosting the
site. 7 out of 10 took it down without checking (even though the text
on the site stated that the material was PD), including Tiscali,
Wanadoo, Demon Internet and Planet Internet. One host (iFast) even gave
the customer details to the complainants without even being asked.
Am I surprised? Not in the least. Do I expect it to happen "for real"
(malicious taking down other people's sites)? Certainly, as has been
predicted for ages...
Chris C
Richard Clayton
<ch...@keristor.net> writes
>See The Register:
>
>http://www.theregister.co.uk/2004/10/14/isp_takedown_study/
>
>According to the article, an organisation put up Public Doman text,
although they muddied the waters by taking that text from a 1981
publication :-(
>then
>sent a 'complaint' via a Hotmail adress to the Dutch ISPs hosting the
>site. 7 out of 10 took it down
yes
>without checking
you (and they) don't know that
>(even though the text
>on the site stated that the material was PD),
of course no website owner would ever publish an untruth, so that should
be seen as entirely conclusive
>including Tiscali,
>Wanadoo, Demon Internet and Planet Internet. One host (iFast) even gave
>the customer details to the complainants without even being asked.
>
>Am I surprised? Not in the least. Do I expect it to happen "for real"
>(malicious taking down other people's sites)? Certainly, as has been
>predicted for ages...
what would be your attitude if the ISPs now took legal action against
the people who ran the study on the basis that fraudulent claims had
been made ? One of the features of the US regime (which the authors of
this study and the previous, rather smaller, Oxford study both have good
things to say about) is that statements must be made "on penalty of
perjury". Should the ISPs be expected to proceed on this basis ?
--
richard Richard Clayton
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. Benjamin Franklin
Chris Croughton
<ric...@highwayman.com> wrote:
> In article <slrncmsqf6...@ccserver.keris.net>, Chris Croughton
> <ch...@keristor.net> writes
>
>>See The Register:
>>
>>http://www.theregister.co.uk/2004/10/14/isp_takedown_study/
>>
>>According to the article, an organisation put up Public Doman text,
>
> although they muddied the waters by taking that text from a 1981
> publication :-(
Is the text of the 1981 publication identical in content to the
original? If so, then it doesn't matter where they took it from.
Actually, the PDF doesn't say that the text was taken from the 1981
publication, only that it was republished in 1981.
(Note that when I use 'they' I am referring to those who did the test,
as reported in the PDF at http://www.bof.nl/docs/researchpaperSANE.pdf,
not to The Register.)
>>then
>>sent a 'complaint' via a Hotmail adress to the Dutch ISPs hosting the
>>site. 7 out of 10 took it down
>
> yes
>
>>without checking
>
> you (and they) don't know that
They don't? Since they say "3 hosting providers and 4 access providers
removed the text without even looking at the website", it would be
assumed that they checked the logs for the page. The hosting
organisations may have used some other method (like going through the
file system), but if they did there is no evidence that they read it.
Two of those who did ask for further 'proof' from the complainant
evidently didn't bother checking the obviously fake address provided (a
quick check with Directory Enquiries would have shown it up).
>>(even though the text
>>on the site stated that the material was PD),
>
> of course no website owner would ever publish an untruth, so that should
> be seen as entirely conclusive
So you are saying that "guilty until proved innocent" should be the
case? If so, that rather proves the case that anyone can take down
anyone else's website at whim, doesn't it?
>>including Tiscali,
>>Wanadoo, Demon Internet and Planet Internet. One host (iFast) even gave
>>the customer details to the complainants without even being asked.
>>
>>Am I surprised? Not in the least. Do I expect it to happen "for real"
>>(malicious taking down other people's sites)? Certainly, as has been
>>predicted for ages...
>
> what would be your attitude if the ISPs now took legal action against
> the people who ran the study on the basis that fraudulent claims had
> been made ?
If they took action against them as being fraudulent complainants, that
would be justified and correct. How would you feel if your ISP took
down your website on an anonymous complaint? I'm sure you (like me and
most Usenet users) have annoyed enough people over the years that
someone would be willing to try. I can see it getting into a cycle of
"tit for tat" takedowns...
> One of the features of the US regime (which the authors of
> this study and the previous, rather smaller, Oxford study both have good
> things to say about) is that statements must be made "on penalty of
> perjury". Should the ISPs be expected to proceed on this basis ?
I think that the website owners should have a claim against the ISP and
the ISP should have a similar claim against the complainants. The ISPs
should be expected to use "due diligence" before complying with a demand
from a Hotmail or other easily obtainable source.
And what about the one which released customer details? The US system
states that such information is only permitted with a subpoena. Their
privacy laws are usually not as strict as ours, it seem that they are
actually better in this case...
I note that the web hosts are not totally guilty in this, the law is
dangerous. However, the times allowed for customer rebuttal of the
claims (3 hours in one case, within a couple of days in others), and the
lack of even rudimentary checking that the complainant was a valid
person (let alone a representative of the copyright holders, if any) was
up to the hosting companies. People can easily be out of touch for a
week or more at a time.
Chris C
Richard Clayton
<ch...@keristor.net> writes
>On Thu, 14 Oct 2004 13:33:15 +0100, Richard Clayton
> <ric...@highwayman.com> wrote:
>
>> In article <slrncmsqf6...@ccserver.keris.net>, Chris Croughton
>> <ch...@keristor.net> writes
>>
>>>See The Register:
>>>
>>>http://www.theregister.co.uk/2004/10/14/isp_takedown_study/
>>>
>>>According to the article, an organisation put up Public Doman text,
>>
>> although they muddied the waters by taking that text from a 1981
>> publication :-(
>
>Is the text of the 1981 publication identical in content to the
>original?
how might one research that ? ... do you expect ISPs to have reader's
tickets to the local copyright deposit library ?
>If so, then it doesn't matter where they took it from.
>
>Actually, the PDF doesn't say that the text was taken from the 1981
>publication, only that it was republished in 1981.
as I said, muddy :( it was not necessary to add this confusion :(
>>>then
>>>sent a 'complaint' via a Hotmail adress to the Dutch ISPs hosting the
>>>site. 7 out of 10 took it down
>>
>> yes
>>
>>>without checking
>>
>> you (and they) don't know that
>
>They don't? Since they say "3 hosting providers and 4 access providers
>removed the text without even looking at the website", it would be
>assumed that they checked the logs for the page.
a) most of the sites are of such a nature as not to generate logs that
the users can consult
b) ISP abuse teams will have "backdoor" access to sites so that their
access will not show up in the logs anyway
>The hosting
>organisations may have used some other method (like going through the
>file system), but if they did there is no evidence that they read it.
>Two of those who did ask for further 'proof' from the complainant
>evidently didn't bother checking the obviously fake address provided (a
>quick check with Directory Enquiries would have shown it up).
AIUI, they gave an address that did exist, but that they thought was
implausible... bit like giving "No 1 London" -- which is of course a
real address and it is entirely plausible that, say, the Wellington
Society is based there.
Again, poor experiment design :(
>>>(even though the text
>>>on the site stated that the material was PD),
>>
>> of course no website owner would ever publish an untruth, so that should
>> be seen as entirely conclusive
>
>So you are saying that "guilty until proved innocent" should be the
>case? If so, that rather proves the case that anyone can take down
>anyone else's website at whim, doesn't it?
It's not at a whim ... it's at the expense of making an entirely
fraudulent claim and then standing behind in when challenged to take
responsibility for it ... thereby laying yourself open to legal action
I don't see Monsanto's website being removed on a daily basis... and I
suspect there are quite a few people who might wish to attack it :(
>>>including Tiscali,
>>>Wanadoo, Demon Internet and Planet Internet. One host (iFast) even gave
>>>the customer details to the complainants without even being asked.
>>>
>>>Am I surprised? Not in the least. Do I expect it to happen "for real"
>>>(malicious taking down other people's sites)? Certainly, as has been
>>>predicted for ages...
>>
>> what would be your attitude if the ISPs now took legal action against
>> the people who ran the study on the basis that fraudulent claims had
>> been made ?
>
>If they took action against them as being fraudulent complainants, that
>would be justified and correct.
interesting view... because that option does still remain open
>How would you feel if your ISP took
>down your website on an anonymous complaint?
I don't think that would happen... but of course you get what you pay
for (something that I think the Dutch were hoping to demonstrate, but by
being feeble in their reaction in their role as the customer, I rather
think they muffed it)
>> One of the features of the US regime (which the authors of
>> this study and the previous, rather smaller, Oxford study both have good
>> things to say about) is that statements must be made "on penalty of
>> perjury". Should the ISPs be expected to proceed on this basis ?
>
>I think that the website owners should have a claim against the ISP
they do... albeit most contracts are written to try and discourage this
from succeeding
>and
>the ISP should have a similar claim against the complainants. The ISPs
>should be expected to use "due diligence" before complying with a demand
>from a Hotmail or other easily obtainable source.
that puts the ISP into a Judge and Jury role and there are very
significant difficulties with doing that... you can find some old
discussion of this in my paper (on my not-yet-taken-down website)...
http://www.cl.cam.ac.uk/~rnc1/Judge_and_Jury.html
>And what about the one which released customer details?
in the UK that would be an offence under the Data Protection Act 1998
and would also open the ISP up for an action for breach of confidence.
If there had been a copyright infringement then the ISP might succeed in
running a defence to both issues on that basis -- but without an offence
having occurred I suspect they would lose :(
John Hall
I'm not surprised either. I feel that any prudent ISP would act in that
way (except that it would be totally wrong of an ISP to hand over
customer details, of course).
The real question is: after taking the site down, did they check and
then get it back up again quickly? I think in the current climate that's
the best that one could hope for.
--
John Hall
"Hegel was right when he said that we learn from history
that man can never learn anything from history."
George Bernard Shaw (1856-1950)
Graham Murray
> One of the features of the US regime (which the authors of this
> study and the previous, rather smaller, Oxford study both have good
> things to say about) is that statements must be made "on penalty of
> perjury". Should the ISPs be expected to proceed on this basis ?
That does not help either. I am sure that I have read of cases of
these "on penalty of perjury" statements being made claiming copyright
in movie or audio files when the actual files being complained about
were not movie or audio files but just files with names which happened
to be the same as (or similar to) the titles of movie or audio tracks.