NOTE: This article is dated February 3, 2004 and is printed here intact with the permission of author Jeremy Reynalds.
===
===
Jeremy Reynalds
P O Box 27693
Alb., NM 87125-7693
Tel: (505) 400-7145
www.joyjunction.org
One Company's Battle to remove a Terrorist Web Site from its Servers
Internet terror and internet hosting is a complicated business. A few days ago I wrote a story about a radical al Qaida affiliated web site that featured shocking pictures of President George W. Bush and British Prime Minister Tony Blair lying in coffins after having apparently undergoing autopsies.
In that story I wrote that the site appeared to be hosted by Canadian based SoftCom Technology Consulting (www.softcomca.com), as that was where all the electronic signs were pointing. However, I was careful to make sure the word "appeared" was in the story, as sometimes things are not quite as they appear in the online world.
After my story appeared and the internet server provider (ISP) was made aware of the material they had been (unwittingly) hosting, company officials immediately pulled the site off line. However, within a few hours it was back on line with a different host based out of Malaysia.
The day my story appeared I was made aware of a very irritated reader who said that the site was never hosted in Canada - and I should have checked my facts better. I did! It was just that between the time I electronically checked the site's location and the time that this reader did, its location had moved half way around the world. With that in mind, I thought you may appreciate reading how that happened and the story of one company's battle to get an unwanted site off its servers.
The Vice-President of Softcom Technology Consulting, Michael Carr, explained to me the history of www.cihad.net and why his company and many others are in a real difficult spot when it comes to successfully tracking and closing terrorist sites (and other sites that carry offensive material).
Carr told me by e-mail that in early 2003 the owner of www.cihad.net moved the site to www.myhosting.com servers and agreed to abide by all the company's policies. In August 2003 Carr found out that www.cihad.net was violating My Hosting's policies. As a result the offending site was terminated, and all of the content contained on www.myhosting.com servers was entirely removed.
However, Carr told me, this is where things took a decidedly different turn. Carr wrote, "In early December 2003 (four months after the original account was terminated), a different person signed up for service with myhosting.com using an entirely different domain name. Unknown to myhosting.com was that the original owner of "cihad.net" was connected to the owner of this new site, and redirected his domain to the IP address of the new account. In late January 2004 myhosting.com was notified of a potential violation of our AUP and immediately initiated an internal investigation. On the surface, it appeared as if the old domain "cihad.net" was being hosted, however it turned out it was being pointed by eNom Inc. to a new domain we hosted. Following a brief and immediate investigation, the new web site account was also terminated for violation of our (acceptable use policy)."
Carr said because there were three different companies involved the situation was more than a little difficult. He said there was one company to register the domain, one to point it and one to host the domain. That, he said, made it extremely difficult to close down a web site without going after the company that actually registered the domain name.
According to Carr, "RegisterFly.com, the registrar, has the power to cancel this domain name. myhosting.com, like all other hosting companies, take all available precautions to prevent web sites like these from signing up for services in the first place. Unfortunately, in this particular case, the violation was not detected and resolved until after the customer published content to our servers. As evidenced, myhosting.com takes all reported violations seriously and will investigate and take appropriate action after conducting a prompt and thorough investigation."
Carr told me that owners of "questionable" web sites quite often work out a way to evade the authorities. He said that www.cihad.net's owner registered the domain name with www.RegisterFly.com on Dec. 4 2001. He added, "the domain name service (DNS) for the domain is registered to eNom Inc. a company based in Bellevue, Wa. eNom provides a web-based interface that enables the owner of the domain to update their account information almost immediately without any human interaction. By updating the domain information, the owner of the domain can continually redirect the domain from one hosting company to another, almost instantly. The unsuspecting hosting company provides space on their server, while the domain is actually hosted elsewhere. When the hosting company is made aware of the content, they usually shut the web site down. However, due to the elaborate scheme practiced by the owner of the domain, the web site could reappear within hours on another unsuspecting web hosting provider's server."
That was exactly what happened with www.cihad.net. Almost as soon as it was shut down, the owner of "cihad.net" successfully directed the web site to another server hosted at (202.157.176.0 - 202.157.176.255) the Acme Internet Data Center in Cyberjaya, Malaysia.
Carr said, "Anyone with knowledge about how the internet works could easily avoid detection, or avoid getting shutdown by transferring around from hosting company to hosting company. This is exactly what the perpetrator in this case has done since the domain was registered in late 2001."
Carr said that when a web hosting provider works with thousands of customers worldwide, it is literally impossible to review all of the content on a company's servers. "However, before customers are permitted to sign-up, they must agree to abide by our comprehensive Acceptable Use Policy (AUP)
http://myhosting.com/Policy/aup.asp. If myhosting.com learns of any AUP violations at anytime, an internal investigation is launched and if any claims are substantiated, immediate action is taken to terminate the infringing account. In the case of "www.cihad.net," once www.myhosting.com was notified, immediate action was taken to investigate and terminate the account from our servers."