Ole.Tange.dk - Time line for take down of www.ec-gc.ca and www.enviro-canada.ca

Time line for take down of www.ec-gc.ca and www.enviro-canada.ca

Ca. 1433 ord.

2009-12-14

www.ec-gc.ca and www.enviro-canada.ca go online and are used in a spoof by The Yes Men. The websites are hosted by Pi-Web, a Danish web hosting company that has some servers hosted at Serverloft's data center in Germany. The websites have a similar layout and build as www.ec.gc.ca, but contain different material.

2009-12-14 - 2009-12-21 14:34:37 UTC

At some point between 2009-12-14 and 2009-12-21 14:34:37 UTC Mike.Landreville@ec.gc.ca of Intellectual Property Office Environnement Canada / Environment (ECCA hereafter) contacts Canadian Cyber Incident Response Centre (CCIRC).

Comments

In ECCA's letter it says:

Please confirm at your earliest convenience your deletion and
removal of these websites.

So ECCA is not pushing for a speedy removal, but simply asks to do this when it is convenient. The letter does not contain anything that suggests the content has been tried before a judge and deemed illegal under German law. Indeed ECCA may be unaware that the server is in Germany.

The letter states that the websites act as phishing sites. According to Wikipedia phishing would require criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details. ECCA does not specify where on the site ECCA believes there is a chance of phishing taking place, and there is no obvious URL that lets you enter sensitive information.

2009-12-21 14:34:37 UTC

CCIRC contacts the German CERT, CERT-Bund. In CCIRC's letter they claim to have contacted the hosting provider to have the sites removed, but the hosting provider has not done so. They mention that the sites are hosted on the server with the IP address 188.138.4.45, and CCIRC requests CERT-Bund's assistance in having the sites deactivated.

Comments

The letter does not contain anything proving that they in fact did contact the hosting provider. The letter is not send in Cc to me. Contact information (both phone and email) is easily found by looking up the IP address 188.138.4.45 in WHOIS.

Just like the letter from ECCA CCIRC's letter does not request urgent action. It also does not contain anything that suggests the content has been tried before a judge and deemed illegal under German law. But CCIRC clearly knows the server is in Germany, as they contact Bund-CERT.

2009-12-21 14:34:37 UTC - 2009-12-21 20:29 UTC

Somewhere in this time frame Serverloft receives Bund-CERT's letter and blocks the IP addresses 188.138.4.32 - 188.138.4.63.

Comments

Bund-CERT's letter does not contain any proof that CCIRC had contacted the hosting provider (e.g. a copy of an email or reference to a phone conversation) nor does the letter contain anything that suggests Bund-CERT have contacted the hosting provider. It might have been wise to do so, as some Germans do not understand English and would not understand communication from CCIRC in English. The letter is not sent in Cc to me. Contact information (both phone and email) is easily found by looking up the IP address 188.138.4.45 in WHOIS.

Bund-CERT's letter is a bit ambiguous:

Wir bitten Sie daher, entsprechende Maßnahmen vorzunehmen und die Seiten abzuschalten, um weitere Phishing-Aktivitäten zu verhindern.

It is unclear whether 'Wir bitten Sie daher' in means 'We hope that you will' or 'We order you to'. If it is the last and if Serverloft by German law are not allowed to question orders from Bund-CERT, then Bund-CERT are responsible for the legal validity of the orders they send.

It is unclear what entsprechende Maßnahmen really cover: Would it be enough to call the hoster and have him deal with the matter? Would it be enough to close access to the IP number mentioned? Or is it required that all the IP addreses 188.138.4.32 - 188.138.4.63 are blocked? Is it a requirement not to call the hoster?

The urgency is stepped up a notch: 'um weitere Phishing-Aktivitäten zu verhindern'. To stop more phishing activities suggests this is fairly urgent, but not so urgent that Bund-CERT calls Serverloft to have it done immediately.

Just like the letter from ECCA and CCIRC's letter Bund-CERT's letter does not contain anything that suggests the content has been tried before a judge and deemed illegal under German law.

The blocking of the IP addresses 188.138.4.32 - 188.138.4.63 takes down more that 4500 customers' websites (mostly owned by small businesses and families) and thereby interferes arbitrarily with the correspondence between more than 4500 humans and the rest of the Internet. This seems to be a clear violation of UN Human Rights §12, UN Human Rights §19, and The European Convention on Human Rights §10.

The IP range 188.138.4.32 - 188.138.4.63 includes the mail server for tange.dk, so email sent to ole@tange.dk will not get through until the IP addresses are unblocked.

It is unclear why Serverloft finds it is urgent to close down the server and why Serverloft blocks more than the IP-address of the sites in question (i.e. 188.138.4.45).

Serverloft does not contact me by phone. Serverloft has my contact details both on file and in WHOIS.

2009-12-21 20:29 UTC

Serverloft posts the German part of Bund-CERT's letter to Serverloft's ticking system.

Comments

The Serverloft ticketing system is normally used for non-urgent messages initiated by customer to Serverloft. This is the first ticket I have seen initiated by Serverloft.

2009-12-21 20:35 UTC

Serverloft emails a 'Breach of Service Policy' to ole@tange.dk.

Comments

As Serverloft has disconnected the mailserver the email only arrives after the mailserver is back online. The email is received 2009-12-21 23:15 UTC. Nothing in the email suggest that the content has been tried before a judge and deemed illegal under German law. The email does not specify which part of the Service Policy that is breached. I can only guess it is about hosting illegal activities, but as the activities are not proven to be illegal I have a hard time seeing the breach.

2009-12-21 22:20 UTC

I discover access to the mailserver is down. It happens now and then that access to Serverloft's network fail for shorter periods of times. So this in itself is no cause for alarm. I can, however, access another machine at Serverloft and can see that traceroute drops IP packets 2 hops before unaccesible the server. From this I deduce that routing in Serverloft's network is the problem.

2009-12-21 22:24:32 UTC

I call Serverlofts 24-7 hotline (+4922336124711). The first person I talk to continously claims nothing is wrong with Serverloft's systems, that it must be a configuration problem on my machine and that he refuses to trouble shoot with me, but tells me to raise a ticket. The more I realize he is not going to help the more I go from calm to desperate. In the end I finally convince him to transfer me to 2nd line support by saying: "How do you want me to prove that your systems are up and running, but misconfigured?"

I explain the 2nd line support the traceroute reasoning and he puts me through to 3rd line support. 3rd line support mentions the reason for the blocking and I have to promise to take the two websites offline before he unblocks the IP addresses.

Comments

It is astonishing that first line support did not immediately see that Serverloft had changed the configuration recently and thus would be aware that this should be fixed.

I have no problem taking an illegal site offline, but I do not want to be the judge, so I only do that if I get a warrant. Thus I felt really bad promising to take the sites offline without a warrant as I am a firm believer of the UN Human Rights. But had I not promised to take the two sites offline, the 4500 sites would still be offline - which would have been worse both from a human rights' perspective and a business perspective.

I am baffled by the missing communication from both CCIRC, CERT-Bund and Serverloft. If either of these had contacted me I believe we would have found a solution that would satisfy all.

The following days

I try to get Serverloft to clarify the reasoning behind their actions, but they simply close the issue by saying they regard this incident as solved.

I contact CCIRC and CERT-Bund to clarify the reasoning behind their actions, but have not heard back from them yet (2010-01-02).

Serverloft's CEO has been interviewed and clearly thinks Serverloft only blocked 1 IP-address and only after they had contacted their customer (me). Both assumptions are incorrect.

Sidst ændret Wed Jan 13 10:56:30 2010




f i r m a e t support foredrag andet p e r s o n e n cv portrætter s a g e r spamsagen linux links k o n t a k t kontakt		Time line for take down of www.ec-gc.ca and www.enviro-canada.ca Ca. 1433 ord. 2009-12-14 www.ec-gc.ca and www.enviro-canada.ca go online and are used in a spoof by The Yes Men. The websites are hosted by Pi-Web, a Danish web hosting company that has some servers hosted at Serverloft's data center in Germany. The websites have a similar layout and build as www.ec.gc.ca, but contain different material. 2009-12-14 - 2009-12-21 14:34:37 UTC At some point between 2009-12-14 and 2009-12-21 14:34:37 UTC Mike.Landreville@ec.gc.ca of Intellectual Property Office Environnement Canada / Environment (ECCA hereafter) contacts Canadian Cyber Incident Response Centre (CCIRC). Comments In ECCA's letter it says: Please confirm at your earliest convenience your deletion and removal of these websites. So ECCA is not pushing for a speedy removal, but simply asks to do this when it is convenient. The letter does not contain anything that suggests the content has been tried before a judge and deemed illegal under German law. Indeed ECCA may be unaware that the server is in Germany. The letter states that the websites act as phishing sites. According to Wikipedia phishing would require criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details. ECCA does not specify where on the site ECCA believes there is a chance of phishing taking place, and there is no obvious URL that lets you enter sensitive information. 2009-12-21 14:34:37 UTC CCIRC contacts the German CERT, CERT-Bund. In CCIRC's letter they claim to have contacted the hosting provider to have the sites removed, but the hosting provider has not done so. They mention that the sites are hosted on the server with the IP address 188.138.4.45, and CCIRC requests CERT-Bund's assistance in having the sites deactivated. Comments The letter does not contain anything proving that they in fact did contact the hosting provider. The letter is not send in Cc to me. Contact information (both phone and email) is easily found by looking up the IP address 188.138.4.45 in WHOIS. Just like the letter from ECCA CCIRC's letter does not request urgent action. It also does not contain anything that suggests the content has been tried before a judge and deemed illegal under German law. But CCIRC clearly knows the server is in Germany, as they contact Bund-CERT. 2009-12-21 14:34:37 UTC - 2009-12-21 20:29 UTC Somewhere in this time frame Serverloft receives Bund-CERT's letter and blocks the IP addresses 188.138.4.32 - 188.138.4.63. Comments Bund-CERT's letter does not contain any proof that CCIRC had contacted the hosting provider (e.g. a copy of an email or reference to a phone conversation) nor does the letter contain anything that suggests Bund-CERT have contacted the hosting provider. It might have been wise to do so, as some Germans do not understand English and would not understand communication from CCIRC in English. The letter is not sent in Cc to me. Contact information (both phone and email) is easily found by looking up the IP address 188.138.4.45 in WHOIS. Bund-CERT's letter is a bit ambiguous: Wir bitten Sie daher, entsprechende Maßnahmen vorzunehmen und die Seiten abzuschalten, um weitere Phishing-Aktivitäten zu verhindern. It is unclear whether 'Wir bitten Sie daher' in means 'We hope that you will' or 'We order you to'. If it is the last and if Serverloft by German law are not allowed to question orders from Bund-CERT, then Bund-CERT are responsible for the legal validity of the orders they send. It is unclear what entsprechende Maßnahmen really cover: Would it be enough to call the hoster and have him deal with the matter? Would it be enough to close access to the IP number mentioned? Or is it required that all the IP addreses 188.138.4.32 - 188.138.4.63 are blocked? Is it a requirement not to call the hoster? The urgency is stepped up a notch: 'um weitere Phishing-Aktivitäten zu verhindern'. To stop more phishing activities suggests this is fairly urgent, but not so urgent that Bund-CERT calls Serverloft to have it done immediately. Just like the letter from ECCA and CCIRC's letter Bund-CERT's letter does not contain anything that suggests the content has been tried before a judge and deemed illegal under German law. The blocking of the IP addresses 188.138.4.32 - 188.138.4.63 takes down more that 4500 customers' websites (mostly owned by small businesses and families) and thereby interferes arbitrarily with the correspondence between more than 4500 humans and the rest of the Internet. This seems to be a clear violation of UN Human Rights §12, UN Human Rights §19, and The European Convention on Human Rights §10. The IP range 188.138.4.32 - 188.138.4.63 includes the mail server for tange.dk, so email sent to ole@tange.dk will not get through until the IP addresses are unblocked. It is unclear why Serverloft finds it is urgent to close down the server and why Serverloft blocks more than the IP-address of the sites in question (i.e. 188.138.4.45). Serverloft does not contact me by phone. Serverloft has my contact details both on file and in WHOIS. 2009-12-21 20:29 UTC Serverloft posts the German part of Bund-CERT's letter to Serverloft's ticking system. Comments The Serverloft ticketing system is normally used for non-urgent messages initiated by customer to Serverloft. This is the first ticket I have seen initiated by Serverloft. 2009-12-21 20:35 UTC Serverloft emails a 'Breach of Service Policy' to ole@tange.dk. Comments As Serverloft has disconnected the mailserver the email only arrives after the mailserver is back online. The email is received 2009-12-21 23:15 UTC. Nothing in the email suggest that the content has been tried before a judge and deemed illegal under German law. The email does not specify which part of the Service Policy that is breached. I can only guess it is about hosting illegal activities, but as the activities are not proven to be illegal I have a hard time seeing the breach. 2009-12-21 22:20 UTC I discover access to the mailserver is down. It happens now and then that access to Serverloft's network fail for shorter periods of times. So this in itself is no cause for alarm. I can, however, access another machine at Serverloft and can see that traceroute drops IP packets 2 hops before unaccesible the server. From this I deduce that routing in Serverloft's network is the problem. 2009-12-21 22:24:32 UTC I call Serverlofts 24-7 hotline (+4922336124711). The first person I talk to continously claims nothing is wrong with Serverloft's systems, that it must be a configuration problem on my machine and that he refuses to trouble shoot with me, but tells me to raise a ticket. The more I realize he is not going to help the more I go from calm to desperate. In the end I finally convince him to transfer me to 2nd line support by saying: "How do you want me to prove that your systems are up and running, but misconfigured?" I explain the 2nd line support the traceroute reasoning and he puts me through to 3rd line support. 3rd line support mentions the reason for the blocking and I have to promise to take the two websites offline before he unblocks the IP addresses. Comments It is astonishing that first line support did not immediately see that Serverloft had changed the configuration recently and thus would be aware that this should be fixed. I have no problem taking an illegal site offline, but I do not want to be the judge, so I only do that if I get a warrant. Thus I felt really bad promising to take the sites offline without a warrant as I am a firm believer of the UN Human Rights. But had I not promised to take the two sites offline, the 4500 sites would still be offline - which would have been worse both from a human rights' perspective and a business perspective. I am baffled by the missing communication from both CCIRC, CERT-Bund and Serverloft. If either of these had contacted me I believe we would have found a solution that would satisfy all. The following days I try to get Serverloft to clarify the reasoning behind their actions, but they simply close the issue by saying they regard this incident as solved. I contact CCIRC and CERT-Bund to clarify the reasoning behind their actions, but have not heard back from them yet (2010-01-02). Serverloft's CEO has been interviewed and clearly thinks Serverloft only blocked 1 IP-address and only after they had contacted their customer (me). Both assumptions are incorrect.
		Sidst ændret Wed Jan 13 10:56:30 2010