DNS Provider Mistakenly Caught in WikiLeaks Saga Now Supports the Group
By Kim Zetter
A DNS provider that suffered backlash last week after it was wrongly identified as supplying and then dropping DNS service to WikiLeaks has decided to support the secret-spilling site, offering DNS service to two domains distributing WikiLeaks content.
EasyDNS, a Canadian firm, was attacked last Friday after media outlets mistakenly reported it had terminated its service for WikiLeaks. The company sent an e-mail to customers Thursday morning letting them know that it had begun providing DNS service for WikiLeaks.ch and WikiLeaks.nl, two of the primary domain names WikiLeaks relocated to after WikiLeaks.org stopped resolving.
“We’ve already done the time, we might as well do the crime,” Mark Jeftovic, president and CEO of EasyDNS, told Threat Level about his decision.
DNS service providers translate human-friendly domain names to IP addresses, so when someone types www.Amazon.com into their browser, for example, they’re properly connected to 72.21.211.176, the address of the host.
It was actually EveryDNS, a competitor of EasyDNS, that had been providing this service to WikiLeaks.org for free. EveryDNS terminated this service last week after WikiLeaks was hit by prolonged denial-of-service (DoS) attacks by people opposed to the group publishing classified U.S. State Department cables. The company said the denial-of-service attacks against WikiLeaks threatened the stability of service for other EveryDNS customers.
In reporting this announcement, bloggers misidentified the DNS provider as EasyDNS, a mistake that was repeated in news stories. EasyDNS was subsequently caught in a firestorm. WikiLeaks supporters attacked it on Twitter. Jeftovic said he also got calls from customers saying, “We can’t believe you’ve taken down WikiLeaks, we’re out of here.”
Jeftovic posted a note to the company blog at the time, musing about the mishap and the fact that his company was now put in the precarious position of deciding what it would do if WikiLeaks did want to become a customer. Would EasyDNS then be attacked if it turned the organization away?
“So after the big clusterf*** with easyDNS being falsely blamed for taking down WikiLeaks,” he wrote, “somebody posts the inevitable question ‘Would easyDNS take wikileaks DNS’? and from there makes what I think is a dubious extension: by not taking them we’re doing the same thing as ‘taking them down.’”
Two days later he was faced with precisely this dilemma when people behind two WikiLeaks mirror sites that have become the defacto WikiLeaks content providers contacted him about becoming customers.
One of the correspondents, based in Switzerland, controls the Swiss-based WikiLeaks.ch domain, which became one of two main domains for accessing the U.S. State Department cables after WikiLeaks stopped using WikiLeaks.org. EasyDNS began providing DNS service for the domain Sunday evening, using 14 name servers. Jeftovic was subsequently contacted by someone who controls WikiLeaks.nl in the Netherlands, and began providing service to that address on Monday.
Jeftovic said he was also in line to take over service for the WikiLeaks.org domain, but that fell through after there was confusion about who exactly controls the domain. He said he’s willing to take that one on as well, if the details are worked out.
Jeftovic agreed to provide the service on condition that resolution for the domains would be provided by dedicated, battle-hardened servers separate from other customers so that any attacks directed against them would not disturb other clients.
Although he says his company is pro-transparency, Jeftovic didn’t go so far as to say he philosophically supports WikiLeaks.
“But I do not believe WikiLeaks is aiding terrorists,” he said. “I think there’s so much hyperbole around it.”
His main reason for agreeing to provide access to WikiLeaks content was practical.
“We were dragged into this,” he said. “The alternatives were we do nothing and get dragged through the mud again, or we just basically do the one thing that really shuts everybody up.”
He said the result has been a “groundswell” of support among the company’s 50,000 customers.
“There is a minority of people who are not happy with this, but by far the majority is extremely supportive,” he said. “Forty percent of our member base is in the U.S., and a lot of our U.S. customers are really on side with this and happy with it.”
He acknowledged that his assistance to WikiLeaks could be terminated if his company were served with an injunction.
But one of the lessons demonstrated by the recent attacks on WikiLeaks is that a popular website can survive even without DNS, thanks to Google. The top search result for WikiLeaks on Thursday is a link to the site’s Internet IP address, 213.251.145.96. WikiLeaks is strong enough now that it can survive as a number.
No comments:
Post a Comment