US Feds seize 33 Iranian news site domains

The US government said it has seized control of 33 domain names previously belonging to an Iranian TV news station that the US considers linked to terrorism.

The Department of Justice said the domains had been registered by the Iranian Islamic Radio and Television Union, which it said is controlled by Islamic Revolutionary Guard Corps Quds Force, designated as a terrorist organization.

Among the domains is presstv.com, used by Press TV, an Iranian state-owned station that broadcasts news in English and French.

The DoJ said the sites were “disguised as news organizations or media outlets” and “targeted the United States with disinformation campaigns and malign influence operations”.

All of the seized names reportedly use .com, .net and .tv domains, which are all operated by Verisign.

The DoJ obtained a court order to grab the names.

As an overseas registrar was used to register the names, it appears the court order instructed Verisign, based in the US, to hand them over.

The domains now direct to a US government placeholder informing visitors of the seizure. Some of the affected web sites have reportedly started using new domains.

Under US law, “Specially Designated Nationals” listed by the Office of Foreign Assets Control are forbidden from obtaining services from US companies without a special license.

The DoJ said it has seized an additional three domains owned by Kata’ib Hizballah (Kataib Hezbollah), an Iraqi militia backed by Iran.

Domain-hopping torrent site seized, founder arrested

A joint US-Polish law enforcement operation has led to the arrest of the alleged owner of the piracy-focused BitTorrent links site KickAssTorrents.
The US Department of Justice announced yesterday that Ukrainian national Artem Vaulin has been arrested in Poland and that it will seek to extradite him to Chicago to face criminal copyright infringement charges.
The site, which has been banned at the ISP level in countries including the UK, provides links to download and share copyrighted works such as movies and music from other BitTorrent users.
But it’s perhaps best known in the domain name industry for regularly jumping from one TLD to another as its domains are terminated by local authorities.
According to the DoJ, it has been seen on kickasstorrents.com, kat.ph (Philippines), kickass.to (Tonga), kickass.so (Somalia) and kat.cr (Costa Rica).
The department said it has seized seven domain names as part of its operation.
According to my records, there are 20 examples of kickasstorrents.example domains in the Alexa one million, all in new gTLDs (though I’ve no idea whether they’re part of the same operation).
The DoJ reckons KAT makes annual revenue of between $12.5 million to $22.3 million from advertising accompanying its links.

Domains seized as part of Liberty Reserve money laundering sting

The US government seized five domain names and is going after dozens more as part of its crackdown on Liberty Reserve, a digital currency provider apparently popular with criminals.
The Department of Justice said yesterday that the company was responsible for laundering $6 billion spread across 55 million transactions, “virtually all of which were illegal”.
The service was being used to facilitate fraud and child pornography, among other nasties, according to Justice.
Seven people have been arrested in the US, Spain and Costa Rica and five domain names were seized: libertyreserve.com, exchangezone.com, swiftexchanger.com, moneycentralmarket.com and asianagold.com.
Three are registered with Go Daddy. The main site, libertyreserve.com, is with Swedish registrar AB NameISP and exchangezone.com is with Internet.bs.
But .com registry Verisign handled the seizures, according to a court order published by Justice (pdf).
While Liberty Reserve was based in Costa Rica, there doesn’t appear to be any reason to believe the company’s activities were any more legal there than in the US.
Justice is also seeking the forfeiture of 35 other domain names, mostly .coms, that were allegedly (pdf) being used as “exchanger” sites, where Liberty Reserve users could exchange real money for virtual currency.

Cops seize 132 domains in Cyber Monday crackdown

Law enforcement agencies in the US and Europe have shut down 132 domain names in order to stop the selling of counterfeit merchandise online.
According to the US Immigration and Customs Enforcement agency, the now-annual Cyber Monday crackdown included domain names in the .eu, .be, .dk, .fr, .ro and .uk ccTLDs.
Law enforcement from those countries were involved, via Europol, in their respective local seizures, while ICE nabbed 101 domains in generic TLDs whose registries are based in the US.
One person was also arrested, and ICE plans to seize $175,000 in ill-gotten gains sent to a PayPal account connected with the sites.
It’s the third year in a row that ICE has led an operation of this kind before “Cyber Monday”, which in recent years has become the most popular day of the year for e-commerce deals.
The operation started when ICE and Europol “received leads from various trademark holders regarding the infringing websites”, ICE said in a press release.

Congressmen quiz ICE over domain seizures

Three US members of Congress have expressed “deep concern” over the alleged lack of due process followed when the Department of Homeland Security seizes domain names.
Rep. Zoe Lofgren, Rep. Jared Polis and Rep. Jason Chaffetz quiz DHS (pdf) about the methods employed by the Immigration and Customs Enforcement agency in its Operation In Our Sites.
The Congressmen’s letter highlights the case of the hip-hop web site Dajaz1.com, which had its .com seized by ICE and then returned.
“Much of Dajaz1’s information was lawful,” the letter reads. “Despite this, DHS and the Department of Justice suppressed this website for more than a year.”
The Congressmen say that “if a website’s domain is seized, it needs to be given meaningful due process that comports to the US Constitution and US law”.
Operation In Our Sites has seen ICE seize hundreds of domains — mainly .coms accused of copyright infringement — from US-based registries including Verisign since late 2010.
Despite the relatively small number of domains seized, there have been a number of controversies.
Notably, the Spanish TV download web site RojaDirecta, which lost its .com and .org domains despite being ruled legal by a court in its home nation, last month had them returned to it by ICE.

Cops seize 36 carder domains

The FBI and UK Serious Organised Crime Agency have seized 36 domain names that were allegedly being used to sell compromised credit card information.
As well as seizing the domains and a number of computers, SOCA said it has arrested two men “suspected of making large scale purchases of compromised data” from the sites.
The sites all used what SOCA calls “automated vending cart” software to process the sale of credit card information. Judging by the video below, some of the operations were fairly professional.
One of the seized domains was cvvplaza.com. SOCA provided the following video which really has to be seen to be believed.

I wonder if the spokesmodel had any idea what she was getting into when she accepted this gig.
While the full list of domains was not released, a SOCA spokesperson said the breakdown by TLD was as follows:

.name – 2
.net – 11
.biz – 4
.us – 5
.com – 11
.org – 3

These are all TLDs whose registries are based in the United States, so I’m guessing the US authorities did the actual seizing.

ICM opens can of worms with .xxx domain seizures

ICM Registry has suspended several dozen .xxx domain names registered by cybersquatters.
It’s believed to be unprecedented for a mainstream registry to unilaterally shut down domains purely on the grounds of alleged cybersquatting, as I reported for The Register earlier today.
ICM took down 70 to 80 domains including washingtonpost.xxx, cnbc.xxx and verizonwireless.xxx because it decided that the domains infringed trademarks and were therefore abusive.
Many belonged to the squatter Domain Name Wire first fingered as the registrant of huffingtonpost.xxx, named in Whois as Justin Crews.
Crews had told MSNBC that he planned to sell the domains at profit.
There was no UDRP arbitration, no court order, just a breach of the .xxx registry-registrant agreement, which gives ICM the right to suspend squatted domains at will.
This is the relevant part of the agreement, which all .xxx registrants must agree to:

You acknowledge and agree that the Registry reserves the right to disqualify you or your agents from making or maintaining any Registrations or Reservations in the .XXX TLD if you are found to have repeatedly engaged in abusive registrations, in its sole discretion.

I blogged back in May about why it might not be necessary to spend a fortune on defensive registrations in .xxx, given the existence of this policy and others.
Nevertheless, while it may take a while for the implications to become clear, I think the suspensions represent a very significant development.
Coming so soon after the end of ICM’s sunrise period, which saw many organizations spend thousands on useless non-resolving defensive registrations, I wouldn’t be surprised if many companies feel like they may have wasted their money.
If you’ve just spent $200 defending your brand, I imagine it would be quite annoying to see the likes of verizonwireless.xxx or businessweek.xxx get the same protection for free.
I would also not be surprised if, from now on, trademark attorneys trying to defend their rights in .xxx first contacted ICM, rather than WIPO or the National Arbitration Forum.
Why spend thousands on a UDRP complaint when you can just send a legal nastygram to ICM?
ICM president Stuart Lawley told DI today that this wave of suspensions was done independently, not in response to any legal demands.
Still, the precedent has been set: ICM will suspend domains for free, under certain circumstances.
What those circumstances are is less clear.
Lawley said that ICM will not get involved in complaints about individual domains – but it will shut down cybersquatters with multiple infringements.
But what constitutes cybersquatting? UDRP has a definition, but I’m not sure ICM does. It may be quite subjective.
It’s also not clear what ICM will do with the suspended domains, not all of which necessarily infringe trademarks. Some may be bona fide, but the ICM policy is to take down the registrant’s entire portfolio.
So will those non-infringing domains be released back into the pool? And if so, how will ICM determine which are squats and which are not?
And what about the ones that are squats? Will they be released?
AOL may be content for huffingtonpost.xxx to remain suspended forever. As long as it’s suspended, the company does not have to worry about defensive registration fees.
But consider gayroom.xxx, which was also suspended.
The owner of gayroom.com owns a trademark on the word “gayroom”. Gayroom.com is a porn site, but one that has chosen not to buy its equivalent .xxx domain.
What if it changes its mind? If gayroom.com wants gayroom.xxx in future, is there a way to take it out of suspension, or is the company stuck without its .xxx forever, just because a cybersquatter got there first?
ICM’s policies do not seem to answer this question and the company has not yet revealed its plans for the suspended domains.
As a post-script, I should note that Huffington Post owner AOL is currently listed as the registrant of huffingtonpost.xxx in the Whois record.
It’s not yet clear why this is the case, but Lawley stated unequivocally today that the apparent transfer is completely unrelated to ICM’s own crackdown.
Go Daddy, the registrar of record for the domain, declined to comment, citing its customer privacy policy.
Did the cybersquatter transfer the domain to AOL before the suspension? Did he sell it to AOL? Or did he just update the Whois with phoney data? Either seems possible at this point.

Another 2,000 .uk fraud domains taken down

Nominet has suspended over 2,000 .uk domain names allegedly being used to sell counterfeit goods on the instruction of the Metropolitan Police.
The Met said in a statement today that the crackdown was designed to protect online shoppers in the run-up to Christmas. It did something similar last year and the year before.
The sites were allegedly selling bootleg products purportedly from brands such as Ugg, Nike and Tiffany.
Nominet said that it worked with is registrars to coordinate the suspensions, and that the registrants were all informed before their domains were taken down.
All the registrants were in breach of terms and conditions, it said.
A Nominet working group is currently in the final stages of creating a policy that will streamline the process of law enforcement domain suspensions, as I reported for The Register today.

GAC slams registrars over “silly” crime domain moves

ICANN’s Governmental Advisory Committee is seriously annoyed with domain name registrars over what it sees as a failure to take the demands of law enforcement seriously.
The first official day of ICANN’s 42nd public meeting in Dakar, Senegal, was highlighted by a fractious discussion between the GAC and the Generic Names Supporting Organization.
Governments are evidently losing patience with the industry over what they see as incessant foot-dragging and, now, halfhearted bone-throwing.
The US, which is easily the most influential GAC member, was harshly critical of recent efforts by registrars to self-regulate themselves some law enforcement cooperation policies.
US GAC representative Suzanne Radell, saying she was speaking on behalf of the GAC, described a registrar move to start publishing legal service addresses on their web sites at some point in the future as as “paltry”, “mind-boggling” and “silly”.
She heavily implied that if the industry can’t self-regulate, the alternative is governments doing it for them. She was backed up by her counterparts from the UK, Australia and the European Commission.
Registrars have been talking to law enforcement for a few years about how to more effectively work together to prevent crime online.
In October 2009, agencies including the FBI and the UK Serious Organised Crime Agency publish a set of 12 recommendations about how to clean up the industry.
A lot of it was pretty basic stuff like a prohibition on registrar cybersquatting and an obligation to publish an abuse point of contact.
Despite a lot of talking at ICANN meetings, up until a couple of weeks ago there had not been a great deal of tangible progress.
The GNSO passed a resolution, proposed by registrars, to ask for an Issue Report to discuss whether registrars should be forced to post on their sites: a physical address for legal service, the names of key executives, and an abuse contact.
In ICANN’s world, an Issue Report usually precedes a Policy Development Process, which can take a year or more to produce results.
While the GNSO motion passed, it was opposed as inadequate by factions such as the Intellectual Property Constituency, which has close ties to the US government.
As the IPC seemed to correctly predict, the GAC was not amused.
“It is simply impossible for us to write a briefing memo for our political managers to explain why you need a policy to simply put your name on your web site,” Radell told the GNSO Council yesterday. “It is simply mind-boggling that you would require that.”
She pointed out that at a session during the Singapore meeting, registrars had indicated a willingness to address more of the law enforcement demands.
“That’s the context in which we are now coming to you saying this looks pretty paltry and actually it looks a little silly,” she said.
Mason Cole from the registrar constituency denied that they were “roadblocking” law enforcement’s demands, saying that a PDP is the fastest way to create a policy binding on all registrars.
“I think law enforcement was very clear when they made their proposals to us that what they were looking for was binding, enforceable provisions of policy that could be imposed on the registrars,” he said. “A code of conduct or a voluntary method would not arrive at binding, enforceable policy and therefore probably wouldn’t achieve the outcomes that law enforcement representatives were seeking.”
The debate didn’t end yesterday. Radell said she intends to take it up with the ICANN board of directors, presumably at their joint meeting tomorrow.
The implicit threat underlying the GAC’s protest is a legislative one, and Radell and other GAC members made it pretty clear that their governments back home regard domain names as a crucial tool in fighting online crime.

VeriSign yanks domain seizure power request

That was quick.
VeriSign has withdrawn its request for new powers to delete domain names being used for abusive purposes, just a few days after filing it with ICANN.
The company had proposed a policy that would give law enforcement the ability to seize .com and .net names apparently without a court order, and a new malware scanning service.
The former came in for immediate criticism from groups including the American Civil Liberties Union and the Electronic Frontier Foundation, while the latter appeared to have unnerved some registrars.
But now both proposals have been yanked from ICANN’s Registry Services Evaluation Process queue.
This is not without precedent. Last year, VeriSign filed for and then withdrew requests to auction off one-letter .net names and a “Domain Name Exchange” service that looked a bit like domain tasting.
Both came in for criticism, and have not reappeared.
Whether the latest abuse proposals will make a reappearance after VeriSign has had time to work out some of the more controversial kinks remains to be seen.