Survey: Are domain registrars free-speech friendly?

Gandi.net

1. Under what circumstances will you suspend a customer's domain name based on the content of his or her Web site, in the absence of a court order?

Gandi, as you know, specializes in domain name registration, and as such we pay close attention to the validity of the registration information of the domain (Whois data). We therefore are allowed to suspend domain names if the Whois data is false.

In some instances, Gandi has suspended domain names where we have found that the Web site that uses the domain is clearly used for blatant illicit activity, and which has been recognized as doing so by other respected and identified sources. A clear example of this is when a domain is used to point to a well-known spam scheme such as "My Canadian Pharmacy."

To pick up on the point about the "court order," we have found that such a process may be very slow in certain cases and circumstances, given the nature of the Internet, which is why action is sometimes taken in the absence of a court order. But this is always done after having contacted the owner of the domain name in question, and in respect of laws and our terms and conditions.

2. How many times a month, on average, do you suspend a customer's domain name based on the content of his or her Web site?

Gandi almost never takes action against a domain name based exclusively on the content of the Web site, largely because we do not provide Web hosting.

Behind each Web site is a company or an individual, and we need to understand who that is and what they are doing before we act. For example we would not suspend a domain name of a hosting company just because of one Web page of a Web site of one of their customers; in such a case it is more effective to collaborate with the host to pull the offending content.

When we make the decision to suspend a domain name, it is often due to a combination of several factors, rather than just the content itself (for example: multiple spam complaints, fake Whois data, and illicit Web site content).

For that kind of abuses, and after warnings, we have an average of 200 domain names suspended--not deleted--a month. Illicit Web site content represents a very small percentage of complaints we receive.

3. What are the most common reasons for suspension?

Other than the crime itself, perhaps the most stupid thing a criminal could do is to leave his or her real address and telephone number at the scene of a crime!

Consequently, in nearly every instance where a domain is being used as part of an illegal scheme, the contact information of the owner is false or deliberately misleading.

Whether the personal contact information used has been stolen from some random person, or simply pulled out of thin air, we most frequently take action against a domain if the complaint for illegal activity is justified, well-documented by multiple respectable sources, and when we have proof that the registration data is incorrect.

We would love to have an official court order each time, but it simply doesn't work like that as you know: courts are reacting to evolution, not anticipating it.

4. How many domain names do your customers currently have registered through you?

Despite the fact that we have chosen to not have a marketing budget, to not publish ads in magazines, to not air commercials on TV during certain football games, and to rely exclusively on word-of-mouth for getting our name out, we are proud to say that we currently manage over 550,000 domain names, with an acceleration last year and a half and our "new start." (The company was acquired 1.5 years ago by a team of managers to build an alternative and "historical" registrar and hoster.)

5. Go Daddy last week suspended its customer's domain, Seclists.org, because of a complaint from MySpace. Would you have done the same thing in the same way if Seclists.org happened to be your customer?

Funny you should ask that question, because it just so happens that Gandi was indeed contacted last week by someone claiming to be from MySpace!

Upon the reception of the complaint (made on our answering machine), we immediately opened a case to examine its merit, which begins by looking into the person making the complaint, and requesting additional information, if necessary. In this case, as we were unable to contact the person who made the complaint, either by telephone or e-mail, and as we were not provided with any justification for the complaint, no action was taken.

We can tell the difference between a mailing list, an offensive post in a forum, and spam. Our investigative process would have told us what action to take, and we would have been able to justify our action with confidence to all of CNET's readers.

6. If you do suspend domain names in the absence of a court order, what procedures do you have in place to ensure that the customer is notified beforehand and given adequate opportunity to respond?

With very few exceptions, when we are forced to suspend a domain name, it is for the very reason that the owner has neither replied to our numerous attempts to contact them, nor was it possible for us to contact them through the information that they provided to us.

In certain rare cases, such as a denial-of-service attack, or a massive attack of spam, we must suspend the offending domain name at the same time we contact the owner.

In the majority of cases, however, we send an e-mail to the domain's owner, giving them the opportunity to correct the problem. We even go so far as to call the telephone number provided in the Whois data for the domain, in order to speak with the domain name owner in person.

When we find that a site is hacked or hosting illegal content that the administrators appear to be unaware of, we take the extra step of contacting the Web host, the Web master of the site, or in some cases, even the forum administrator.

As stated in Gandi's blog, gandibar.net, we are not "trigger-happy" in our fight against domain abuse.

7. Do you believe that your most important responsibility is to provide technical services to paying customers--or is it to police the content of their Web sites, FTP sites, and so on?

Who watches the watcher? The global community of course! Our role is not to police the Internet. For that there are anti-spam forums, special blacklists, and concerned citizens, all of which I commend for their vigilance and dedication, and contribution.

This lets us focus on our specialty, which is managing domain names for our customers in an ethical and transparent manner. And to participate in supporting an alternative and responsible Internet community.

While we do pro-actively investigate domain abuse at Gandi, this activity goes hand-in-hand with the complaints that we receive. We have been given the trust of our customers to manage their domains, and we are proud to do so.

In short words, it's technically impossible to watch the content of all Web sites, but we will always be very reactive and efficient if we are aware (thanks to our investigations and protective measures or to a complaint) of an issue somewhere.

8. Are you attempting to recruit Go Daddy customers as a result of last week's news about Seclists.org?

It is not in Gandi's nature to go after potential customers in such a way. Part of what makes Gandi so unique is that people come to us because they share our values and want an alternative to the tactics and practices of mainstream companies. We do care both about our customers and Internet. For example, we do fight spam actively (we strongly support spamhaus.org among other things) and we assume the risk to lose customers because of this ethic positioning (spammers are large ones).

9. If you do suspend domain names in the absence of a court order, how do your customers go about getting their sites restored?

After we suspend a domain name, we send out a final e-mail to the address of the domain's owner in which we explain what steps the registrant must take to reactivate the domain.

Each case is treated individually, and so we tailor our demands to meet the severity and nature of the offence.

10. Do you have a dedicated department or person who handles issues related to domain name suspensions?

Our entire Customer Care Department receives abuse complaints, though we have special e-mail addresses and online forms on our Web site that we also invite concerned citizens to use.

Complaints that we receive are then centralized by dedicated staff members (Ryan and Francoise), who investigate the validity of the complaints, enter into contact with the parties involved, and if necessary, take action. If there is a particularly complex case, a meeting is held by Gandi management together with our legal team, to discuss the complaint, and what action may be appropriate.

The advantage of this approach is that Gandi can tell the difference between domain name abuse, and the posting of an isolated user of a mailing list.