Small business domain name hijack via gmail
Interesting and unfortunate tale on several fronts, including the usefulness of WHOIS: <http://www.davidairey.co.uk/google-gmail-security-hijack/> Maybe we can help this guy somehow? Note especially these paragraphs: "Where can I get help with domain name disputes? This is the stage I'm at now, weighing up my options before it comes to paying legal fees. This is also where I'm calling on your valued help. I know that many of you are much more clued up on this than I am, and if you can spare some advice in the comments here I'd be very appreciative. In my email communications with GoDaddy (the company where my .com domain name is now registered), a representative had this to say: Should we receive notice of a pending dispute from a court or arbitration forum, we will lock the domain name so it cannot be transferred or have the registrant information modified. Likewise, when we receive a decision from the legal body, we will update the domain name accordingly. They then directed me to the WIPO (World Intellectual Property Organization, domain.disputes@wipo.int). So I looked into this organisation's website, and in particular, the section on domain name dispute resolution resources. There's a FAQ section which provides information on a number of items, including the following: How do I file a dispute? How much will it cost and who pays? Can damages be awarded? To cut a long story short, it seems I have to pay a minimum of $1500 for the pleasure of initiating a court case. All fees are listed here. As for how long the process lasts, this information isn't very obvious on the WIPO website, so at present I'm unsure. What should I do?
From what I understand, the only option is to proceed with legal action (again, I'm not paying the thief one penny).
Do you know any different? Do I have a good case to proceed with? Is there any other information available online about the pirate who is blackmailing me? If you can provide any of these answers, it would mean a lot." -----Original Message----- From: Jonathan Zittrain [mailto:zittrain@law.harvard.edu] Sent: Tuesday, December 25, 2007 2:04 PM To: stopbadware-workinggroup@eon.law.harvard.edu Subject: [stopbadware-workinggroup] gmail hack An awful tale, beginning with a gmail hack and ending with a domain name hijacking. Fascinating. <http://www.davidairey.co.uk/google-gmail-security-hijack/> *** Scanned
Brendler, Beau wrote:
Interesting reminder how tenuous and insecure domain name "ownership" is.
Maybe we can help this guy somehow?
"UPDATE December 28th: You left over 400 comments on my original post (now located here on my .com domain). My domain name has been returned, and you can read how it happened in this blog article." linking <http://www.davidairey.com/david-airey-dot-com-restored/> However, we might well want to look into ways (including education) by which individuals could keep their domains better secured. --Wendy -- Wendy Seltzer -- wendy@seltzer.org Visiting Professor, Northeastern University School of Law Fellow, Berkman Center for Internet & Society http://cyber.law.harvard.edu/seltzer.html http://www.chillingeffects.org/ https://www.torproject.org/
This is a good ending Wendy. Its good to see that the Registrant was able to reverse this with help from GoDaddy. I've heard far too many stories where Registrars have simply walked away from the Registrant in situations like this - regardless of whether the original request was valid or not. On 2-Jan-08, at 11:25 AM, Wendy Seltzer wrote:
Brendler, Beau wrote:
Interesting reminder how tenuous and insecure domain name "ownership" is.
Maybe we can help this guy somehow?
"UPDATE December 28th: You left over 400 comments on my original post (now located here on my .com domain). My domain name has been returned, and you can read how it happened in this blog article." linking <http://www.davidairey.com/david-airey-dot-com-restored/>
However, we might well want to look into ways (including education) by which individuals could keep their domains better secured.
--Wendy
-- Wendy Seltzer -- wendy@seltzer.org Visiting Professor, Northeastern University School of Law Fellow, Berkman Center for Internet & Society http://cyber.law.harvard.edu/seltzer.html http://www.chillingeffects.org/ https://www.torproject.org/
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org
At-Large Official Site: http://www.alac.icann.org ALAC Independent: http://www.icannalac.org
Ross Rader Director, Retail Services t. 416.538.5492 c. 416.828.8783 http://www.domaindirect.com "To solve the problems of today, we must focus on tomorrow." - Erik Nupponen
This is a very simple issue. In this case, the Registrant did not approve the transfer. The Form of Authorization that GoDaddy procured was fraudulent, and therefore invalid. Why would Godaddy take the position that they can do nothing? It should be a very simple process to simple revert the ownership and the transfer. On 2-Jan-08, at 11:11 AM, Brendler, Beau wrote:
Interesting and unfortunate tale on several fronts, including the usefulness of WHOIS:
<http://www.davidairey.co.uk/google-gmail-security-hijack/>
Maybe we can help this guy somehow? Note especially these paragraphs:
"Where can I get help with domain name disputes? This is the stage I'm at now, weighing up my options before it comes to paying legal fees. This is also where I'm calling on your valued help. I know that many of you are much more clued up on this than I am, and if you can spare some advice in the comments here I'd be very appreciative.
In my email communications with GoDaddy (the company where my .com domain name is now registered), a representative had this to say:
Should we receive notice of a pending dispute from a court or arbitration forum, we will lock the domain name so it cannot be transferred or have the registrant information modified. Likewise, when we receive a decision from the legal body, we will update the domain name accordingly.
They then directed me to the WIPO (World Intellectual Property Organization, domain.disputes@wipo.int).
So I looked into this organisation's website, and in particular, the section on domain name dispute resolution resources.
There's a FAQ section which provides information on a number of items, including the following:
How do I file a dispute? How much will it cost and who pays? Can damages be awarded? To cut a long story short, it seems I have to pay a minimum of $1500 for the pleasure of initiating a court case. All fees are listed here.
As for how long the process lasts, this information isn't very obvious on the WIPO website, so at present I'm unsure.
What should I do?
From what I understand, the only option is to proceed with legal action (again, I'm not paying the thief one penny).
Do you know any different? Do I have a good case to proceed with? Is there any other information available online about the pirate who is blackmailing me? If you can provide any of these answers, it would mean a lot."
-----Original Message----- From: Jonathan Zittrain [mailto:zittrain@law.harvard.edu] Sent: Tuesday, December 25, 2007 2:04 PM To: stopbadware-workinggroup@eon.law.harvard.edu Subject: [stopbadware-workinggroup] gmail hack
An awful tale, beginning with a gmail hack and ending with a domain name hijacking. Fascinating.
<http://www.davidairey.co.uk/google-gmail-security-hijack/>
*** Scanned
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org
At-Large Official Site: http://www.alac.icann.org ALAC Independent: http://www.icannalac.org
Ross Rader Director, Retail Services t. 416.538.5492 c. 416.828.8783 http://www.domaindirect.com "To solve the problems of today, we must focus on tomorrow." - Erik Nupponen
participants (4)
-
Bashar Al-Abdulhadi -
Brendler, Beau -
Ross Rader -
Wendy Seltzer