Server Seizure ConcernsBy Jay Lyman,
This article appeared in the August 2005 issue of Web Host Industry Review magazine. Click here for a free subscription.
Servers hosting content for Indymedia, a collection of independent news sites and online radio shows, have been taken offline, again highlighting the precarious position of Web hosts caught in the collision of free speech, customer rights, and government requests, as well as potential liability for legal compliance.
The most recent Indymedia server seizure reportedly occurred at a private residence in Bristol, UK, where authorities took an entire server and other computer equipment. The action follows last October’s controversial seizure of whole servers that apparently involved a request from a foreign government, an order from the US, and a handing over of equipment by US-based Rackspace, which may now face liability for letting go of more than was requested, says Electronic Frontier Foundation (eff.org) staff attorney Kevin Bankston.
Bankston, who did not comment on the more recent server seizure in the UK, says the EFF was still fighting to review the actual court order to find out whether the US government - apparently prompted by Italian authorities - subpoenaed entire servers or simply IP logs, which is more typical, when the Rackspace UK Indymedia servers were seized last year.
Bankston says the EFF, which is working with Indymedia on the matter, understood that Italy only asked for IP logs, and Rackspace, after receiving a subpoena from US authorities last July, made a mistake in October 2004 by panicking somewhat and actually opening servers to remove hard drives for authorities in response to the request.
Beyond the apparent disregard for freedom of speech, says Bankston, the incidents highlight how Web hosts such as Rackspace should not respond, even to legitimate government requests, without contemplating customer rights and laws protecting privacy.
“It’s a good lesson for enterprises or Web hosts that not only do they have an ethical responsibility to their customers, but they have a legal responsibility under federal privacy law,” Bankston said.The EFF indicates on its site that Rackspace, which declined to comment citing an ongoing legal case on the matter, may be facing liability from an investigation being conducted by UK officials.
“An investigation is underway to determine if Rackspace UK’s actions violated the UK Data Protection Act or the Regulation of Investigatory Powers Act,” says an EFF report.
Amid the speculation on what may have prompted the previous - and the most recent - Indymedia server seizures (the server takedown came a week before the G8 Summit and accompanying protest in Scotland) Bankston says it always seems to come from something written in an anonymous user posting.
“It’s not surprising, but it’s sad that when you are a facilitator of speech, you turn yourself into a target for all this legal process,” he says. “Certainly, intermediaries such as Web hosts should be mindful of what can be incredibly burdensome requests.”
Such requests caused an outcry among US ISPs last year when the Recording Industry Association of America was busy sending subpoenas for IP information to track alleged illegal file traders. US courts have since ruled that the RIAA cannot send its blanket subpoenas to multiple users, instead limiting the industry group to so-called “John Doe” suits, where the alleged infringers are not identified until they are in court.
Maury Shenk, a UK attorney with Steptoe & Johnson, says balancing of official requests and user rights is a difficult issue for Web hosts, who must also contend with various governments and laws based on international rules such as the Mutual Legal Assistance Treaty, which was invoked in last year’s Indymedia seizure, according to a Rackspace statement.
However, Shenk adds that while hosts must maintain their rules of use and privacy protections, a legitimate search warrant or other order from the police or courts must always be met with cooperation.
“I don’t think this is a very difficult issue for a Web host,” Shenk said. “If there’s a search warrant, you don’t have much choice but to comply.”
Shenk says Rackspace may incur some liability if it did in fact turn over more than what was requested in the warrant or court order last year.
“If you allow people to take more than the warrant says, that’s a mistake,” he says.
The attorney says this is why Web hosts and other intermediaries must carefully evaluate the legitimacy and scope of such a legal order. If it is a civil complaint or other matter that does not involve government authority, hosts typically give the customer a chance to respond, and are not as bound to compliance, according to Shenk.
“You need to make sure the warrant is valid,” he said. “But if you’re a Web host, you kind of have to comply with it.”
