From: InfoSec News (alertsinfosecnews.org)
Date: Tue Mar 20 2007 - 01:06:37 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.eff.org/deeplinks/archives/005168.php

By Derek Slater
March 16, 2007

A few weeks back, we wrote [1] about how domain name registrar GoDaddy
took offline Seclists.org based merely on an informal request and
without providing any meaningful notice to the site's operator.
Unfortunately, this isn't the only instance in which GoDaddy has
carelessly ignored its users' rights.

In February, EFF was contacted by an anonymous owner of a parody and
criticism website forum that allegedly exposes the financial corruption
and domestic scandal of a local politician in Birmingham, Alabama. As
part of a civil case in family court, an attorney representing the
politician's girlfriend issued a subpoena to GoDaddy seeking the
identity of the website owner, who was not a party to the lawsuit.

With the website owner's right to anonymous speech on the line, what did
GoDaddy do? It caved without any apparent hesitation, providing its
customer with a mere three days to find a lawyer and decide whether to
file a challenge. GoDaddy also refused to provide a copy of the
subpoena, which included essential information to determine whether and
how to respond.

GoDaddy promises in its privacy policy [2] to turn over customers'
information only if required by law, but its lawyers didn't give this
subpoena even a shred of scrutiny. Had they done so, they could have
seen it was clearly invalid -- GoDaddy is located in Arizona and Alabama
state law doesn't permit a subpoena to be issued on someone out of
state. That was the ultimate conclusion of the state judge who
eventually quashed the subpoena, no thanks to GoDaddy.

Even putting aside this aspect of GoDaddy's casual disregard for its
customer's interests, the company's behavior is shameful. The First
Amendment limits the ability of litigants to pierce a speaker's
anonymity [3], particularly when that person isn't even being sued.
GoDaddy owes its customers meaningful notice, time, and information so
that they can fight back and protect their rights.

With the help of lawyer Lewis Page [4], the anonymous website operator
did manage to move to quash before it was too late. But GoDaddy's sloppy
practices still put an unfair burden on this user and continue to
threaten all of its customers' rights.

For what online service providers ought to do to protect their users,
check out our best practice guide [5].

[1] http://www.eff.org/deeplinks/archives/005096.php
[2] http://www.godaddy.com/gdshop/legal_agreements/show_doc.asp?isc=goox2001av&pageid=PRIVACY
[3] http://www.eff.org/Privacy/Anonymity/
[4] http://www.pagelaw.com/
[5] http://www.eff.org/osp/

_________________________________________
Visit the InfoSec News Security Bookstore
http://www.shopinfosecnews.org

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]