[ISN] GoDaddy, Get a Backbone and Protect Your Users' Rights

From: InfoSec News (alerts@private)
Date: Mon Mar 19 2007 - 22:06:37 PST


By Derek Slater
March 16, 2007

A few weeks back, we wrote [1] about how domain name registrar GoDaddy 
took offline Seclists.org based merely on an informal request and 
without providing any meaningful notice to the site's operator. 
Unfortunately, this isn't the only instance in which GoDaddy has 
carelessly ignored its users' rights.

In February, EFF was contacted by an anonymous owner of a parody and 
criticism website forum that allegedly exposes the financial corruption 
and domestic scandal of a local politician in Birmingham, Alabama. As 
part of a civil case in family court, an attorney representing the 
politician's girlfriend issued a subpoena to GoDaddy seeking the 
identity of the website owner, who was not a party to the lawsuit.

With the website owner's right to anonymous speech on the line, what did 
GoDaddy do? It caved without any apparent hesitation, providing its 
customer with a mere three days to find a lawyer and decide whether to 
file a challenge. GoDaddy also refused to provide a copy of the 
subpoena, which included essential information to determine whether and 
how to respond.

GoDaddy promises in its privacy policy [2] to turn over customers' 
information only if required by law, but its lawyers didn't give this 
subpoena even a shred of scrutiny. Had they done so, they could have 
seen it was clearly invalid -- GoDaddy is located in Arizona and Alabama 
state law doesn't permit a subpoena to be issued on someone out of 
state. That was the ultimate conclusion of the state judge who 
eventually quashed the subpoena, no thanks to GoDaddy.

Even putting aside this aspect of GoDaddy's casual disregard for its 
customer's interests, the company's behavior is shameful. The First 
Amendment limits the ability of litigants to pierce a speaker's 
anonymity [3], particularly when that person isn't even being sued. 
GoDaddy owes its customers meaningful notice, time, and information so 
that they can fight back and protect their rights.

With the help of lawyer Lewis Page [4], the anonymous website operator 
did manage to move to quash before it was too late. But GoDaddy's sloppy 
practices still put an unfair burden on this user and continue to 
threaten all of its customers' rights.

For what online service providers ought to do to protect their users, 
check out our best practice guide [5].

[1] http://www.eff.org/deeplinks/archives/005096.php
[2] http://www.godaddy.com/gdshop/legal_agreements/show_doc.asp?isc=goox2001av&pageid=PRIVACY
[3] http://www.eff.org/Privacy/Anonymity/
[4] http://www.pagelaw.com/
[5] http://www.eff.org/osp/

Visit the InfoSec News Security Bookstore

This archive was generated by hypermail 2.1.3 : Mon Mar 19 2007 - 22:22:42 PST