(context: I'm the CTO of Quad9 and am one of the people dealing with the lawyers)
There is an understandable focus on "how are you going to block French users" when we have also claimed that geoIP blocking is insufficient for selectively denying resolution for certain names - we understand this conflict, but we think it is energy spent in the wrong place.
It is probable that we will use geoIP filters to block French users from our services after November 24. We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we've been told to make unavailable. But this would corrupt our core premise, which is that the DNS is not the right place for this to happen, and if we comply within France to meet the requirement then we accept the worst eventual outcome for users and we still do not have legally perfect coverage. We wish to first remain consistent with our core mission, and secondarily we must remain as close to compliance as we can to the legal constraints put upon us. By accepting the demands for blocking, we would admit that such demands are permissible within our mission - that we will act on behalf of companies (or others) to create ineffective and mis-directed regimes of content constraint.
We would be admitting that we think this solves the problem - it does not. We would be admitting that we will do this for an ever-increasing number of names - we will not. We would be permitting these methods to be applied for more areas of filtering such as moral, religious, social, or political reasons - we must not.
So we accept that there is the possibility that we will have errors in our blockade, but in this case (blocking French users) we maintain consistency with our stated mission of integrity of the DNS. We would rather there be a clear distinction made for users of our services: you get the DNS as you (the user) expects, or if Quad9 is forced to pollute the service with unexpected and arbitrary number of fragmentation demands, then we will not offer the services at all.
The underlying issue is not ONLY that geoIP blocking is ineffective, but that the entire premise of any of these demands is inappropriately applied to DNS recursive resolution providers. We would hope that this discussion continues to be on the most fundamental of the disagreement we have with the outcome in this court case, not on the details of the technical implementation which have yet to be entirely decided and which can be tuned over time.
Good to see leaders stand up for what they believe in. Soemtimes I simply do not understand this obsession with controlling the internet by European countries. So ridiculous.
Keep up the good fight! I'm happy that you take a stand for your beliefs and try to do what's best for all of us.
Thanks for fighting this.
I wonder how much longer the internet will manage to hold out. Governments will continue trying to impose their laws on it, causing the international network to degenerate to numerous national networks with heavy filtering at the borders. It's really sad to watch...
It isn't just governments. Cases like this are started by companies.
Necessity is the mother of invention. Fortunately what's needed is already invented, but the motivation to push 'normal' people there hasn't. In particularly decentralized techs, TOR, and other technologies are fully robust against these actions.
Our inability to push "normal" people onto these things is precisely what will kill us. Tor needs a massive anonymity set to work properly. If people don't use it, we are all weakened. It also gives the corporations economic leverage: they can just ban Tor exit nodes and take the small loss instead of being forced to connect.
If you have no presence in France do you need to care about the ruling or the fines?
I mean, theres probably EU provisions in place to make that kind of local ruling have teeth, n'est-ce que pas?
Ok, but Switzerland is not a part of the EU. They participate only by treaty. So there has to be more to this story (legally-speaking)
EU is a treaty, or lots of them.
As some other comments on this post have mentioned, there is a a treaty known as the "Lugano Convention", whose parties are the EU (as a whole), Denmark [0], Iceland, Norway and Switzerland; post-Brexit, the UK wanted to join in its own right, but the EU refused. Under the Lugano Convention, if you get a judgement in a French court, you can then apply under the convention to have a Swiss court enforce it; however, there are exceptions which the Swiss court could rely on to refuse to do so – but I have no idea what are the odds that a Swiss court would decide any of those exceptions apply.
[0] Denmark has an opt-out from this area of EU law, which is why it is the only EU member state which needs to be directly party to the treaty; it applies to the others indirectly through the EU as a whole being a party to it
Thank you for the explanation! I couldn't agree more with your stance, and I appreciate deeply you fighting to maintain your (correct) principles. You've gained at least one fan and new user today.
One can only hope the tribunal that rendered this ridiculous decision is one of the organizations that lose DNS access on November 24.
Honest question here: why don't they target the operators for the nameservers that own the affected domain, basically the TLDs?
Oh right, the blocked domain is probably not a french TLD...
Well, they might be able to go against the domain registrars and possibly cloud providers that also operate in the french market. But those companies probably have a bigger expensive legal team, while quadnine is just a little non-profit.
Quick question: what would happen if you decided to simply shield yourself from France’s action without applying any change to your dns? Or is blocking french users considered a compliant answer by French courts?
I don’t get why you would still need to block french users if you also need to exit the jurisdiction.
Because continuing to provide the service to French users would mean they have not exited the jurisdiction. You cant provide services in a jurisdiction and at the same time expect not be subject to that jurisdiction. That's just not how any country treats legal jurisdiction.
Hence the “shield” part. I guess it’s easier said than done when you’re a Swiss non-profit and not an anonymous sysadmin in Iraq (or whatever jurisdiction would work for this example, idk).
> whatever jurisdiction would work for this example
The Principality of Sealand*
* until the UK or French navy shows up
Yes but if you don’t have any assets in the country you could not liable, that was OP’s point.
But even being based in Switzerland I believe there’s some inter-countries agreements, so it would not be practical.
Let's say you are a software company based in country C (company) and offer services to users in country U (users), only over the internet, and having no physical assets in country U. You could imagine Microsoft offering Office 365 to customers in Liechtenstein, for example.
GP's point is that whenever you sell or offer something to users in U, you have to abide by U's laws in doing so - no matter whether you did that all while sitting at your desk in country C.
Whether or not enforcement or liability is realistic is up to the relationship between U and C I guess - my guess is France and Switzerland are on pretty good terms.
Then Law is both broken, and dumb -
This is not exactly your focus, but this means that it can be possible for there to be a set of laws in U, such that an action is required and illegal if not present, but that this same action is illegal in C...
I.e., the predication is both meaningless and pointless, unless the supposition is that the laws of U don't hold - if C extradites a citizen of U over said action, is then U's law not supreme?
I understand that's probably how the law works, but it is kind of nonsensical to me that it passively allowing visitors from a country would pull you into their jurisdiction. Requiring you to be responsible for blocking any users to your service from U ensures seems analogous to an author of a book that is illegal/censored in U being required to make sure that no one from U buys the book and takes it back to their country.
“Dear France, have your ISPs block us because we won’t block you” could buy a few days of uptime there.
As a side project I help out with some technical stuff at a hosting company that provides services to a political group that is strongly anti Erdogan. The infrastructure is in the USA.
We do not block IP traffic from known Turkish ISP ranges. The customer (the political group) receives all sorts of dire legal warnings and threats that what they publish is contrary to Turkish law.
None of our other hosting platforms are configured to block any traffic to/from Turkish IP ranges. We have no business presence or financial involvement with anything domestically in Turkey. Am I subject to Turkish jurisdiction? I don't think so.
But by what you wrote, I am providing services in Turkey.
If you go to Turkey you might find yourself in a prison until you abruptly close this website. This is what happened to Pavel Durov (Telegram creator) in France. Telegram now complies with French law, because otherwise Pavel Durov would still be in French prison.
That's certainly a valid risk, if I were to put myself physically at the mercy of Turkish armed law enforcement inside their borders. In my particular case there's no public information that links my real name to the hosting company, as my work is behind the scenes.
Could Turkish intelligence link me to the company if they spent significant resources researching the hosting company that provides services to their political enemies? Probably. Do I have any personal plans to take a vacation in Turkey any time soon, or a pressing need to visit Turkey? No.
I am pretty sure we also have someone, somewhere hosting something that insults the King of Thailand, so I suppose that's a risk too.
This is a Swiss company offering services to French users. Although Switzerland is not an EU member, it is a party to the European Free Trade Area (EFTA) and through this, the Swiss government would likely be required to help enforce French rulings against their companies.
What about countries friendly with Turkey? I can easily imagine you being arrested in half of the world and extradited to Turkey because you are being criminally prosecuted in Turkey.
It sounds like your point is that (1) you think Türkiye is unlikely to unmask any individuals associated with your company and also (2) you have little interest in ever visiting that country anyway.
In the Quad9 people’s case, defying French law and still doing operating the services under French jurisdiction might work out just fine for as long as (1) holds true, but it doesn’t take a consorted effort of research to change that. It could just be that some leaked piece of information eventually surfaces. It could be a tweet posted by someone else. And I don’t know how many people work for that organization, or might do so in the future, but it seems like a bad move to make a decision on their behalf to paint a target on all their backs.
Also, France being part of the EU makes being an enemy of the state there seem even more unwise for anyone who might want to have associations in any other EU country.
I personally would do exactly what they are doing: if French people want a government that respects free speech, they had better elect one themselves. I wouldn’t become a martyr to that cause - it wouldn’t help anyway.
Bad example, especially githen the fact that Durov is a french national.
The problem is that, technically, an IP address doesn't have a country. GeoIP is at best a suggestion, and it is trivial to route your traffic through a "foreign" IP.
It is about as enforceable as "don't read letters written by redheaded people": it'll never be airtight, and it'll always have a huge amount of false positives.
The only possible "solution" is to ban all open devices from the internet, mandate a DRM-style "trust zone", have the device do mTLS, and embed a realtime DNA sequencer in every device.
Don't give them ideas... That's the wet dream they all salvate at... complete control of what's allowed to be published with a instant way of banning content and people.
Unrelated but hoping you could answer this:
There was a rumour years ago that Quad9 was connected to UK intelligence, or something like that. I haven't heard anyone discuss there for a long time, but wondering if you (or anyone reading this) can comment on the source of the rumours and whether there is any veracity to them.
The thing about DNS is that you can do your own investigations, rather than rely on rumour and innuendo. You can query their DNS and anyone else you can get at and compare results. You can use a VPN to appear to come from somewhere else or ask a friend to perform a query on your behalf.
You can literally [sigh] be your own journalist in this regard. All you need is a DNS query tool. I recommend dig but you might only have nslookup available out of the box.
Now, this UK intelligence thing. Even if James Bond Q's mates were actually running a DNS system you can still query it and compare it to someone else's view of the internet, say 1.1.1.1 or 8.8.8.8 or whatever.
You can also go to the source, ie root: . and work your own way down to decide on what is what.
Let's have a go at an analogy: DNS is (not really) a bit like a topographical map. You could buy your maps from DodgyRussianMaps'R'us and be surprised that Ukraine has somehow been subsumed by a bunch of murderous wankers. On the other hand you might buy your maps from HonestJonOffOfFaceb00c and note that it isn't. You can, of course, ask for a few other opinions and make up your own mind.
My real point is that DNS is actually quite hard to tamper with, without breaking so many things that everyone can know it is being messed with. When an org resorts to fiddling with DNS they've already lost whatever argument is to be had.
I think the point is more about the intelligence gathering rather than the tampering.
I think you fundamentally misunderstood the potential issue.
Sure, on a reply based approach you can audit a DNS service.
But that doesn't tell you about other things like "is my DNS provider also providing intelligence agencies with my entire DNS query history?". The issue isn't "oh no the MI6 can redirect my PornHub link to anothe site", but "oh no the MI6 knows every single webpage I visited". Which is a valid worry given the current British political climate.
I’m sorry for being so dense, so what do you plan to do?
It sounds like selectivd site blocking is against your mission, so will you then just not offer Quad9 to any person in France instead (total blackout across all sites)?
Sorry if I’m missing the obvious or your stated solution.
Sorry that you guys have to go through this. I use quad9 and it works great!
Better than geoip, y'all could work with the French to have French networks point to a black hole server by having BGP point 9.9.9.9 at said server.
The French might just do that anyway and point it at some government-approved “safe” DNS resolver.
I asked his elsewhere but aren't there like a prepondeance of existing case law or amicus-briefs that would speak to the logical and historical stupidity of arguments by the plaintiffs?
So, basically, you admit you will comply exiting all countries that ask for it; Pushing users to allegedly less safe resolvers in the name of security and integrity; And eventually ending the service in a couple of years because no one will be able to use your service since you'll be blocking most parts of the world and won't work without VPN exit in specific places. The decision is understandable, this really is a dillema I wouldn't want to take part in. You'll die by a thousand cuts of authoritarianism.
I haven't seen your donation to their legal defence fund? Cheque is in the mail?
It's strange that Quad9 openly does malicious domain filtering [1] using what it terms "threat intelligence feeds", but apparently filtering piracy domains is technically impossible and not the right place for this to happen. I think courts rightly are suspicious of this kind of doublespeak from DNS companies. If DNS filtering is effective for protection against malware and ransomware, it will be at least somewhat effective for piracy filtering too.
[1] https://quad9.net/service/threat-blocking/
Yeah, it's not the right place for it to happen. One's a service to protect the consumer, and the other is a corporate profit preserving concern. Why should a free DNS service be doing their work for them?
Because a court interpreted the law and ordered them to. And protecting companies from unlawful piracy is just as much a moral good as protecting the consumer from ransomware and threat actors. And if the DNS company can do the one, they can do the other.
protecting companies from unlawful piracy is just as much a moral good
bruh
> protecting companies from unlawful piracy
Counterpoint: piracy is moral.
Only if purchasing doesn’t mean ownership. ;)
Nobody's owning a thing, BeIN is a live sports channel
Enabling the transfer of information from companies to people through piracy is a moral good
I’ll always support those who are willing to take such risks where I am not.
(context: I am the CTO of Quad9) Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.
The threat feeds we offer are in alignment with what the user expects and intends. Mandatory restriction of DNS resolution by a third party (not the user, not Quad9) is expressly what users do NOT want, regardless of the outcome. Once such restrictions are enacted and treated as normal, the channel for making demands will fill with a flood of "objectionable" names from every corner for every reason. Quad9 has already received demands from the French regulator to block sites which deliver adult content found to be objectionable to minors. We see an extremely slippery slope which has already moved out of piracy as the scoped intent which is this case in particular.
More to the point: prohibiting content via the DNS is a useless exercise when it is done out of alignment with the end users' goals - they will simply use some other recursive resolver (or their own) probably without the benefits of being oriented towards security and privacy. We have no monopoly on DNS resolution - there are thousands of others open to public use, and anyone can set up their own, for free, with no mandatory requirements by governments or regulators. This case (and any others like it) only drives out law-abiding organizations who are trying to promote better cyber hygiene and who want to keep the DNS as a single, un-splintered high-integrity pointer system.
> Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.
TIL that filtering is on by default on the standard resolver (9.9.9.9). That’s certainly a surprise to me; I would have expected the standard resolver to provide “honest” DNS responses and a secondary to provide filtering, rather than the reverse (which is what I think Cloudflare does).
While I think that the ruling is both morally and legally questionable, I do agree with GP that this weakens your original argument quite a bit.
> TIL that filtering is on by default on the standard resolver (9.9.9.9).
Their offering is explained in the first paragraph of the home page, in fact the h1 and page title cover it.