Feeds

Wikileaks Iraq War Logs vanish from Amazon US

Whistle-blower still on American registrar, DNS

High performance access to file storage

WikiLeaks' "Iraq War Logs" site is no longer hosted on US-based servers operated by Amazon.com, according to internet records.

Warlogs.wikileaks.org is now mirrored only on Ireland-based Amazon servers and France-based servers from French service provider Octopuce, records collected by UK-based internet research outfit NetCraft show.

The main WikiLeaks site, however, is still mirrored on US-based Amazon servers, according to NetCraft data. What's more, the site's DNS service is controlled by a US outfit, and it uses a US-base domain name registrar.

On Friday, after WikiLeaks released almost 400,000 classified documents related to the Iraq War, independent technology consultant Alex Norcliffe noticed that the whistle-blowing outfit was mirroring its content on Amazon's AWS infrastructure cloud in the US and Ireland, and on Octopuce servers in France. This included both the new warlogs.wikileaks.org, which serves up the Iraq Wars Logs, and the organization's primary site, www.wikilleaks.org.

Then, on Tuesday, Norcliffe noticed that the US mirrors had disappeared.

WikiLeaks maintains its central servers in Sweden with the outfit PRQ, run by the founders of the P2P file-sharing site The Pirate Bay. According to WikiLeaks founder Julian Assange, the organization uses servers in Sweden because the country provides legal protection for disclosures on the site. PRQ also offers what's commonly known as "bulletproof" hosting. It keeps almost no information about its users, and it maintains few if any logs.

But it would appear that Wikileaks began mirroring its data on Amazon and Octopuce in an effort to handle the additional traffic expected with the release of the Wars Logs. Wikileaks has not responded to emails sent to addresses it has answered in the past.

We've also contacted Amazon and the US Department of Defense, which has condemned the release of the Iraq War Logs, but neither has responded.

Wikileaks on Amazon

Warlogs.wikileaks.org was hosted on US-based Amazon servers. But no more...

It's unclear why the War Logs site is no longer hosted on Amazon's US servers. Conservative US newspaper The Washington Times is calling for a US government-led cyberattack on WikiLeaks. Though Amazon may not be legally compelled to remove the War Logs from its servers, Santa Clara law professor and tech law blogger Eric Goldman questioned whether Amazon might removed the data anyway.

"[Federal law] 47 USC 230 protects Amazon from being liable for WikiLeaks' content in most circumstances. The only relevant exception is that 230 does not protect Amazon if republishing the content constitutes a federal crime. I'm uncertain what crimes could apply to the content publication," Goldman told The Register over the weekend, while the Wars Logs site was still on Amazon's US-based servers.

"However, even if Amazon is insulated from liability, I suspect Amazon will choose to remove the content 'voluntarily' (motivated by a little persuasion from the government), presumably citing a breach of its terms of service as a pretext.

"A more 'ideological' web host would probably fight more vigorously for its users' publishing rights than Amazon will," Goldman said.

Another federal law, 18 USC 798, forbids the disclosure classified information about a "code, cipher, or cryptographic system of the United States" or "the communication intelligence activities of the United States." But according to George Washington University law professor Orin Kerr, this does not mean that Amazon is legally at fault. "The statute requires that the person held liable has to act 'knowingly and willfully,' and Amazon has not done either," he tells The Reg.

As NetCraft points out, it appears that WikiLeaks has set up its DNS so it can quickly shift its mirrors between locations. Warlogs.wikileaks.org has a 15-minute "time to live" (TTL) setting, which would allow for a rapid move if content is taken down in one location. NetCraft says it has not witnessed any outages at the site.

But even if WikiLeaks is not hosting the War Logs on US servers, it may be vulnerable because EveryDNS is owned by Dyn Inc., a US-based company. Wikileaks also uses a US-based domain register, Dynadot.®

Update: This story has been updated to show that Dyn Inc. – not Dynadot – owns EveryDNS and that there is only one major paper, The Washington Times, calling for a US-government-led cyberattack on Wikileaks.

High performance access to file storage

More from The Register

next story
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
Broadband Secretary of SHEEP sensationally quits Cabinet
Maria Miller finally resigns over expenses row
Skype pimps pro-level broadcast service
Playing Cat and Mouse with the media
Beat it, freetards! Dyn to shut down no-cost dynamic DNS next month
... but don't worry, charter members, you're still in 'for life'
EE dismisses DATA-BURNING glitch with Orange Mail app
Bug quietly slurps PAYG credit - yet EE denies it exists
Like Google, Comcast might roll its own mobile voice network
Says anything's possible if regulators approve merger with Time Warner
Turnbull leaves Australia's broadband blackspots in the dark
New Statement of Expectations to NBN Co offers get-out clauses for blackspot builds
Facebook claims 100 MEEELLION active users in India
Who needs China when you've got the next billion in your sights?
Facebook splats in-app chat, whacks brats into crack yakety-yak app
Jibber-jabbering addicts turfed out just as Zuck warned
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.