The SBU seized NIC.UA servers, affecting tens of thousands of clients (updated)
On Tuesday, April 7, 2015, the Security Service of Ukraine, without explanation,seized the serversNIC.UA's four data centers in Kyiv were hacked. Tens of thousands of the company's clients suffered as a result of these law enforcement actions.
The company's director, Andrei Khvetkevich, learned that law enforcement agencies were seizing servers from a phone call from employees of one of the data centers around 10 a.m.
It wasn't until 2:00 PM that we learned the official reason and received a copy of the court ruling. It stated that the company hosted five separatist websites on its premises and that they should be taken down. The websites aren't physically located on the company's premises; they are hosted elsewhere. Only the domains of four of the five websites are registered with NIC.UA.
"To block a website that violates Ukrainian law, an official request from the relevant authorities is sufficient. We regularly receive requests from the Security Service of Ukraine (SBU) regarding such websites, and we block them. Why the SBU decided not to send a request to us this time, but to seize the company's servers, is beyond me. These illegal actions have disabled the websites of tens of thousands of our clients, while the websites cited in the court order remain operational because we don't actually own the websites themselves, only the domains.", says Andrey Khvetkevich.
The company representatives received the list of seized equipment only by 3:00 p.m.The seizure protocol has not yet been received at the time of writing this press release.
The court's ruling was unfounded, but gave law enforcement agencies formal powers to seize equipment.
In our opinion, the judge simply failed to heed the SBU investigator's demands and did not fully review the case materials, resulting in such an unfounded decision. The court's rulings clearly state that the separatist websites are maintained outside of Ukraine, so seizing equipment in Ukraine is pointless.
The company's lawyers are currently trying to recover the equipment to restore the clients' websites. There's no word yet on when the trial will take place, but we expected it to happen today, April 8.
We do not support separatist websites and always cooperate with law enforcement agencies within the framework of a well-established and agreed-upon interaction algorithm.
In August 2014, despite the absence of a court order, we blocked the gubarev.org domain based on a reasoned request from the Security Service of Ukraine (SBU). We amended our Public Offer and written agreements to ensure a more effective response mechanism.
Below we present a chronology of the SBU's requests and responses, indicating that our company cooperated with law enforcement agencies promptly and within the law.
By domain odnarodyna.com.ua:
1.41727 there was a request from the SBU “to provide information”:
Answer:
- 42024 There was a client request. We wrote to the client that we would block the domain, and we did so on January 21, 2015. We then informed the client about the work done.
By domain slv.org.ua:
41929 there was a request from the SBU (Department of Counterintelligence for the Protection of the State's Interests in the Information Security Sphere), we only received a scan. They didn't ask to block the domain, just provide information. Request:
The corresponding response was prepared by:
UPDATE: In January 2015, we amended our public agreement and written contracts. These changes simplify the domain blocking procedure for websites that violate Ukrainian law. As a result, the domain odnarodyna.com.ua was blocked.
The requests below were received before the contract amendments were made. The originals have not yet been received.
By domainnahnews.com.ua:
1.41851The SBU in Kharkiv requested information on the domain.
The information is provided in our response:
2.41863We received two email requests from the SBU's Counterintelligence Department. The first was for information, the second was for blocking. We cannot publish the second request because it is confidential.
Our lawyer provided the necessary information via email and received a response from an SBU officer stating that the information provided was sufficient.
The header of the blocking request states "Request for information"; there is no information about the criminal proceedings or the grounds for blocking the domain.
The scanned request came from an email address that doesn't match the government domain name. We still haven't received the originals.
Further correspondence:
3.August 20, 2014A request for information was received from the Dnipropetrovsk department of the SBU.
Information on the request was provided by:
4.On September 8, 2014, we received two requests from the SBU's Counterintelligence Department. The first was for information, the second was for domain delegacy. There was no criminal investigation. We provided the information and outlined the steps required to block the domain in accordance with the law. We expressed our willingness to cooperate and requested a court decision, thereby voicing the Ministry of Internal Affairs' position on this matter (as stated at a briefing on August 19, 2014). We are not publishing the text of the blocking requests due to SBU instructions to ensure confidentiality. We never received the original request.
Answer:
5.41983We received the latest request for the domain nahnews.com.ua to provide information regarding the domain name.
The information in the response was provided by:
By domainrubezhnoe.org.ua
11.08.14Our support team received two separate complaints regarding this domain. We responded promptly and requested that the relevant authorities be contacted.
A month later, we received a request for information from the SBU's Counterintelligence Department, dated September 27, 2014. Unfortunately, we cannot publish the request itself, as the SBU requested confidentiality. The Department cited current legislation for information. In the final part of the letter, the SBU requests "to ensure the proper functioning of the stated domain name." However, the Department does not cite any legislation. Importantly, we never received the original request. Given the many legal nuances of this request, we prepared an appropriate response. We voiced the legal position that representatives of the Ministry of Internal Affairs stated at briefings: a court order is required to block a domain name.
Following the SBU request of September 27, 2014, for the domain name rubezhnoe.org.ua, we have not received any official requests from the SBU.
By domaingubarev.org
As we stated at the conference, we have always blocked domains when we were approached with clearly substantiated requests. To confirm this, we are publishing our responses to the SBU's inquiries regarding the gubarev.org domain. The SBU Directorate in Dnipropetrovsk Oblast sent us a request for information on July 4, 2014. The request and response are available below.
A response that provides information.
The request from the Dnipropetrovsk Oblast Security Service Directorate dated August 12, 2014, contained a request to block the gubarev.org domain. Please note that the request clearly states that a criminal case has been initiated and provides relevant information. We received all requests from the Dnipropetrovsk Oblast Security Service Directorate in hard copy (i.e., originals).
Information from Evgeniy Dokukin (head of the Cyber Troops of Ukraine), posted on hisFacebook pageThe claim that we didn't cooperate until a court ruling was received is untrue. In this case, understanding the entire situation, we promptly responded to the SBU's reasoned request, filed in accordance with current legislation, and blocked the domain.
Below is a request and our response regarding the blocking of the domain name gubarev.org.
