Under Attack? Call (844) END.DDoS


This week agents from the US Customs and Homeland Security agencies seized assets (including DNS domain names) from fifteen streaming Internet video companies, including PlanetMoviez.com, Movies-Links.tv, Filespump.com, Now-Movies.com, ThePirateCity.org, NinjaVideo.net, NinjaThis.net and TVshack.net.

The below graphic shows the colorful DOJ / ICE warning now greeting visitors to these disabled domains. We include the previous homepage for tvshack.net below (note: from a personal viewpoint, I think showing a Knight’s Tale is a crime in itself).


The US government complaint alleged that these web sites illegally distributed pirated first-run movies and television shows in exchange for small subscription fees and advertisement revenue.

In addition to domain names, US officials also seized bank accounts and executed search warrants in four states.

The video sites reportedly collectively enjoyed more than 7 million unique visitors per month and all ranked in the Alexa Top 10,000 (Tvshack.net ranked 1,762).

Though the actual servers hosting the alleged pirate web sites resided in different countries (including the Netherlands and Germany), the video sites registered the domain names using US based companies.

Which all brings up some interesting questions.

Jurisdiction and policy are tricky things in this age of a global Internet.

In particular, government and court jurisdiction over virtual global Internet shared resources pose interesting extra territorial jurisdiction and sovereignty questions.

In the specific case of civil commercial trademark and copyright disputes, the Internet benefits from a long international intellectual property legal tradition with the ICANN Uniform Dispute Resolution Policy. While imperfect, the UDRP process works and has resolved thousands of commercial domain name intellectual property disputes.

But beyond UDRP settlements, criminal jurisdiction over DNS and other shared global Internet resources remains a murky and rapidly evolving virgin legal territory. We’ll explore a few recent cases:

And if DNS domains for foreign companies using .net or .com can be seized by the US, do foreign governments have jurisdiction over gTLDs managed by a registrar incorporated in their countries? In theory, ICANN insists top level domain registrars do not “own” domains, but act as trustees for their delegations with “a duty to serve the community.”

Even more interesting, if DNS domain names are property then do the courts have jurisdiction over the root servers or over other ICANN and regional registry (i.e. ARIN, RIPE, APNIC) number allocations? Could a foreign court order US providers to stop accepting BGP ASNs or revoke IPv4 address assignments?

Or maybe the legal issues are an intellectual curiosity but not terribly important from an operational perspective.

The real question is did the US Customs and Homeland Security domain seizure have an impact on the steady flood of illegal movie downloads / streaming?

Tvshack (as well as several other movie sites) uses a Dutch Hosting provider, Ecatel (AS29073), with multiple data centers in Amsterdam, The Hague and Stockholm. Ecatel uses GlobalCrossing and Terremark for upstreams and maintains dozens of smaller peering sessions at the AMS and NS exchange.

The graph below shows traffic from five North American consumer providers with Ecatel between June 27 and July 2. All times are EDT.

While Ecatel has many other hosting customers besides Tvshack, few are likely as large. You can see the impact of the Wed June 30th tvshack domain seizure on AS29073 traffic above. Within hours of the takedown, Ecatel traffic dropped by more than 25%.


During the Wednesday press release announcing the US government action, ICE Assistant Secretary John Morton declared
“I don’t think we’ve stopped Internet piracy in a day”.

It turns out Mr Morton was right.

The seizure did not stop piracy within a day — not even half a day.

Four hours after the seizure, tvshack administrators registered a new domain name. But this time, tvshack selected a Chinese registrar and a Cocos Islands ccTLD.

Traffic is now rapidly climbing to the renamed tvshack.cc site.