Gandi Bar - Gandi US - Comments

Gandi's Opposition to the SOPA Legislation - BAReFOOt

BAReFOOt — Mon, 23 Jan 2012 05:31:39 -0400

Hmm… Seems your “preview” button does actually publish things right away, and there is no preview. :/

Gandi's Opposition to the SOPA Legislation - BAReFOOt

BAReFOOt — Mon, 23 Jan 2012 05:30:35 -0400

I’m deeply disappointed, that you still support organized crime (the “media” Mafia), by using fake/propaganda words like “piracy”. You should, by now, know exactly and know why information can not be owned, sold or stolen. Why making a copy does not harm the person that the copy was made from. That copyright is specifically designed to abuse artists and creatives. (It's not authors’ right, after all! It’s a distributors' “right”.) That the whole thing “intellectual property” is a protection racket, and a crime. That they are accusing us of the exact thing *they* are doing. *They* are ripping off artists in a service-based adhesion contract, while wanting money for every copy, even though they didn’t do a single bit of work in return, and actually didn’t do any work at all anyway!

The thing is, that their fraudulent model (the *exact* opposite of your “no bullshit” philosophy, by the way) doesn’t work anymore, in a world where there is the Internet.
That’s why they want to stop the Internet in the first place.

It's a crime. It hurts *everyone*, except for a small group of lazy cocaine-filled douches. If you support it, you’re a criminal. And you don’t have to support SOPA to support it. If you so much as spread the lie of “intellctual property” or “piracy”, you’re already deep inside it.
Please don't be criminals. Ok?

Thank you.

(Yes, I’m a information scientist, specializing in information physics and that whole “IP” racket.)

Gandi's Opposition to the SOPA Legislation - Dave

Dave — Wed, 11 Jan 2012 05:38:12 -0400

Transferred a personal .ws domain from GoDaddy to here - liked the interface and the feel of the site enough that I moved my domains from a registrar I was perfectly happy enough with too.
I'll be moving another 50 or so of the company I work for from GoDaddy next week.

Gandi's Opposition to the SOPA Legislation - Stokes

Stokes — Fri, 30 Dec 2011 13:47:46 -0400

I see that the total due is $15.00 for my transfer from godaddy. Has this offer expired?

Gandi's Opposition to the SOPA Legislation - Byte

Byte — Fri, 30 Dec 2011 02:30:22 -0400

It's interesting to read that Gandi is in agreement with "the goals of anti-piracy efforts"; what about Fair Use? How about "the toddler dancing to a popular song playing on the TV"? How about sound recordings from before WW2 still being (c) by some label? Come to think of it, which sound recordings have actually passed in the Public Domain in the US? Is Gandi really in agreement with all that? Yes, if you publish one of those 1940s home-made 78 rpm recordings of great-great-grandparents singing "Happy Birthday To You", Warner Music can order it taken down. And Gandi is apparently in agreement that.

Gandi's Opposition to the SOPA Legislation - EkriirkE

EkriirkE — Fri, 30 Dec 2011 00:41:23 -0400

Everything's Moved! Well, almost. It seems even though all my domains were unlocked, properly auth'd, paid for to Gandi, and approved, all of my .ME domains failed because they appear to still be locked by GoDaddy, they are not relinquishing them!

How long is my committed order valid while I sort them out?

Gandi's Opposition to the SOPA Legislation - Jonas

Jonas — Wed, 28 Dec 2011 18:29:12 -0400

Remember! 29 December is move your domain day!

Let's relieve Godaddy of the domains once and for all!

Gandi's Opposition to the SOPA Legislation - GogglesPisano

GogglesPisano — Tue, 27 Dec 2011 17:47:44 -0400

Just transferred my domain from GoDaddy.com to here, based on recommendations on reddit.com. Thanks for the price decrease and for decrying SOPA as the abomination that it is.

Gandi's Opposition to the SOPA Legislation - killbam

killbam — Tue, 27 Dec 2011 13:13:45 -0400

Is is great that Gandi.net has come out against SOPA, and I'm more than happy to have my domains hosted here as well as encourage other people to do the same. I hope that Gandi continues to speak out against SOPA, PIPA, and all censorship laws by all governments.

Gandi's Opposition to the SOPA Legislation - Nicolas (Gandi)

Nicolas (Gandi) — Sun, 25 Dec 2011 11:40:22 -0400

Yes we have decrease our gtld transfer in price in USD for a week. For more than 100 transfer you can contact me directly on Nicolas@

Gandi's Opposition to the SOPA Legislation - EkriirkE

EkriirkE — Sun, 25 Dec 2011 02:06:16 -0400

I just transferred 5 domains to Gandi as they were about to be renewed and will be doing the remaining 70-odd domains on "NoDaddy Domain Transfer Day" the 28th. Is there some kind of coupon code you guys can offer to make the transfers a little bit easier?

Gandi's Opposition to the SOPA Legislation - UnnDunn

UnnDunn — Sun, 25 Dec 2011 00:25:34 -0400

I just completed the transfer of 7 domains from GoDaddy to gandi.net. Hope you guys don't let me down.

Gandi's Opposition to the SOPA Legislation - osmosis

osmosis — Sat, 24 Dec 2011 16:24:51 -0400

If you could support bitcoin as a payment method, you would be king in my book!

Gandi's Opposition to the SOPA Legislation - dt

dt — Sat, 24 Dec 2011 03:50:37 -0400

I am transferring one domain, is there any promo code I can use?

Gandi's Opposition to the SOPA Legislation - HD

HD — Sat, 24 Dec 2011 03:27:47 -0400

Thanks for standing up - transferred 38 domains and counting so far.

Gandi's Opposition to the SOPA Legislation - Mikee

Mikee — Fri, 23 Dec 2011 22:58:59 -0400

Add me as another new customer who came over from GD today after seeing the good reviews on reddit.

Gandi's Opposition to the SOPA Legislation - Michael Moore (Gandi)

Michael Moore (Gandi) — Fri, 23 Dec 2011 19:13:21 -0400

If you are paying in US Dollars, Gandi has currently discounted the transfer rate of .biz, .com, .info, .net, and .org domains to $8.

Gandi's Opposition to the SOPA Legislation - broseph

broseph — Fri, 23 Dec 2011 15:02:16 -0400

I am planning on transferring a domain here as well. Based on recommendations by: http://www.reddit.com/r/technology/...

Gandi's Opposition to the SOPA Legislation - Isarian

Isarian — Fri, 23 Dec 2011 14:16:20 -0400

I transferred my two domains to Gandi away from GoDaddy due to recommendations for you on Reddit, due to your position on SOPA. Money well spent, I think.

Gandi's Opposition to the SOPA Legislation - Paul

Paul — Fri, 23 Dec 2011 13:52:22 -0400

I have one domain remaining with SOPA supporting GoDaddy. Are you offering any specials for transfers right now like other registrars are?

I am a current Gandi customer and would like to have this one domain moved over but I'm paid up until 2017 with GoDaddy so I need a good price to help in my personal protest.

Gandi's Opposition to the SOPA Legislation - Will

Will — Fri, 23 Dec 2011 12:37:57 -0400

As a company operating outside the US will you be non-compliant with requests made under SOPA?

U.S. Data Center Open for Business! - William

William — Thu, 27 Jan 2011 07:37:00 -0400

A brief presentation about our new storage infrastructure available in the US data-center: http://gandikitchen.net/post/2010/1...

U.S. Data Center Open for Business! - Olvegg

Olvegg — Sat, 22 Jan 2011 18:42:14 -0400

Hello,

It is a great opportunity for an european like me in north america to keep on using you guys. Been here from the beginning and wil be there as long as you continue to go a great job.
Now I read all those comments and I am … wow. I think people really need to get a life and move on. I mean, you are right not to endorse Gandi's strategy, but seriously coming in there and commenting so intensly is just insane. Don't you think ? Let's put it that way : Gandi is not a caritative organisation, it is not related to any government so welcome to the free world and try to make your company as efficient and profitable as possible.
Gandi does not have to come back to you with a report on how it impacts your business legally and on and on. Not happy, move out but stop the bullshit and do it respectfully and if you think your content is better in Russia or Iceland like said John .. well go forth but please, please just stop polluting the whole fucking website with your BS.

Seriously people

U.S. Data Center Open for Business! - John

John — Tue, 11 Jan 2011 21:48:33 -0400

Edward is correct.

All the legal mumbo-jumbo does not matter. The fact is you have a server on U.S. soil. Period. End of story. You will therefore feel the power of the US Government whenever they wish for you to feel it.

You may appeal to the courts afterward (or your family may do so after you go missing for several weeks.) But it will be a big fat waste of time.

My advice to all. If you don't want to end up at Guantanamo, move your registry to a Russian registrar (or Iceland - they seem to still believe in freedom up there).

If the Internet existed in 1939, and a British registrar opened a server center in Berlin - I wonder if people in London would be responding like many on here saying "Don't worry. You are over-reacting. You are still protected by German law man - chill out."

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Wed, 05 Jan 2011 17:23:02 -0400

@Anon: This is an anonymous blog, where anyone can chose any handle. Gandi's CEO has the prenom "Stephan", but I or anyone else could have chosen the handle "Stephan" here. There is no way to know who any commenter on this blog really is. It would be unfair for me to hold Gandi responsible for comments that could have been made by anyone, rather than official statements by Gandi (such as direct communications or in customer notices or on the Web site itself, rather than in comments to the blog).

I am familiar with both French data protection rules and "Safe Harbor". You refer to transfers to a "sous traitant" (subcontractor) "when there is conformity with the European privacy legislation". But that would require, among other things, respect for the purpose limitation of both the EU data protection directive and French data protection law. Any transfer of my data to the US (including to "Gandi US") would be directly contrary to those purposes for which I provided data to Gandi (France), among which were insuring that my data would not stored in or transferred to any entity in the US.

It remains to be seen whether Gandi respects EU or French law or "Safe Harbor". I am still trying to find contact info for the data controller or for subject access requests for Gandi (France). Even though my contract is with Gandi (France) and not Gandi US, the "Privacy Policy" link redirects to that of Gandi US, with only US contacts. And searches for "data protection" or "data controller" on the main Gandi site return no results.

U.S. Data Center Open for Business! - Anon

Anon — Wed, 05 Jan 2011 16:12:24 -0400

Edward - If you are such concerned customer, it is surprise that you had not done even basic due research before buying, otherwise you would know that stephan is CEO at Gandi.

Also the access by Gandi (US) of customer data as a sub traitant to do there support work is not in contravention of french data protection law and the CNIL even has procedure to permit without formal approval when there is conformity with the european privacy legislation and directly says safe harbor for the USA. This too you will have found with a simple google on "Safe Harbor CNIL".
http://www.cnil.fr/vos-responsabili...

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Wed, 05 Jan 2011 10:35:44 -0400

@Stephan: I don't know who you are, or whether you are speaking officially for Gandi (or gandi US). But anyway...

You refer to Gandi's "proven track record". But we no longer know what is Gandi's track record. In the US, a "National Security letter" can forbid the recpient for disclosing to anyone that they have received an NSL. So neither the public, Gandi customers, nor even Gandi (France) knows whether Gandi US has already received NSL's for data about us. Once you have a US presence, your "track record" or how you have responded becomes unknown and can no longer be "proved to be reliable".

That's why it's critical to make sure that access by Gandi US to data pertaining to customers of Gandi (France) is logged in France (in such a way that Gandi US cannot alter or delete those logs) ,and that those access logs available to Gandi customers in response to subject access requests under French data protection law. Unfortunately, I cannot find any no contact info for your French data protection officer on your Web site. -- the link for "privacy policy" directs me solely to information about your US office.

Of course, my contract is with Gandi (France), and my rights are protected by French data protection law, which prohibits transfers of data for purposes inconsistent with those for which the data was provided. I did not provide data to Gandi (France) for the purpose of having it transferred to Gandi US or to anyone else in the US. On the contrary, my express purpose in providing information to Gandi was to ensure that it would *not* be stored in, or accessible from, the US. *Any* transfer of *any* of my data by Gandi (France) to Gandi (US) would thus be a transfer in violation of French data protection law, and would subject Gandi to liability and possible sanctions from CNIL.

U.S. Data Center Open for Business! - Stephan

Stephan — Wed, 05 Jan 2011 07:46:35 -0400

Edward : I'm talking about being paranoid because we're talking about something that might never happen. Regarding the rest, I already expressed myself and have nothing to add or remove.

I'm a person of facts, not fears. And 10 years of legal fights against a lot of national and international jurisdictions is a nice proven track record, don't you think ? We proved to be reliable for those (citizen, non profit organizations ...) who rely on us. Please take that into consideration. And maybe, maybe, you'll see the light

U.S. Data Center Open for Business! - Jay Boredom

Jay Boredom — Wed, 05 Jan 2011 01:42:58 -0400

"So please, please, just chill out and keep on trusting us."

Can I just say some stuff? Things that come to mind are "brouhahaha", "trololol" and "is this guy being serious?"

It does not matter where you are located as a registrar or hosting company? Yes, it does matter, surely enough. And aside from trusting the hoster there are also other trust issues at hand, for example the "on route snooping" of data, the FBI who thinks it can take down websites without requesting permission from a lawyer, and net neutrality being under serious pressure.

Please, just trust me.
-Jay

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Tue, 04 Jan 2011 10:58:49 -0400

@Stephan: As the articles i linked to show, I'm not being paranoid, but discussing the real recent history of OFAC action against Cuba travel related use of domain names.

You say that , "your personal details are safe with us, as you are not obviously doing something against the laws". Which laws? "...and acknowledged as such by a court." Which court? Previously, that judgment would have been made by a French court. Now, it would be made by a US court, *or* by OFAC's extra-judicial administrative process.

You continue, "We don't sell or give access to our files to anyone but an authority with a court order." But the issue isn't just access to our personal details, but which court would have jurisdiction over Gandi to, for example, order you to shut off a domain (either at the hosting or DNS or registry level). OFAC's enforcement methods include administratively seizing property (now potentially including Gandi's US assets). You could go to (US) court to try to get the propertry released, but in OFAC's process that happens *after* it has been seized (and of course in US court). They don't need a court order *before* it is seized.

I still haven't heard anything directly from Gandi. I really would like to discuss these unaswered questions with you:

(1) Why you didn't give specific advance notice to your customers (not just press releases that customers have no reason to read), or what customers such as, e.g. a travel agency in Montreal that sells travel to Cuba as a core part of their business was expected to do?

(2) Can Gandi *promise* that even if your US assets are seized because of allegations by US authorities (in practice most likely OFAC) against the use of a particular domain, you will not turn off thta domain unless ordered to do so by a French court?

(3) As I asked above, if the US government orders your US office to retrieve and hand over customer data, (a) Are you prepared to refuse such an order even if it might result in seizure of your US assets?, and (b) Would that access by the US office be logged (in such a way that nobody in the US would be able to alter or delete those logs) and included in what would be reported to me if I make a subject access request to Gandi under French law, so that I would know which of my data was accessed from the US and when?

U.S. Data Center Open for Business! - Stephan

Stephan — Tue, 04 Jan 2011 05:19:37 -0400

For the few being paranoid about this move, trust me : it doesn't matter where you are located as a registrar or hosting company. What matters is how we behave and how we defend ourselves.

This has not changed. We're still the same company, and your personal details are safe with us, as far as you are not obviously doing something against the laws, and acknowledged as such by a court. We don't sell or give access to our files to anyone but an authority with a court order. And even then, if we estimate this is not a good thing to do, we've got an army of lawyers trained since 10 years to defend our position.

So please, please, just chill out and keep on trusting us. Please only rely on facts, not fears. Never a good idea to do so :p

This being said : Happy New year !

U.S. Data Center Open for Business! - Luigi P.

Luigi P. — Mon, 03 Jan 2011 20:26:59 -0400

@gandi staff,
I'm a European customer that had chosen Gandi exactly because of being a big, reliable and _NOT US based_ registrar. This news have made me to stop and reconsider my position as a customer for a while.
I perfectly understand that from a legal perspective Gandi US is simply a customer support branch, however the given assurance that "Customer data is accessed by Gandi US staff on an as-needed basis" does me not comfort me at all. Any kind of formal or informal request by a US body could be a reasonable need to access such a data.
I don't think the US are interested in a replica of the whole database if they can easily access the needed records on an as-needed basis.
I'm aware Gandi would never reverse its decision, but I'm also aware my enthusiasm of European customer feeling in a "safe harbor" at Gandi has now vanished.

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Sat, 01 Jan 2011 20:35:52 -0400

@Martyp: You say that David G "replied in the context of your argument". No, he replied in the context of "CDA, DMCA, or PATRIOT prosecutions", not OFAC's powers and procedures in relation to Cuba sanctions.

I don't know if David G, or Martyp, are associated with Gandi, but I'm still waiting for a response from Gandi or any way to contact the responsible people at Gandi outside this forum.

I have made no secret of who I am or what I do. I am happy to accept responsibility for my actions, and for complying with the terms of my contract with Gandi as interpreted and enforced by French law. I am not happy to have Gandi give the US government jurisdiction over them by opening a US presence, which could allow the US government to exert power over Gandi (up to and including seizure of its US assets) without any involvement of French courts, and under US not French procedures.

U.S. Data Center Open for Business! - Martyp

Martyp — Sat, 01 Jan 2011 16:35:20 -0400

Edward. David G's response was spot on as a response to the specific point of your rant. You specifically cited OFAC as the basis of your argument, so he replied in the context of your argument. Sure there are other laws under which OFAC has powers, but clearly you are here to simply troll. Obviously you have something to hide and if you are scared to own up to your own responsibility for your travel website, then find another hosting provider instead of throwing your crap around here.

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Thu, 30 Dec 2010 21:01:22 -0400

@David G: While *some* of "OFAC's powers and responsibilities are derived from Section 311 of the USA PATRIOT ACT and are specifically related to the illicit financing and facilitation of terrorism, laundering, and financing of foreign entities subject to economic or other sanctions", those aren't OFAC's only powers. OFAC existed for decades before the USA PATRIOT Act, and the powers you refer to (and the restrictions on them) aren't OFAC's only powers. Other OFAC powers include those under the Trading with the Enemy Act and the IEEPA. OFAC's powers to enforce the Cuba sanctions, for example, are subject to different procedures and have been differently interpreted.

U.S. Data Center Open for Business! - Leland (Gandi)

Leland (Gandi) — Thu, 30 Dec 2010 19:14:58 -0400

@nathan: reference your question about migration. William is totally correct, in that we do not have an automated way of migrating a VM from Paris to Baltimore and vice-versa. There are ways to do this manually though.

We have published a brief FAQ on the matter here:
http://gandikitchen.net/post/2010/1...

Hope this helps!

Leland

U.S. Data Center Open for Business! - David G

David G — Thu, 30 Dec 2010 18:36:47 -0400

@Edward Hasbrouck

As a a member of the legal profession, and having dealt first-hand with the fallout from OFAC, CDA, PATRIOT, and DMCA in the US and abroad both "online" as well as "offline", I can categorically state that your statements are over-generalized and based on unfounded assumptions. Whilst it is true that the OFAC can indeed seize the assets of individuals, organizations and companies facilitating banned or sanction-governed trade, commerce, and activities, these powers of seizure are limited to actions against those individuals, organizations and companies who are directly involved in such facilitation, commerce, or supply.

OFAC's powers and responsibilities are derived from Section 311 of the USA PATRIOT ACT and are specifically related to the illicit financing and facilitation of terrorism, laundering, and financing of foreign entities subject to economic or other sanctions. In the realms of the internet and online media, provisions exist to differentiate between a service provider and a responsible party under the Act, in much the same way as section 230 of the CDA under title 47 USC. It therefore stands to reason that your assumptions that Gandi's assets can be seized simply because one of their customers either directly or indirectly facilitates trade with Cuba is not only unfounded, but also outside the context and intent of Section 311 of the USA PATRIOT ACT. Under the letter of the law, it is Gandi's customer who is wholly responsible. Gandi's own terms and conditions underpin this position in such a way that even if under normal circumstances a service provider may be held even partly responsible, in this case the customer has under contract guaranteed his sole responsibility and holds Gandi harmless in case of legal prosecution arising out of the use of the domain or other Gandi product by the customer.

Further, in the US we have certain rights under the Constitution, not least of which is the First Amendment, and any legislation that erodes those rights, barring a very exhaustive short list of certain exceptions, is deemed to be unconstitutional and unenforceable, and you will find on the net a multitude of examples whereby CDA, DMCA, or PATRIOT prosecutions were attempted against companies and more importantly individuals, but found to be unconstitutional and thereby summarily overruled.

Dave

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Thu, 30 Dec 2010 17:52:53 -0400

@nobody: It doesn't matter whether "Gandi US" is a registrar or hosting provider. The question for OFAC is whether it is owned by Gandi, and whether Gandi does things that a "US person" (entity with a US presence) would be forbidden to do. If so, "Gandi US" and its assets could be seized as penalty for the actions of its parent, Gandi (France).

Hotel and other travel companies, for example, have to make a choice: they can operate in Cuba or in the US, but not in both. If they had assets in the US, those could be seized if they do unlicensed business with (or "facilitate" unlicensed trade with) Cuba.

Whether the banned activities were carried out in the US or by the US subsidiary is irrelevant to OFAC. Companies get in trouble all the time with OFAC over actions taken by subsidiaries or affiliates in different countries.

U.S. Data Center Open for Business! - Big Brother

Big Brother — Thu, 30 Dec 2010 17:18:48 -0400

Hey... didn't you get that address wrong?

It should be:

935 Pennsylvania Ave.
Washington, DC 20535

(this thread is better than watchin reruns od laugh-in!)

U.S. Data Center Open for Business! - nobody

nobody — Thu, 30 Dec 2010 17:11:57 -0400

Hey troll.... what part of "gandi us is not a registar or hosting provider" do you not understand? I do not see any listing at icann for gandi us as a registrar, and i do not see any of their servers or systems for domain registration in the us. Only thing that i can find in probing around is all to do locally with the baltimore hosting service.

Get a damned life....

Oh.. by the way, i can get you a cuban visa and free tickets if you want... just send me your details by mail to 1600 pennsylvania ave, washington dc, 20500.

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Thu, 30 Dec 2010 16:14:00 -0400

p.s. -- In case you think my scenario is hypothetical, here's one example of how OFAC has gone directly to registrars (not the domain name owner) to take down domains that it believed were being used to facilitate travel to Cuba (as many Gandi-registered and/or Gandi-hosted domains obviously do):

http://havanajournal.com/politics/e...

This was done *without* any notice to the domain name owners:

http://havanajournal.com/politics/e...

Yes, they also tried to go after ICANN, but ICANN would have a better defense than a registry or host like Gandi, since it didn't have any direct relationship to the (second-level) domain name at all, only to the TLD.

And again, lest it be claimed that all .com names are registered with a US registry, Gandi also registers domain names including .info (the registry for which is incorporated in Ireland) and country-code domains outside the US.

U.S. Data Center Open for Business! - Edward Hasbrouck

Edward Hasbrouck — Thu, 30 Dec 2010 16:02:15 -0400

@Fred Hayes: It may be true that, as you say, "Gandi has been talking about their upcoming US datacenter and support office in the US for nearly 8 months both on this blog, the french version of the blog, twitter, and in the press." But like most people I deal with many companies. I don't read every one of their marketing blogs or press releases, nor should I have to. Major changes that would affect their services should be part of *notices* to customers.

Almost every travel agency outside the US deals to a greater or lesser extent with travel to Cuba. All of those agencies who use Gandi's services, if they had realized the implications of this change, would have recognized that it was essential to their business to migrate off Gandi in advance of such a change in Gandi's US presence. There are similar issues for many other Gandi users. That deserved formal advance notice to Gandi customers.

You say that, "In your particular scenario, if you had a website about travel and a 3rd party posted to a forum under your control something that could be construed as facilitating travel to Cuba ... you and you alone are responsible for taking action to remove the illegal content from your website upon receipt of a takedown notice from a competent authority (judge/court, law-enforcement agency, etc)."

That would be a good system, but that's not the way the Cuba sanctions laws or their enforcement by OFAC work in the USA, either in terms of who is deemed responsible or what the process is.

You continue, "The contents of your website is not under Gandi's direct control or responsibility (and jurisprudence has demonstrated this time and time again both in Europe and in the US)."

I know of no case law to this effect in the US in relation to Cuba (or other) sanctions or trade or export restrictions (e.g. software that the US considers to be "munitions" subject to export licensing rules). I think you are making unwarranted generalization either from what you assume would be fair, from legal processes in other countries than the USA, or from procedures in unrelated areas of US law (e.g. allegations of copyright infringement).

You continue, "You solely are responsible for the content and the legal use of your domain and hosting with Gandi." Actually, OFAC enforces *very* broad theories (broader than those in copyright cases) of contributory and accessory liability.

And further, you say that "the government does not just simply and unilaterally 'shut down' sites or domains without the benefit of due process. The law clearly outlines a due process of notify [the editor/content owner] first with a takedown notice." In this you are describing copyright law. OFAC doesn't work that way.

If OFAC believes that Gandi is hosting, or is facilitating through DNS records or domain name registrations, activities which facilitate travel to Cuba or trade with embargoed countries, OFAC can order Gandi to desist, or imposes penalties including asset forfeiture for past conduct. There is no requirement in OFAC rules for notice, even after the fact, to the domain name owner. OFAC could, under its procedures, seize all of Gandi's assets in the US. It would be up to Gandi to contest the seizure after the fact, through OFAC's procedures, under US law.

Seriously, if you think copyright enforcement law lacks due process, I encourage you to look at OFAC and how the US enforces sanctions. It's *much* worse.

I'm not talking about copyright law. I'm not talking about the substantive desirability or undesirability of the Cuba and other sanctions. I'm talking about the lack of due process in OFAC enforcement procedures, and the way that places Gandi and its users at risk, even if those users (like me) are doing nothing that we believe to be illegal, and would be prepared to defend the legality of our actions in French court under French procedures.

If, for example, it had been alleged that we had violated Gandi's user temrs by acting "in violation of local [US] law, that claim would have been evaluated by French courts under their procedures -- not under OFAC's kangeroo-court administrative procedures. Gandi's US presence changes all that, since OFAC's modus operandi is to go after the US assets of foreign companies it believes are party to violations of US sanctions.

U.S. Data Center Open for Business! - Fabrice

Fabrice — Wed, 29 Dec 2010 17:04:05 -0400

As a french person here i can honesty say that i am happy about gandi move to the us. Here the guvernment has really killed freedoms of the internet with new laws. The police can even hack prople computers without knowing and install spy software to spy on what you do and can shut off your internet if they think you have download pirate sofware or music. There is no presomption of innocence in france. Consider yourself lucky.

U.S. Data Center Open for Business! - Fred Hayes

Fred Hayes — Wed, 29 Dec 2010 16:15:31 -0400

EH352: you said 'your customers should have been should have been given ample warning' ...
Gandi has been talking about their upcoming US datacenter and support office in the US for nearly 8 months both on this blog, the french version of the blog, twitter, and in the press.

If you can't do your own research, how can the rest of us believe that the rest of your garble is not just the rants of a paranoid individual?

Also, you acknowledge that as a US person you are subject to US law (illegal ... to 'facilitate' _unlicenced_ travel to Cuba). Therefore, this would apply to you even if Gandi did not have a US presence and even if your server were located in Swaziland or somewhere else obscure. It sounds to me more like you are trying to actively abdicate your responsibility for your own actions.

Don't forget that if you own a domain name, the information pertaining to you is a matter of public record. If the government were really hell-bent on obtaining your information, they would not even have to ask Gandi for it -- they can get it from the registry upstream, or even just a simple google search in many cases.

In your particular scenario, if you had a website about travel and a 3rd party posted to a forum under your control something that could be construed as facilitating travel to Cuba (as if the government have nothing better to do than to witch-hunt such individuals), you and you alone are responsible for taking action to remove the illegal content from your website upon receipt of a takedown notice from a competent authority (judge/court, law-enforcement agency, etc)

Gandi is just a technical solution provider, not the editor of content, thus the contents of your website is not under Gandi's direct control or responsibility (and jurisprudence has demonstrated this time and time again both in Europe and in the US). You solely are responsible for the content and the legal use of your domain and hosting with Gandi. Also, again on a positive note, the government does not just simply and unilaterally 'shut down' sites or domains without the benefit of due process. The law clearly outlines a due process of notify [the editor/content owner] first with a takedown notice. The editor can then mount a defense or do nothing. Of course it does not behove the owner to do nothing.

So many people on here seem to be beating a dead horse because of what they read either out of context, or greatly exaggerated in the press (and usually only the biased press).

Fred

U.S. Data Center Open for Business! - EH352-GANDI

EH352-GANDI — Wed, 29 Dec 2010 14:03:00 -0400

Thank you, Marc, for your message and your efforts to address our concerns.

unfortunately, I still believe that (1) this is far too late -- your customers should have been should have been given ample warning, since regardless of what you think, there are clearly many users who would have wanted to migrate off Gandi before such a change took effect, and (2) your comments suggest that you don't fully understand our concerns.

While you say that I am "vocal", I am expressing these concerns publicly only because we weren't given advance notice and a private channel to express concerns, discuss them with you, and make our choices before your changes took effect. Please feel free to contact me privately. I would *welcome* a chance to discuss this with you or higher-level decision-makers at Gandi, as long as you are not just trying to feed me p.r. about a decision you consider irrevocable, but are actually willing to *consider* making changes in response to these customer concerns.

Obviously, there is some risk for anyone to make the precise scenario they are concerned about public, lest that encourage the US government to act. that may be part of why you haven't heard many complaints -- even if some unknown number of those customers who have quietly left Gandi, or are planning to do so -- or why soem of the concerns may seem vague.

But since it seems that somebody has to do it, let me present one scenario:

I write about travel, and have a Web site with travel information. As a US person, it is illegal under US law for me to "facilitate" unlicensed travel to Cuba.

Facilitation of travel to Cuba is legal *everywhere* else in the world except the USA. It poses none of the issues of, "If you do illegal things, you will have problems everywhere in the world and not just the USA" that some have tried to raise about other activities the US government doesn't like. The *only* legal issue with such activities is the US.

If I create a Web site in which people post commetns about how to travel to Cuba, am I breaking US law? I don't think so, but the US government might think so. And if the site is hosted in the US, they could probably shut the site down *before* any court considers that question. If the site is in France, they could order me to shut it down, but I might be able to get that order reviewed, and it would be up to me whether to comply. If they want to get a French host to shut down such a site, they would have to do so under French law (according to which facilitation of travel to Cuba is legal).

Of course, if I weren't a US person, the argument would be even stronger. In effect, opening a US presence makes it impossible for any legal travel agency (in France or Quebec for example, or anywhere else in the world) who ever sells or facilitates travel to Cuba, legally under their lcoial laws and the laws of the rest of the world except the USA, to use Gandi's services. Was this considered in your decision?

But if the French host has a US presence, the order to shut down the site could be given to them in the US. If they don't comply, *all their US assets could be seized*.

Unless Gandi is willing to allow its new US assets to be seized in such a case, it would have to act on such an order to shut down the site or domain name. And it would have to contest such an order, if at all, in US courts, where the international human rights treaty protecting the right to travel (Article 12 of the ICCPR) cannot be invoked because of reservations associated with the US ratification of the treaty.

Without a US presence, Gandi would not be subject to such an order in the USA, and could contest any attempt at such an order in French courts, before shutting down the site.

You say that, "I hope that the controversy that's been stirred up here in the U.S. leads to some constructive changes, and not just angry finger pointing." I and many others would like to change US policy on travel to Cuba, and on the power to seize assets in the US of foreign compnaies that do business with Cuba, but that is unlikely to happen soon.

You say that, "While US entities may ask Gandi US for customer information, we would only be obligated to give them what we have, not to go out and procure information at their request." You might not think that you are obligated to do so, but the US government probably does think you are so obligated. And what is relevant to that obligation of your US office is, of course, US law as adjudicated in the US, not French law.

You admit that, "Customer data is accessed by Gandi US staff on an as-needed basis." If the US government orders your US office to retrieve and hand over customer data, (1) Are you prepared to refuse such an order even if it might result in seizure of your US assets?, and (2) Would that access by the US office be logged (in such a way that nobody in the US would be able to alter or delete those logs) and included in what would be reported to me if I make a subject access request to Gandi under French law, so that I would know which of my data was accessed from the US and when?

U.S. Data Center Open for Business! - marc

marc — Wed, 29 Dec 2010 10:46:21 -0400

I want to say thank you to everyone for taking the time to comment. The overwhelming majority of the feedback we've gotten from customers has been extremely positive, and we genuinely appreciate your support!

Between the holidays, wrapping up year end and what not, I've been a little slow to respond, and I apologize for that.

I note that fully half the negative posts were all written by the same person, who is unhappy over an unrelated issue, and is simply 'stirring the pot', and trying to cause a reaction over 'unanswered' or 'ignored' questions.

We started off with a post by 'rebel'. Several people commented that they also wanted to see what I had emailed rebel. I'm not an attorney, and thus not qualified to give legal advice. What I sent rebel was simply an invitation to clarify his rather open-ended question to see if there were some specific issues that we could address. In retrospect, I think that question would have been better posed here on the blog.

For EH352 who asks that we "reverse this decision and remove your US presence", I can see that you are knowledgeable and very vocal regarding your views. I respect that, and think that it's also important to recognize that it's not simply a black and white issue. The reality is that there are many places where governments and corporate interests can apply pressure on information technology and infrastructure providers. Let's not forget that ICANN has a large U.S. presence, with headquarters in the US and offices around the world. And how much of the world's traffic moves through the U.S.'s eastern (in Washington DC!) and western IXPs, not to mention other major IXP's in the U.S.? As more exchanges and fiber is built out around the world, the routing choices become more flexible, yet still a routing error or BGP route injection could cause data to be routed to vulnerable locations.

The concern over domain seizures is understandable. In my personal opinion, the recent domain seizures in the U.S. this past November certainly do seem to have been "influenced" by commercial interests. Domain seizures are not solely a U.S. phenomenon, as 1800 sites were shut down in the UK this week, yet I haven't heard much outcry about it. I hope that the controversy that's been stirred up here in the U.S. leads to some constructive changes, and not just angry finger pointing.

I note your dissatisfaction with Safe Harbor, however please understand that Gandi's regard for the safety and privacy of customer data is of utmost importance to us. Customer data remains in France with Gandi SAS, where stringent data protection laws apply. Customer data is accessed by Gandi US staff on an as-needed basis, and there is no wholesale transfer of customer data. Indeed, we take the matter very seriously. While US entities may ask Gandi US for customer information, we would only be obligated to give them what we have, not to go out and procure information at their request. Our agreement only allows us to obtain customer data for the sole purpose of customer support, and we do not store customer data here in the US, with one exception: faxed forms. If you need to fax paper forms to Gandi, you have the choice to fax them to Paris or to Baltimore.

All domain registry and internet services are provided by Gandi SAS, not by Gandi US. Therefore, a UDRP, DMCA, or other challenge would need to be sent to Gandi SAS. Similarly, any legal procedure seeking customer information or other remedy must also be directed towards Paris.

Leland provides a nice breakdown on the relationship between Gandi SAS and Gandi US in an earlier blog item

Nothing really changes with regard to domain name registrations, the choice to host your VPS in Paris or Baltimore is yours, and you have the option of expanded customer support based in the US.

U.S. Data Center Open for Business! - PM906-GANDI

PM906-GANDI — Tue, 28 Dec 2010 22:41:38 -0400

@4 @Marc: I've not received the information you offered to Rebel on December 22, that which I requested on December 23. Could you please send it?

U.S. Data Center Open for Business! - no bullshit?

no bullshit? — Tue, 28 Dec 2010 01:46:19 -0400

So much for "no bullshit" if Gandi can't even face up to a simple question asked by at least 3 people here, yet skillfully avoided, or just simply ignored, by Gandi.

What are the legal differences between France and the US for internet services providers and protection guarantees?

If Gandi is incapable of answering that one simple question adequately, it means that they either realize that opening in the US was commercially motivated alone without regard to their customers and are trying to find a way to bullshit/lie their way out of it, or quite simply Gandi didn't even do a basic due diligence and don't even know the answer. The first case is just bullshit, the second is gross incompetence. Either way, not a company I would want to do business with anymore.

U.S. Data Center Open for Business! - bob3

bob3 — Mon, 27 Dec 2010 07:55:10 -0400

You people really need to get a life. Only if you have something to hide, or are a believer in wild conspiracy theories would you be this much up in arms about this shit, and especially without having done your research on the facts first! Jeez people, this ain't the peoples republic of china ffs. Grow up and get a pair.

Bob

U.S. Data Center Open for Business! - Anonymous

Anonymous — Sun, 26 Dec 2010 18:52:58 -0400

I find it funny that people in the US complain about having their registrar under US jurisdiction, as though they themselves don't have the same problem.

For people *outside* the US, I can understand the concerns, but I don't think this move by Gandi affects you at all. If you don't need to host something like Wikileaks that annoys governments, or something like Youtube or the Pirate Bay that annoys big companies, then you care a lot more about a hosting provider's platform, services, and support, and Gandi wins big on those fronts. And if you *do* need to host something like that, then you should plan in advance to deal with attacks of various kinds, legal and otherwise; multiple hosting providers, redundant services, minimum possible logging, technical solutions like Tor and Freenet, and so on. Either way, this move by Gandi shouldn't affect you; because you don't have anything that gets targeted, or because you already planned for that and no move by Gandi alone can cause you a problem.

On top of all that, I strongly suspect Gandi will do a better job defending their customers than most companies, and not drop a customer or volunteer information about them when simply asked to by a government, particularly if that customer has done nothing illegal. That much seems critical no matter the jurisdiction.

So, before you attack Gandi for this move, please give some thought to what scenario you actually care about and consider more likely: your site personally getting targeted by the US government (and not the French government), or you hosting a mission-critical site and wanting reliability and maintainability. I know which one I consider more likely, and I think Gandi will do a great job helping me with it.

And finally, think before you start claiming the backing of a large silent group of customers unhappy with this move. Personally, as a US customer, I've been looking forward to this for a long time. I think you'll find that most customers either want this new data center, or don't care about it.