How Cybersecurity Threw Cyberdrugs

On Sunday, not at the peak time for news, Ilya Sachkov, the general director of Group-IB, a fairly well-known information security company, on his Facebook page published a couple of screenshots and modestly signed them: “excellent! sue =) ".

And on Monday, about fifty leading media and news agencies wrote about it, and they actively discussed Runet.
')
So what so outraged the top of the odious cyber defense company? And why did it become such a hot topic?

Let's start with the fact that Ilya Sachkov suddenly found out that at that time Rostelecom had been blocking their English-speaking Internet resource group-ib.com for at least a month:



Rather, at that time no one from Group-IB suspected what time their resource was under such a lock, this awareness came later when RosKomSvoboda presented an analysis of the incident , during which 2 decisions of the State Drug Control on blocking the IP address surfaced. where the cybersecurity site is located directly.

The decision to make an entry in the Register of banned sites was made twice - back in mid-October and concerned the blocking of the domain and the pages of the portal drugspace.info, where the Federal Drug Control Service found information on the distribution of drugs.

And as we know, the law on “blacklists of sites” 139-FZ, introduced last fall, makes it possible to enter into the registry not only pages and domains that are prohibited by supervisory agencies, but also the corresponding network addresses. What are those operators who use the so-called IP blocking, in which they fall under the restriction of access to tens of thousands of other respectable sites located on the same network address.



Rostelecom, having received another similar extract from the registry, restricted access to the entire IP address. Well, once again I ran into a more or less well-known portal that hung on the same IP.

Such cases become loud in two cases:
1) a well-known company or portal / person affiliated with government agencies falls under such a Rostelecom block;
2) the owner of an Internet resource blocked in this way is suing.


(from the report “Year under the sign of blocking: from“ black lists ”to the petition and beyond”)

In the first version, such cases are no longer uncommon, for example, one of the Kaspersky Lab resources +, the Tina Kandelaki website, the World Tesen social network, the Blogger blog platform and Wordpress.com, many electronic libraries, a number of resources came under such blocking. Google also suffered from this kind of blocking, etc.

As for the lawsuits, the most resonant at the moment is the assertion by the owner of the e-book publishing resource, Vladimir Kharitonov, the right to access his portal www.digital-books.ru , which was also blocked by the IP address “for the company”. At the moment, a complaint is being prepared to the “European Court of Human Rights”, since The Moscow City Court sided with our government agencies and subsequently rejected the appeal in the case.

And in this case, claim 1 coincided with paragraph 2: not only is Group-IB, known in its circles, supports many government initiatives, is not indifferent to the odious "Safe Internet League" (the instigator and evangelist of the "black lists of sites ”), recently received the“ Runet Award ”in the category of“ Safe Runet ”sponsored by the same LBI, and also intends against all this to be suing the law enforcement practice of blocking, which itself fell under.

Phantasmagoria and grotesque!

Quote:

“Mr. Sachkov believes that visitors could associate the site with illegal activities, and estimates the damage to the company at $ 3-5 million. Lawyers believe that Group-IB can win the case.
Mr. Sachkov does not explain the methodology for assessing damage in this particular amount just as he is not yet ready to say who the lawsuit will be for - Rostelecom or Roskomnadzor, but he believes that the incident shows flaws in the current law. “Technically, the law needs to be improved so that honest companies do not suffer from its actions. We decided to sue because blocking the site had a negative impact on the company's reputation. At the same time, the resource that served as the main reason for this blocking simply changed the IP address and is still working. ”

(from an interview with RBC daily )

An interesting conversation unfolded between the company representatives and Rostelecom on Twitter.
Squeeze:
"Izvestia" : To unblock the site of the Group-IB company site, Rostelecom recommended changing the IP address
Group IB : Let Drug Dealers Change IP
Rostelecom : IP in the registry eais.rkn.gov.ru, you can appeal the decision of the Federal Drug Control Service and Roskomnadzor in the prescribed manner
"Group-IB" : the trial will teach Rostelecom in the 21st century to block resources by url
Rostelecom : We are ready to listen to your proposals on the budget implementation of DPI throughout the country.

(Financial indicators of Rostelecom for 2012, source )

At the moment, it all ended with the fact that Roskomnadzor suddenly found out that the forbidden resource drugspace.info because of which all this fuss had rolled out had long ago migrated to another IP address and excluded the ill-fated IP from the registry and accordingly gave the operators nothing to block him.

The situation becomes even more piquant: Rostelecom blocked an IP address, on which there was already no forbidden resource.

NO ONE forbidden!

Only 441 respectable domains of the most diverse subjects (based on the result of the check on the portal www.yougetsignal.com )



Interesting conclusions:

1) A company that positions itself as "one of the leading international companies for the prevention and investigation of cybercrime and high-tech fraud" is located on the so-called “Shared IP hosting”, together with other domains that are clearly not owned by this information security company.
2) The registry continues to function only in manual mode, the machine automatically sends out excerpts from the “black lists of sites”, and control and reaction to illegal blocking occurs only when it becomes “very hot”.
3) The practice of blocking IP addresses continues even after the migration of forbidden domains from them, the identified case is far from the first.
4) The company, which spoke positively about the practice of restricting access to Internet resources by government agencies and introducing “blacklists”, faced its blockage and was ready to sue it.
5) The DrugSpace portal, which served as an indirect reason for blocking Group-IB, is again available and is pleasing to the eyes of its parishioners. By the way, if you carefully review the contents of the site, then there is just communication of drug addicts, and it is not a forum for the sale of drugs, and their rules also state that among other things "it is strictly forbidden: drug propaganda, any attempts to sell / buy surfactants."

In a word, some, one way or another, suffered financially, others - reputational, others - depict vigorous activity, fourth - do not follow the content and content of the registry, fifth - do not care for their clients and their duties, etc.

Anything, but all this in no way concerns the protection of our children, as it was stated when implementing the law on extrajudicial blocking of Internet resources and under the cover of which it has been happening for more than a year.
But we all want to impose new categories of prohibited information, such bills have already been submitted to the State Duma and are waiting for their time.
The absurdity continues, and will only increase.

But, let's see how the trial will unfold, unless the company itself refuses its words and, after consultations in the government corridors, does not play up the topic.

According to the materials of the portal " NAG.ru "