Servers of large registrar NIC.UA are withdrawn
Now representatives of the Security Service of Ukraine conduct a search and seizure of the servers of the large domain registrar NIC.UA from the data center. About this, representatives of the company reported on Twitter: “Now government agencies are withdrawing our hosting servers from the data center, because of this, many have problems with hosting. We will keep you informed. " Later, the company promised that there should be no problems with client sites: “Domains are working and will work properly”. Sites that used hosting are no longer available.
As the director of the company Andrei Khvetkevich said, the main equipment was located in the Datagroup data center. The withdrawal is carried out by court order, however, neither the management of the data centers nor the company’s representatives showed it. “We are trying to figure out what is going on. Informally, I heard that this is due to the fact that we had registered domains of some separatist sites. Given that we usually always regularly block such resources according to the law, recently, for example, Gubarev.info blocked it, ”Hvetkevich noted. According to him, it will be possible to find out more information when Datagroup will provide the equipment withdrawal act.
“In short, the equipment was taken out of action. In specialized mailings, these sites have been discussed since summer, ”noted Maxim Tuliev, the head of“ NetAssist ”, where, among other things, the company's equipment was seized.
')
Push:
Most of all, of course, suffered users who had nic.ua and were a registrar and a hoster.
Neither NS change nor move, even with backups.
Update : Disappointing information appeared on twitter for those who do not have local backups
Backups were taken with the equipment. We are trying in every way to resolve the situation.
Update 2:
The initiator has appeared
Update 3:
Domain control panel is working .
We restored the work site NIC.UA. The site works in Amsterdam, so no one can disconnect it.
With hosting problems continue .
The answer to the “what with sites” questions: We cannot restore the operation of the hosting until we get the equipment back. We do our best.
Update 4:
Tomorrow at 11:00 am (Kiev), a press conference regarding the withdrawal of NIC.UA equipment will be held at the LIGABusinessInform press center.
Online, apparently, you can see here.
Update 5:
SBU promises to return Nic.ua servers in two months
Update 6
NIC.UA asks for help
Update 7
Chronology of events and correspondence with the Security Service of Ukraine according to NIC.UA
Update 8
As the director of the company Andrei Khvetkevich said, the main equipment was located in the Datagroup data center. The withdrawal is carried out by court order, however, neither the management of the data centers nor the company’s representatives showed it. “We are trying to figure out what is going on. Informally, I heard that this is due to the fact that we had registered domains of some separatist sites. Given that we usually always regularly block such resources according to the law, recently, for example, Gubarev.info blocked it, ”Hvetkevich noted. According to him, it will be possible to find out more information when Datagroup will provide the equipment withdrawal act.
“In short, the equipment was taken out of action. In specialized mailings, these sites have been discussed since summer, ”noted Maxim Tuliev, the head of“ NetAssist ”, where, among other things, the company's equipment was seized.
')
The court's decision
Push:
Most of all, of course, suffered users who had nic.ua and were a registrar and a hoster.
Neither NS change nor move, even with backups.
Update : Disappointing information appeared on twitter for those who do not have local backups
Backups were taken with the equipment. We are trying in every way to resolve the situation.
Update 2:
The initiator has appeared
Because of two sites, I consider such meanness to normal people to be universal stupidity.
Ukrainians KŃ–ber VŃ–yska cursed say teroristiv slv.org.ua that slav.pp.ua.
These domains, they led to one and the same site, we enrolled in the Security Service of Ukraine. With these amazing results, the gubarev .org on.fb.me/1phzFel website was closed at the domain registrar register. My worm nasilali provider of the list of one hundred percent cich trioh the і sites Terivist, yak stench pressed the servants і vіdmovylyalisâsya zakrivati ​​site. Bo "did not bachili terrorism" on tsikh sites. Only if the SBU nadslala їm in the case of a court ruling, they smelled the domain of Gubarova, they didn’t cope with any other sites. Naretmeni vdalosya perekonat SBU dіyat і і Stinks viluchili server of the provider.
These domains, they led to one and the same site, we enrolled in the Security Service of Ukraine. With these amazing results, the gubarev .org on.fb.me/1phzFel website was closed at the domain registrar register. My worm nasilali provider of the list of one hundred percent cich trioh the і sites Terivist, yak stench pressed the servants і vіdmovylyalisâsya zakrivati ​​site. Bo "did not bachili terrorism" on tsikh sites. Only if the SBU nadslala їm in the case of a court ruling, they smelled the domain of Gubarova, they didn’t cope with any other sites. Naretmeni vdalosya perekonat SBU dіyat і і Stinks viluchili server of the provider.
Update 3:
Domain control panel is working .
We restored the work site NIC.UA. The site works in Amsterdam, so no one can disconnect it.
With hosting problems continue .
The answer to the “what with sites” questions: We cannot restore the operation of the hosting until we get the equipment back. We do our best.
Update 4:
Tomorrow at 11:00 am (Kiev), a press conference regarding the withdrawal of NIC.UA equipment will be held at the LIGABusinessInform press center.
Online, apparently, you can see here.
Update 5:
SBU promises to return Nic.ua servers in two months
Statement
The security service of Ukraine will keep the Nic.ua server for two months, the adviser to the head of the Security Service of Ukraine Markiyan Lubkivsky said.
“We asked, appealed, we have documents, asked such and such sites to disconnect, because they are engaged in anti-Ukrainian propaganda, they are on the side of the enemy. They did not listen to us, they answered us that this would be done solely by a court decision. We have achieved a court decision, respectively, seized the equipment. The equipment is held by us for the next two months, respectively, after which it will be returned, ”he said at a briefing on Wednesday.
According to Lubkivsky, the company's clients, who suffered from the seizure of the equipment, may seek help from the investigation in order to copy their data.
“We asked, appealed, we have documents, asked such and such sites to disconnect, because they are engaged in anti-Ukrainian propaganda, they are on the side of the enemy. They did not listen to us, they answered us that this would be done solely by a court decision. We have achieved a court decision, respectively, seized the equipment. The equipment is held by us for the next two months, respectively, after which it will be returned, ”he said at a briefing on Wednesday.
According to Lubkivsky, the company's clients, who suffered from the seizure of the equipment, may seek help from the investigation in order to copy their data.
Update 6
NIC.UA asks for help
Picture statement
Update 7
Chronology of events and correspondence with the Security Service of Ukraine according to NIC.UA
A lot of pictures, hid under the spoiler
On Tuesday, April 7, 2015, the Security Service of Ukraine, without giving reasons, took the servers of NIC.UA out of four data centers in Kiev. Several tens of thousands of company clients suffered from such actions by law enforcement agencies.
About the fact that law enforcement agencies are withdrawing servers, the company’s director Andrei Khvetkevich learned from a phone call from employees of one of the data centers at about 10 am
Only by 14:00 was it possible to find out the official reason and get a copy of the court ruling. It dealt with the fact that there are 5 separatist sites on the company's facilities, which should be turned off. Physically sites are not located on the company's facilities - they are hosted elsewhere. Only the domains of four of the five indicated sites are registered on NIC.UA.
“In order to block a site that violates the legislation of Ukraine, a formal request from the relevant authorities is enough. We regularly receive requests from the Security Service of Ukraine on such sites and block them. Why this time the SBU decided not to send a request to us, but to withdraw the company's servers - I do not understand. Sites of tens of thousands of our clients stopped working from these illegal actions, and the sites indicated in the court ruling continue to work, because in fact the sites themselves are not with us, only the domains, ”says Andrei Khvetkevich.
Representatives of the company received the list of the seized equipment only by 3 p.m. The withdrawal protocol at the time of writing this press release has not yet been received.
The court order was unreasonable, but gave the law enforcement agencies formal authority to seize the equipment.
In our opinion, the judge simply did not delve into the requirements of the investigator of the SBU and did not fully study the case materials, as a result of which such an unreasonable decision was made. The court rulings expressly state that separatist websites are served outside Ukraine, therefore, it does not make sense to withdraw equipment in Ukraine.
Now lawyers of the company are trying to return the equipment in order to restore the work of clients' sites. There is no information as to when the trial will take place, but we expected this to happen today, April 8th.
We do not support separatist sites and always cooperate with law enforcement agencies in the framework of a well-developed and coordinated interaction algorithm.
In August 2014, despite the absence of a court decision, we blocked the domain gubarev.org based on a reasoned request from the SBU. We have made changes to our Public Offer and written agreements in order to provide a more effective response mechanism.
Below we present the chronology of requests and responses of the Security Service of Ukraine, indicating that our company cooperated with law enforcement agencies promptly and within the framework of the Law.
By domain odnarodyna.com.ua:
1. 03/29/14 there was a request from the State Security Service of Ukraine "for information”:
Answer:
01/20/15 was a customer request. We wrote to the client that we would block the domain, we blocked it on 01/21/15. Then they informed the person who applied about the work done.
By domain slv.org.ua:
10/17/14 There was a request from the Security Service of Ukraine (Department of Counter-Insection for Institutions in the Sphere of Information Security), received only a scan. Block did not ask for a domain, just provide information. Request:
The corresponding answer was prepared by:
About the fact that law enforcement agencies are withdrawing servers, the company’s director Andrei Khvetkevich learned from a phone call from employees of one of the data centers at about 10 am
Only by 14:00 was it possible to find out the official reason and get a copy of the court ruling. It dealt with the fact that there are 5 separatist sites on the company's facilities, which should be turned off. Physically sites are not located on the company's facilities - they are hosted elsewhere. Only the domains of four of the five indicated sites are registered on NIC.UA.
“In order to block a site that violates the legislation of Ukraine, a formal request from the relevant authorities is enough. We regularly receive requests from the Security Service of Ukraine on such sites and block them. Why this time the SBU decided not to send a request to us, but to withdraw the company's servers - I do not understand. Sites of tens of thousands of our clients stopped working from these illegal actions, and the sites indicated in the court ruling continue to work, because in fact the sites themselves are not with us, only the domains, ”says Andrei Khvetkevich.
Representatives of the company received the list of the seized equipment only by 3 p.m. The withdrawal protocol at the time of writing this press release has not yet been received.
The court order was unreasonable, but gave the law enforcement agencies formal authority to seize the equipment.
In our opinion, the judge simply did not delve into the requirements of the investigator of the SBU and did not fully study the case materials, as a result of which such an unreasonable decision was made. The court rulings expressly state that separatist websites are served outside Ukraine, therefore, it does not make sense to withdraw equipment in Ukraine.
Now lawyers of the company are trying to return the equipment in order to restore the work of clients' sites. There is no information as to when the trial will take place, but we expected this to happen today, April 8th.
We do not support separatist sites and always cooperate with law enforcement agencies in the framework of a well-developed and coordinated interaction algorithm.
In August 2014, despite the absence of a court decision, we blocked the domain gubarev.org based on a reasoned request from the SBU. We have made changes to our Public Offer and written agreements in order to provide a more effective response mechanism.
Below we present the chronology of requests and responses of the Security Service of Ukraine, indicating that our company cooperated with law enforcement agencies promptly and within the framework of the Law.
By domain odnarodyna.com.ua:
1. 03/29/14 there was a request from the State Security Service of Ukraine "for information”:
Answer:
01/20/15 was a customer request. We wrote to the client that we would block the domain, we blocked it on 01/21/15. Then they informed the person who applied about the work done.
By domain slv.org.ua:
10/17/14 There was a request from the Security Service of Ukraine (Department of Counter-Insection for Institutions in the Sphere of Information Security), received only a scan. Block did not ask for a domain, just provide information. Request:
The corresponding answer was prepared by:
Update 8
Information from Facebook by Andrey Khvetkevich
We found and studied all the requests / responses of the SBU.
All requests that were to us with the request of blocking sites came from the Counterintelligence Department of the Security Service of the SBU. These requests were sent ONLY in the form of a scanned copy to e-mail. We still have not received the original requests.
Other departments sent originals. In particular, from the offices in Kharkov and Dnepropetrovka, we regularly received the originals and quickly responded to them. The Dnipropetrovsk Department also provided an appropriately executed document for disabling the website gubarev.org and we immediately disconnected it.
It was the Counterintelligence Department of the Security Service of Ukraine that never sent the originals. All requests of this department begin with the heading “Shchedo nadforya informatsii”. All requests without a criminal proceedings number, without any information, on the basis of which we could, by law, block sites.
At the same time, we were ready to block these sites and waited for the original request. Prior to receiving the original request, we did not have the legal right to block resources. Also, SBU officials repeatedly asked not to take any action until a court decision, in order not to destroy evidence for the investigation.
All requests that were to us with the request of blocking sites came from the Counterintelligence Department of the Security Service of the SBU. These requests were sent ONLY in the form of a scanned copy to e-mail. We still have not received the original requests.
Other departments sent originals. In particular, from the offices in Kharkov and Dnepropetrovka, we regularly received the originals and quickly responded to them. The Dnipropetrovsk Department also provided an appropriately executed document for disabling the website gubarev.org and we immediately disconnected it.
It was the Counterintelligence Department of the Security Service of Ukraine that never sent the originals. All requests of this department begin with the heading “Shchedo nadforya informatsii”. All requests without a criminal proceedings number, without any information, on the basis of which we could, by law, block sites.
At the same time, we were ready to block these sites and waited for the original request. Prior to receiving the original request, we did not have the legal right to block resources. Also, SBU officials repeatedly asked not to take any action until a court decision, in order not to destroy evidence for the investigation.
Source: https://habr.com/ru/post/255185/
All Articles