Wikileaks Iraq War Logs vanish from Amazon US

Whistle-blower still on American registrar, DNS

WikiLeaks' "Iraq War Logs" site is no longer hosted on US-based servers operated by Amazon.com, according to internet records.

Warlogs.wikileaks.org is now mirrored only on Ireland-based Amazon servers and France-based servers from French service provider Octopuce, records collected by UK-based internet research outfit NetCraft show.

The main WikiLeaks site, however, is still mirrored on US-based Amazon servers, according to NetCraft data. What's more, the site's DNS service is controlled by a US outfit, and it uses a US-base domain name registrar.

On Friday, after WikiLeaks released almost 400,000 classified documents related to the Iraq War, independent technology consultant Alex Norcliffe noticed that the whistle-blowing outfit was mirroring its content on Amazon's AWS infrastructure cloud in the US and Ireland, and on Octopuce servers in France. This included both the new warlogs.wikileaks.org, which serves up the Iraq Wars Logs, and the organization's primary site, www.wikilleaks.org.

Then, on Tuesday, Norcliffe noticed that the US mirrors had disappeared.

WikiLeaks maintains its central servers in Sweden with the outfit PRQ, run by the founders of the P2P file-sharing site The Pirate Bay. According to WikiLeaks founder Julian Assange, the organization uses servers in Sweden because the country provides legal protection for disclosures on the site. PRQ also offers what's commonly known as "bulletproof" hosting. It keeps almost no information about its users, and it maintains few if any logs.

But it would appear that Wikileaks began mirroring its data on Amazon and Octopuce in an effort to handle the additional traffic expected with the release of the Wars Logs. Wikileaks has not responded to emails sent to addresses it has answered in the past.

We've also contacted Amazon and the US Department of Defense, which has condemned the release of the Iraq War Logs, but neither has responded.

Warlogs.wikileaks.org was hosted on US-based Amazon servers. But no more...

It's unclear why the War Logs site is no longer hosted on Amazon's US servers. Conservative US newspaper The Washington Times is calling for a US government-led cyberattack on WikiLeaks. Though Amazon may not be legally compelled to remove the War Logs from its servers, Santa Clara law professor and tech law blogger Eric Goldman questioned whether Amazon might removed the data anyway.

"[Federal law] 47 USC 230 protects Amazon from being liable for WikiLeaks' content in most circumstances. The only relevant exception is that 230 does not protect Amazon if republishing the content constitutes a federal crime. I'm uncertain what crimes could apply to the content publication," Goldman told The Register over the weekend, while the Wars Logs site was still on Amazon's US-based servers.

"However, even if Amazon is insulated from liability, I suspect Amazon will choose to remove the content 'voluntarily' (motivated by a little persuasion from the government), presumably citing a breach of its terms of service as a pretext.

"A more 'ideological' web host would probably fight more vigorously for its users' publishing rights than Amazon will," Goldman said.

Another federal law, 18 USC 798, forbids the disclosure classified information about a "code, cipher, or cryptographic system of the United States" or "the communication intelligence activities of the United States." But according to George Washington University law professor Orin Kerr, this does not mean that Amazon is legally at fault. "The statute requires that the person held liable has to act 'knowingly and willfully,' and Amazon has not done either," he tells The Reg.

As NetCraft points out, it appears that WikiLeaks has set up its DNS so it can quickly shift its mirrors between locations. Warlogs.wikileaks.org has a 15-minute "time to live" (TTL) setting, which would allow for a rapid move if content is taken down in one location. NetCraft says it has not witnessed any outages at the site.

But even if WikiLeaks is not hosting the War Logs on US servers, it may be vulnerable because EveryDNS is owned by Dyn Inc., a US-based company. Wikileaks also uses a US-based domain register, Dynadot.®

Update: This story has been updated to show that Dyn Inc. – not Dynadot – owns EveryDNS and that there is only one major paper, The Washington Times, calling for a US-government-led cyberattack on Wikileaks.