& The Whack-A-Mole Defense

By Thom Wysong

7:00 AM EDT, 22 October 2000

Only a day ago some were declaring that was dead. It's not so. It never was.

Earlier this year the web site stirred up controversy when the site, and the New York based graduate student who created it, first came to the public's attention. When New York authorities threatened legal action, the web site was temporarily shut down. Ownership of the site was transferred to an Austrian entrepreneur who promptly re-opened the web site running on a server in Bulgaria - out of the reach of American authorities. Or, so it seemed.

The weak link in their plan was that Domain Bank, the company that controlled their DNS entry, was based in the State of Pennsylvania. Last week, the Chicago Board of Election Commissioners took advantage of this weak link and obtained a court order forcing the US based company to remove from their Domain Name System (DNS). This action rendered the site unreachable by most people. But it did not shut the web site down, as was erroneously reported.

For those not familiar with DNS, this is analogous to someone's name being removed from the telephone directory - their telephone is still hooked up, but people can no longer look that person's name up in the directory. To call that person you need to find the phone number from some other source, or simply remember what it was. But, you can still call the person.

With the site, the same was true. In other words, even after the DNS entry had been deleted, the original website was still accessible from the Internet by those who knew how to find the website's "phone number" (its IP address) using such tools as a
WHOIS search and a DNS lookup.

However, to see what's posted on the website it's no longer necessary to track down its IP address. A few days ago, on 18 October 2000, the people behind registered a new domain name - apparently as a backup for the one they realized might get removed from DNS. The new domain name is simply All they did was add a hyphen.

However, this time they didn't make the same mistake with their DNS company. On this second go 'round they registered with a division of CSL GmbH, based in Germany, which supplies domain names in cooperation with CORE, based in Switzerland. With the web site now administered from Austria, served from Bulgaria, and registered in Germany and Switzerland, it appears that this new site will be much more resistant to the US legal system than its predecessor was.

One thing that was interesting about the old web site was that, even though its DNS entry had been deleted, the web site itself remained reachable on Friday and Saturday by those who had the technical expertise to do so. However, in place of the regular web site, visitors were greeted with a message stating "URGENT NOTICE TO ALL VOTE-AUCTIONEERS: services had been temporarily offline". And below this text was a graphic image showing part of the Temporary Restraining Order from the Chicago Board of Election Commissioners and the Illinois court. This alternate content was present on the original web site and the new web site for at least part of Friday and most of Saturday. Then, first thing Sunday morning, the new site began displaying the data from the original web site and a new press release explaining the events of the past week from's perspective.

One thing that is noticeable about the revived site is that it appears to be listing information for both the State of New York and the State of Illinois. The information from New York had previously been removed after state officials had threatened legal action. And, it could reasonably be assumed that information for Illinois would have also been removed as a response to last week's court order. However, since information for both states seem to be listed, and it appears new entries can be created for both buying and selling votes in these states, the site's operators seem to be signaling they believe they are safely out-of-reach of US officials.

Another thing that is interesting about the new web site is that it was up and running on Friday - the same day the original domain name was shut down. In other words, the web site got shut down in one place and popped up somewhere else. On the Internet, this has become known as the "whack-a-mole" technique - named after a popular arcade game. With the game, a little plastic critter pops up from one hole in a grid of holes, the player "whacks" it down into its hole with a rubber mallet, and the critter instantly pops back up from a different hole. Every time the mole is whacked down, it pops up somewhere else.

Whack-A-Mole is used as a defense strategy on the Internet when some entity attempts to suppress information it considers illegal or unethical, but which others consider to be legitimate. When one source of the information is shut down, one or more copies of it appear elsewhere - almost instantaneously. The more valuable the information is believed to be, the more vigorously this technique is applied.

With the arcade game, there is a linear correlation between the moles going down and the moles popping up - one mole pops up for every mole hit down. However, on the Internet, there is potentially an exponential correlation - many "moles" can pop up for every "mole" hit down.

A paper entitled Whack-A-Mole In Action ( ) offers a number of quotes and links on the technique as it has been used to propagate a computer program known as DeCSS, which can read DVD disks without a DVD player. There is a difference between DeCSS and in that one is static information that can be copied and the other is an active web site. However, the technique has been applied in both cases.

As for the new, there are reports that it not only intends to continue trafficking in US votes, but that it also may be expanding to the UK, Germany, Russia, Japan, and worldwide. Whether or not they will succeed remains to be seen. My guess is they won't. There are just too many ways to defeat such a mechanism as a vote auction. And, the best ways have nothing to do with restraining orders. But I'll leave that topic for another day.

Thanks goes to Adi Fairbank for providing assistance in sleuthing out the old site after its DNS entry was deleted.

© Copyright 2000 by Thom G. Wysong