PRIVACY

The exit does not name France

· 5 MIN · 1,171 WORDS

The exit does not name France.

@Itsfoss posted at 06:37 UTC on October 23. https://x.com/Itsfoss/status/2113520157830295561. When I read it, that post had 1,469 likes, 244 reposts, 41 replies, 28 quotes, 177 bookmarks, and 32,133 impressions. The short text cuts off at Quad9. The long text says a privacy resolver chose to leave a country rather than lie, quotes Quad9 refusing to alter a DNS answer, and says the court cut the fine to €1,000 a day. Quad9 still walked away, it says, because the problem was the precedent, not the fine. Complying would mean applying French copyright law to the global resolver, or using geo-blocking Quad9 considers unreliable. Most services, it says, would have quietly blocked the domains and moved on.

The post stops at the exit. The note it is quoting does not say how they will tell a French query from any other.

The invoice ends first

Quad9 published the note on October 22. https://quad9.net/news/blog/au-revoir-france/. I read it today. The court ruled the day before, for beIN. The ruling forces Quad9 to block recursive DNS for a number of domain names, for users located in France. The penalty dropped from €580,000 a day to €1,000 a day. If they do not comply, that €1,000 runs until the block concludes on November 14. They add that up to €24,000. Legal defense is not in the figure.

TorrentFreak’s write-up of the same ruling has the count. https://torrentfreak.com/dns-resolver-quad9-will-leave-france-after-court-orders-piracy-blocking-penalty/. I read that today too. The May order now covers 58 domain names. beIN asked for €10,000 a day for every name that stayed reachable. The court set €1,000 a day in total, through November 14. Quad9 told TorrentFreak they understand the penalty applies, because they will not block those names before the order ends. The ruling cited there is RG 26/11882. I did not read the PDF.

Both pages date the service stop at November 24. That is 10 days after this penalty window closes. They are not leaving on the morning the invoice starts. They have already chosen to pay this one by blocking zero names. The stop is scheduled after that window.

The appeal is still pending. The note says they will keep defending this case, and as many of the others as they can. The post is about the service stopping. The lawsuit is still open.

They still have no list

The note is plain about the list. There is no database tying users to countries. The service is free, with no sign-up and no proof of identity. They write that there is no way to determine which users the ruling applies to. They have no list of French users, because they do not keep dossiers at all.

Two ways to satisfy the court are in the note. They reject both.

One is global. Add the names to the malicious domain blocking list on 9.9.9.9 and its secondaries. That list is not applied to 9.9.9.10, the nonprotective address. A global add would meet the order. It would also apply a French ruling to every user of the protective addresses, for one private company. They will not.

The other is geoIP, and a German court already treated that hack as noncompliance. From 2021 to 2023, Sony Music Entertainment GmbH wanted names blocked. Quad9 tried geoIP so the German service could stay up while the case ran. Sony used a VPN, reached the names from Germany, and the court fined Quad9 for contempt. Quad9 later won. It took several years and six figures. They say they are still paying that down, and they will not use geoIP for this order. A VPN already counted as proof they had not complied.

The false answer is refused. The country filter they have already tried is refused too. The note still says protection and ordinary resolution will be unavailable to French users on November 24.

TorrentFreak asked how that stop will work. Quad9 told them it has not been decided. The options they are looking at are all imperfect. That sentence is not in the post.

The note does publish a partial list, then tells you not to treat it as the test. The list is an hour or so of typical traffic, autonomous system numbers, not IP addresses. They do not identify a user inside a network. On the list: DINUM, the prime minister’s digital directorate, AS60855. EDF, AS1301. SNCF, AS203885. France Travail, AS205461. RENATER. AP-HM, Marseille’s public university hospital group, AS201659. Hundreds more, they say, picked at random from that hour. Under the table they write that autonomous systems are not exclusively geographically mapped and cannot be used as a jurisdictional identifier. A network on a list is not a user the court can point at. The table is not the France test. They have not published that test.

They also say many users in France have had this filter for nearly 9 years, and those users lose it on the way out. They do not give a count, and I do not have one either.

The names stay in the answer

On November 24 they will not block the domains. That sentence is in the note. They will stop serving whoever they decide is in France. Taking a name out of an answer is not the same as taking the resolver away from someone. The 58 names stay in the answers Quad9 still gives everyone else. They also stay on the other open resolvers the note already names, the ones a person can switch to in a settings page. Quad9’s image for a block is a piece of newspaper held up in front of a stadium. Leaving does not pull the streams down either. If the filter they have not published matches the networks on that list, what those networks lose is Quad9’s malware and phishing blocking.

TorrentFreak says that earlier in October the Paris court refused beIN’s penalty requests against Cloudflare and several VPN providers. Those companies had blocked at least some of the names. The court called that a reasonable effort. Canal+ lost a similar penalty request against Cloudflare in September. Quad9 told this court it has not blocked a single domain. The €24,000 is what they owe for blocking zero names before November 14. The November 24 exit is a separate date, and the method for it is still open.

About 20 other French cases are pending, against Quad9 and other resolvers, covering hundreds of names. Quad9 writes that it cannot survive the penalties still to come in those cases, or in later ones like beIN’s. That is the constraint in the note. The €1,000 in the post is this case’s daily rate. They already accepted the €24,000 by refusing to block before November 14.

If someone says they left rather than lie, ask whether November 24 has a test for France that is not the geoIP a German court already called noncompliance, and whether any of the 58 names is actually missing from 9.9.9.9. The note answers the second. It does not answer the first.