Hosting terror

SunSpot Staff

From a refurbished broom factory in the west end of Canton, an Internet Service Provider serves up one of the most prominent Web sites of Hezbollah, a group designated by the State Department as a terrorist organization.

The site boasts of how the group "...used one of its own special types of resistance against the Zionist enemy that is the suicide attacks. These attacks dealt great losses to the enemy on all thinkable levels such as militarily and mentally. The attacks also raised the moral [sic] across the whole Islamic nation."

An investigation of several ISPs has revealed that they are hosting the Web sites of listed terrorist organizations. However, the nature of their business makes it hard to control which sites are hosted and while the sites may be objectionable, they are not necessarily illegal. Furthermore, efforts to shut them down could tread on First Amendment rights and possibly hinder anti-terrorism efforts.

The Web site of the Islamic Resistance Support Association also is hosted by the same Canton company, SkyNetWEB. IRSA's site lists the names, photos and biographies of men killed in their fight against Israel under a section labeled "martyrs."

Everything from their marital status to the cause of their death is listed. The listings go back to the 1960s, and most appear to have been killed in fights with the Israeli military.

"Hussein Mohsen," killed, "In an attack on the "Israeli" enemy." "Nimr Ali Ftouni," killed "In a gunbattle at Houla deep inside the "Israeli" occupation region." But others are more vague: "Youssef Kataya," killed "In a course of executing his Islamic sacred duty."

SkyNetWEB was purchased in 2000 by Affinity Internet Inc., a California-based Web-hosting provider.

When asked how much and when his company knew about the two sites, Jim Collins, Affinity's chief operating officer, said: "Affinity provides hosting for more than 120,000 customers and more than 500,000 domains, making it impossible to constantly monitor customers' Web sites or activities. In addition to that, approximately 55 percent of our sites are sold and controlled [by] resellers who lease the space from us."

Collins also is wary of losing the company's status as a "conduit" company, which allows it to exist merely as a provider for the flow of information across the Internet. He said that if his company were to make a conscious effort to monitor content, it might lose that status. That could leave Affinity legally responsible for the content on every site they host.

As to whether the company planned to shut down Hezbollah's site, Collins deferred to federal agencies. "When we are made aware of any violations of our usage policy we take immediate action and contact the proper authorities. ...In many cases, authorities will approach companies such as ours and request that the sites stay online for monitoring. Beyond that, I can't say anything."

Affinity has offices in Fort Lauderdale, Fla., and El Segundo, Calif., with data centers in Los Angeles, Fort Lauderdale and Baltimore.

Tracking them down

In the complex world of Internet hosting, controversial Web sites often disappear overnight and accountability can be hard to come by. Shut down a Web site in one location and another provider, unwittingly or not, will have the material up within weeks, days or minutes.

To track down the owner and hosting provider of a Web address, public databases were queried. Some of the information -- such as the owner of the domain name -- can be falsified., for instance, is purportedly owned by a Mohamad Hejazi in Beirut. But the company that hosts a Web site cannot be falsified because of something called an IP, or Internet Protocol, address.

The Internet is built around these IP addresses. They are the string of numbers that designate Web sites and individual users on the Web. For example, SunSpot's IP address is

Broad ranges of IP addresses are doled out from large companies such as UUNet to Internet resellers. Those resellers then sell individual IP addresses to anyone who wants to set up a Web site or blocks of IP addresses to companies that want to host multiple sites.

And that's how an entity that identifies itself as Norsac ended up with six IP addresses that host Hezbollah and the Islamic Resistance Support Association.

Public records show Norsac purchased a block of IP addresses -- ranging from to -- from SkyNetWEB, which provides a rack space and bandwidth for Norsac's server in Canton.

Four of these IPs are non-responsive, but two of them -- and -- are home to the two Islamist Web sites.

With a few keystrokes, a credit-card number and a modicum of technical skill, anyone in the world can serve up anything -- including radical Islamist propaganda -- to Internet browsers via these ISPs.

But that is where the trail goes cold. The registrant, Norsac, lists its address as being the same as SkyNetWEB's. Affinity declined to provide further information about Norsac, citing its privacy policy.

A common dilemma

It isn't just Baltimore companies that are hosting these sites. A company in Houston hosts a site that identifies itself as the Web site of another group listed by the State Department as a terrorist organization, the Al-Qassam Martyr's Brigade (the military wing of Hamas).

Buried deep on Al-Qassam's site is a plea in English for money to help fund "mujahids" (religious warriors):

"The price of Kalashnicov [sic] bullet is $3 and the price of the Kalashnicov [sic] gun itself now is $2,000 and it was $3,500 couple of months ago, and do you know that the the price of R-B-G is $12,000 and the price of T.N.T that's used by your mujahideen brothers is $100 a kilo, also Martyr Izz el-Deen el-Qassam Phalanxes now manufactures Al-Qassam land-to-land missiles in different sizes and also the anti-shields Al-Banna bomber, Martyr Izz el-Deen el-Qassam Phalanxes also supervises the development of fighting, defensive and attacking weapons and other much projects mustn't be elaborated for confidentiality purposes. "Dear donator brother, send us at the e-mail available at Martyr Izz el-Deen el-Qassam Phalanxes's web site and send us a fake name and the amount that you want to donate and we will secure handing this money to the mujahideen ..."

The site goes on to list an e-mail address where interested parties can write to get more details on making the donation.

The letter is signed, "Your brothers, Martyr Izz el-Deen el-Qassam Phalanxes, The military wing of Hamas movement- Palestine."

The hosting company of, Everyone's Internet, did not respond to repeated requests for comment.

Propaganda being delivered via these sites isn't the only concern. It has been widely reported that the FBI is worried that terrorist organizations may be using the Internet to send messages with steganography, a process that encodes messages inside other files, including pictures, audio or video. What looks like a harmless picture could conceivably contain instructions for terrorists.

Another of these sites,, highlights the difficulties faced by Internet hosting companies and law enforcement agencies when a suspected terrorist site has no English-language section identifying its affiliation.

Several sites, including those of watchdog groups that keep tabs on terrorist sites and Islamic portals, identify Qudsway as the site of the Palestinian Islamic Jihad.

But without an open statement of identification in English, companies are often left in the lurch.

"Hostway will not host sites that are anti-American or pose a threat to anyone," said John Lee, director of marketing for Hostway, the Chicago-based Internet provider that carries Qudsway. The issue is under investigation, and his company is aware that it may be hosting a site that "may be related to certain terrorist organizations."

But without proof, Lee said, "We do not want to play the censor ourselves. What we will do is coordinate with the proper authorities and cooperate fully."

If the site is proved to be affiliated with any group on the State Department's list of terrorist organizations, Lee says, they will no longer host it.

Are these companies breaking the law?

Some ISPs rely on technology to block certain customers.

Hostway, for instance, runs all names that apply for service against a list of organizations and individuals affiliated with terrorism that has been provided by the State Department.

If there's a match, the company refuses service.

But hosting these sites might do more than provide tools for terrorists -- it could also put them afoul of the law.

To prevent American companies or individuals from providing assistance or support to terrorist organizations, President Bush signed Executive Order 13224 into law last September. The order is intended to block transactions with "Persons who commit, threaten to commit, or support terrorism."

So are companies who are paid to host these sites in violation of the law?

The answer to that question isn't entirely clear. The U.S. Treasury Department, the agency tasked with executing Executive Order 13224, took a guarded line on whether companies like SkyNetWEB are in violation.

"We can't comment on an ongoing investigation, but we will take appropriate action in any situation where a U.S. business is providing services to a named terrorist group in violation of the sanctions," said Treasury spokeswoman Tasia Scolinos.

First Amendment rights also an issue

Should the government move to shut these sites down, or are they simply extreme examples of the rights protected by the First Amendment?

"Propaganda, per se, would be a tough argument to make for closing it down" said Paul McMasters, First Amendment ombudsman for the Freedom Forum, a non partisan foundation in Arlington, Va., that works with First Amendment issues. "Engaging in unlawful activities is another matter. The First Amendment doesn't allow violations of the law or threats to national security."

Even if the government could shut down these sites for legal violations, would they necessarily want to?

"I think that it would be naive to assume that the government is unaware of these sites and that there is no good reason that it hasn't moved to shut them down," McMasters said. "It may well be that government officials regard these sites as being helpful in their intelligence-gathering. In other words, they are of more benefit than harm."

Lee Tien, senior staff attorney for the Electronic Frontier Foundation, a San Francisco watchdog group that monitors civil rights online, agreed.

"It is often the case that law enforcement -- or in this case, counterintelligence -- is going to let something that they could shut down stay in place so that they can monitor it."

But he added, "I think the ISP is in a difficult spot."

Copyright © 2018, The Baltimore Sun, a Baltimore Sun Media Group publication | Place an Ad