Bulletproof hosting, and what the words actually mean

Search for a host that will not remove your service on request and you will meet four words used as if they were interchangeable: bulletproof, offshore, DMCA-ignored, DMCA-free. They are not interchangeable. Three of them describe something real, each a different thing, and the fourth describes nothing at all. Buying on the wrong one is how people end up paying for a promise their provider never made.

Four words, three meanings and one blank

Take them one at a time, because the differences are the whole subject.

Offshore — a statement about legal geography

“Offshore” says that the machine, and ideally the company that owns it, answer to a legal system other than yours. That is all it says. It is a statement about which law applies, not about what that law permits, and not about what the provider chooses to do. A host can be perfectly offshore and still remove your service the moment anyone complains, because nothing about the word constrains its behaviour. It is the most honest of the four and the least informative on its own.

DMCA-ignored — a statement about one specific statute

The Digital Millennium Copyright Act is United States law. Its notice-and-takedown machinery, 17 U.S.C. § 512, conditions an American provider’s safe harbour on operating a removal procedure — which is why American hosts remove first and ask afterwards. A provider established outside the United States has no safe harbour to lose and therefore no structural reason to remove pre-emptively.

So “DMCA-ignored”, read literally, is a factual claim about jurisdiction rather than a policy of defiance. Nobody is ignoring a law; the law was never addressed to them. That distinction sounds pedantic until a provider that advertises the phrase folds anyway — at which point you discover it was describing an attitude rather than a legal position, and attitudes change when an upstream carrier makes a phone call.

DMCA-free — a phrase that means nothing

Nothing is “free of” a statute it was never subject to. A datacentre in Chișinău is no more DMCA-free than it is free of the Californian vehicle code. The phrase exists because it converts well, and its presence in a provider’s marketing is a reasonable signal that the rest of the marketing was written the same way. It is the only one of the four that carries no information.

Bulletproof — a word with a meaning you did not choose

This one is different, and it is worth knowing before you type it into a search box. In the security literature — vendor reports, law-enforcement takedown announcements, academic papers on abuse infrastructure — “bulletproof hosting” has a settled meaning: a provider that knowingly hosts criminal infrastructure and sells that knowledge as the product. Command and control servers, phishing kits, malware distribution.

Sellers use the word to mean “we will not remove your file sharing site”. Researchers and prosecutors use it to mean something a great deal narrower and less pleasant. Both meanings are in circulation, and a provider advertising the term is choosing to be legible to the second audience as well as the first. That has consequences for the neighbours: prefixes associated with the term collect blocklist entries, and blocklists do not distinguish between the customer running a forum and the customer running a botnet.

What a host can actually be made to do

Under all four words sit three separate verbs, and providers habitually blur them. Separating them is the fastest way to read any hosting policy.

Forward. Pass a complaint to the customer and let them decide. This costs the provider nothing and protects nobody but the customer, which is precisely why it is the one thing a provider can do freely. A host that forwards and stops there has made an actual choice.

Remove. Take the content or the machine offline. In the United States this follows from a notice; elsewhere it generally requires a court, or a provider that has decided not to wait for one. The gap between “a notice can do this” and “only a judge can do this” is the largest single difference jurisdiction makes, and it is measured in weeks rather than in principles.

Disclose. Hand over what the provider knows about the customer. This one is not governed by copyright law at all, and it is the verb people forget to ask about. A provider can be immovable on removal and entirely cooperative on disclosure — and if it collected identity documents at signup, cooperation is trivial for it and expensive for you.

Where this host sits on that list

Since the point of the exercise is to make providers answerable, here are our own answers in the same terms, and they are checkable against the pages that carry them.

Offshore: yes, and in one country rather than nine. The machines and the company are both in the Republic of Moldova. A provider incorporated somewhere strict, renting cabinets somewhere permissive, stays permissive exactly as long as its own head office allows.

DMCA: it does not reach us, and that is a jurisdictional fact rather than a posture. A copyright notice is logged, counted, forwarded to the customer verbatim, and that ends our involvement. The instrument that governs copyright here is Moldovan law, and it provides a judicial remedy — a claimant brings an action before a Moldovan court. The quarterly count of notices, and the number of removals they caused, is published.

Disclosure: there is very little to disclose. No identity documents are collected at any point, so none can be handed over. Connection logs are kept for twenty-four hours. The full inventory of what exists is published rather than summarised, which is the only version of that claim worth anything.

Bulletproof: no, and the word is not ours. Two categories of content are refused outright — child sexual abuse material, and material organising violence against people. There has never been a third. Everything else on the list, including the things that get people refused elsewhere, is the customer’s business. That is a narrower promise than “bulletproof” and a far more durable one, because it is a promise we can keep when somebody applies pressure.

Six questions for anyone using these words

These work on us as well as on anyone else, and the answers should take a competent provider under a minute.

1. Which instrument compels you, by name? A provider that cannot name the statute and the forum has not thought about it, or has and would rather you did not.

2. Do you own the hardware, and where is the company registered? Rented cabinets mean an upstream with its own abuse desk and its own risk appetite, and every layer above you is another party who can terminate you for reasons you will never see.

3. What did you collect about me at signup, and how long do you keep it? This is the disclosure question in its practical form. Documents collected are documents disclosable.

4. How many removal demands did you receive last quarter, and how many did you act on? Two numbers. A provider that publishes them is making a falsifiable claim; a provider that does not is making an unfalsifiable one.

5. What do you refuse, and is the list finite? An open-ended “anything we deem inappropriate” is a clause that means whatever is convenient on the day it is invoked.

6. What happens to my data if you stop answering? Every question above assumes the provider is still there. A signed statement refreshed on a schedule is worth more than a promise made once at signup.

If those six answers are specific, the word on the homepage barely matters. If they are not, no adjective will save you — least of all one that means something in a courtroom that it does not mean in an advertisement.

Written by the engineers who run the platform, and re-read today. If something here is wrong or has gone out of date, say so from the panel — that is where about half of these came from.