Farewell, France | Quad9
weblog
We have some information to share with you.
Summary
Starting November 24, Quad9 will now not be capable to supply its free cyberprotection service to customers positioned in France.
The French courts yesterday handed down an unfavorable ruling towards Quad9 in a serious case that undermines the transparency and stability of the web. This determination in favor of beIN forces Quad9 to dam the recursive DNS decision for numerous domains for customers positioned in France.
The excellent news is the court docket considerably diminished the monetary penalty, from €580,000 to €1,000 per day. However, for Quad9, this has by no means been only a monetary difficulty: it’s a matter of precept.
We can not adjust to this ruling over the long run whereas remaining trustworthy to our mission to guard your privateness, defend you towards cyber threats, and protect the integrity of the web. For us, recursive DNS decision is a impartial and passive service. We categorically refuse to change or misinform you concerning the DNS responses you obtain in a manner that opposes your expectations.
This ruling forces an untenable place upon us. Compliance is technically unfeasible, and implementation straight contradicts our mandate to serve the general public. As a consequence, we’ve got made the troublesome determination to withdraw Quad9 providers from France as of Tuesday, November 24. We deeply remorse that French web customers might be left with out another that may adequately defend their cybersecurity whereas remaining compliant with European privateness regulation.
Background
beIN, a Qatari firm with places of work in France, beforehand sought to power Quad9 to dam decision for a set of domains they assert are collaborating in copyright infringement of its audiovisual rights on sports activities occasion broadcasts. Quad9 has no affiliation with these domains, nor with the operators of the web sites. The French courts have essentially misunderstood the working of the web and the function of the area identify system and have allowed a monetary penalty to use to Quad9 if we don’t block DNS responses to customers in France.
Quad9 is a Swiss public-benefit, nonprofit basis established for the express function of defending the cybersecurity of web customers. We cost nothing for our service and serve all folks and organizations which search to enhance the safety and privateness of their web use. Our core values are to make privateness, safety, and integrity obtainable to all web customers, and our mission is to universally apply these guiding rules to recursive DNS decision providers as a way to serve finish customers.
We need to be very clear: we don’t condone content material piracy. Quad9 exists to create a safer, extra reliable web expertise for finish customers. We supply international blocking as an possibility for malicious cyberactivity towards customers worldwide. We don’t block content material, and we give customers the selection to make use of our risk blocking providers, or not, based mostly on their pursuits and desires. Content piracy must be handled on the supply: the place the place the infringing content material is printed. Forcing uninvolved third events to interrupt the basic working rules of the web to profit particular person events to the detriment of the worldwide internet-using public is misguided, counter-productive, and distracts from precise options addressing the internet hosting of the content material straight, or the market pressures which trigger piracy to exist within the first place. Not solely are DNS recursive resolvers, like Quad9, the flawed actors to deal with piracy, however making use of authorized stress to Quad9 will even have huge unintended penalties harming the cybersecurity of tons of of hundreds of thousands of harmless web customers.
For Quad9, complying with this ruling is not possible. We haven’t any database of customers associating them with jurisdictions. Our service is free to the general public and doesn’t require sign-up or proof of id. Recursive DNS is so elementary to the underlying operation of the web that there isn’t any technique to map customers’ jurisdictions reliably, nor do we expect there must be a option to power customers to establish themselves earlier than they will hook up with the web. Our core objectives – privateness of person information and honesty of responses – are straight against the strategies essential to implement the blocking this court docket ruling would require us to carry out. There isn’t any manner we will decide which customers this ruling applies to – we’ve got no checklist of French customers, as a result of we don’t maintain dossiers of our customers in any respect.
If we don’t comply, we are going to face a each day penalty of 1.000 euros till the blocking concludes on November 14 (i.e., 24.000 euros) not together with our authorized protection. Quad9 can not survive the buildup of penalties but to be assessed in 20 different pending instances, nor these of future instances much like the one introduced by beIN. Inaction is, subsequently, not an choice to problem this determination.
Can Quad9 simply comply by way of international blocking?
We may add these names to our international malicious area blocking database, which is what we use to offer web customers with malware and phishing safety. This is a single, monolithic set of names utilized to all customers of our protecting providers (9.9.9.9 & secondaries) globally however to not our nonprotective providers (9.9.9.10 & secondaries). Blocking these names for all customers globally would fulfill the necessities of the court docket.
However, this could have the “extraterritorial” impact of making use of French authorized selections to each web person worldwide, when they’re meant to solely apply to France, for the business good thing about a single personal, foreign-owned firm. We suspect if different nations wished to impose their nationwide laws inside France, there can be a powerful response from French customers and authorities. The converse is equally true: the findings of a French court docket will not be relevant to the remainder of the planet. Such a system would set a precedent that any nation may impose their legal guidelines, morals, financial calls for, or social constructs upon another nation by the technique of blocking DNS names, and thus blocking communication and content material.
Therefore, this international blocking technique is solely unworkable for us as an answer to be compliant with the court docket order.
What is “France” from the angle of the web?
There are extra vital causes geoIP blocking is not going to work. We already prevailed in an identical authorized case in Germany in 2021-2023 through which we realized an vital lesson: we tried to make use of geoIP blocking as a “hack” in an identical circumstance at first of the authorized proceedings, permitting us to proceed providers in Germany till the case concluded. The plaintiff (Sony Music Entertainment GmbH) then used a VPN to entry the blocked content material from Germany in circumvention of the geoIP blocking. The court docket agreed with Sony of their assertions of noncompliance, and we had been fined for contempt of court docket.
From this expertise, we all know that the geoIP-based mannequin will not be solely unfit from a technical perspective, however we’ve got confirmed, historic proof that utilizing geoIP strategies ends in fines being levied towards us by courts. To any technology-aware individual, this appears absurd and outrageous – however that is what we face in these lawsuits the place there’s a disconnect between the courts’ understanding and the way (and why) the technical protocols of the web truly function. We can not danger this damaging end result on this or another future occasion, as absurd selections apparently are de rigueur in these instances.
We finally won that case against Sony, however it took a number of years, six figures of price to Quad9, and big wasted time – all of which set us again in our skill to ship providers and is a useful resource debt we’re nonetheless paying for in the present day. This case is simply extra of the identical – the opposition has extra attorneys than we’ve got time and money.
The determination of Quad9
Given these situations and on account of our unwavering mission, our historic expertise, our need to stay throughout the regulation, and the result of the court docket determination, we’re left with an uncomfortable selection.
The calls for lead us to an not possible requirement: we should adhere to the court docket’s determination, or we face rising dangers to our existence. However, in implementing the blocking, we should both prolong French regulation to the entire planet (blocking globally) or create a vulnerability situation whereby we proceed to be in danger as a result of the obtainable technical strategies are imprecise, not possible to validate, and don’t meet any person privateness and safety necessities.
This leads us to the one conclusion we will perceive to get rid of our authorized danger and maintain us true to our mission: we should make our cybersecurity safety and normal providers unavailable to French customers. Our departure is scheduled for November 24, 2026.
In any occasion, for Quad9, it is a matter of precept concerning the potential misuse of some of these blocking measures. Allowing personal companies to have the flexibility to dam what’s seen on the web appears to us to be a harmful and infinitely deep drawback. Actions that appear affordable and rare in the present day will tomorrow change into an avalanche of petty calls for used to suppress political, non secular, financial, or social outcomes. We is not going to be even a small a part of that degradation of the liberty of information. Once the instruments of censorship are constructed, they’re not often used sparingly or justly.
This case with beIN will not be the one litigation we face in France. There are roughly 20 totally different lawsuits pending towards Quad9 (and different recursive resolver operators) that demand we adjust to blocking tons of of various names. We anticipate a lot of them to escalate to the identical situations as we’ve got seen with beIN, which places Quad9 in danger whatever the end result of this case.
Based on the generalized, high-level visitors statistics we maintain, we all know we’ve got many customers in France. With our departure, these customers might be put in danger from the threats we’ve got protected them from for practically 9 years. We deeply remorse that consequence, however we’ve got no different selection. Below is a partial checklist of the networks from which we see visitors in France. You will see many utilities, nationwide safety, finance, schooling, and different networks of crucial significance along with ISP customers and cellular customers. All these customers will lose service on November 24 due to the authorized dangers going through Quad9 in France.
What is the aim of this entire lawsuit, anyway?
The most troubling a part of this determination is that it’s ineffective in apply. Forcing Quad9 to dam domains doesn’t take the content material out of circulation and has no impact on the servers that home the information.
We supply a free service, and there are thousands of other open DNS systems that do what Quad9 does however with decrease belief, security, and reliability. Users in search of blocked content material will merely shift their DNS to make use of a type of different free providers, probably utilizing techniques in different nations which have less-than-honorable intentions from a privateness and safety perspective. This is like holding a chunk of newspaper in entrance of a stadium full of individuals to dam the view of a live performance. It is an unsolvable drawback by way of recursive DNS, and the impact of authorized rulings like this isn’t measurable exterior of the quantities paid to attorneys and the variety of phrases in press releases declaring hole victory.
Even beIN is not going to see any adjustments. Perhaps that’s understood and the cruelty could be the level – we can not say with certainty why such expenditures have been made towards a small nonprofit like Quad9, which tries solely to convey safer, trusted service to customers. But of this we’re sure: these actions are a tragic waste of time and assets and create an actual, damaging end result for the web neighborhood of France, whether or not or not they’re our customers.
What we’re doing on November 24
Quad9 is not going to block the domains in query – we want to stay dedicated to our integrity of offering a whole view of the DNS for customers who want that service. However, beginning on November 24, we are going to now not serve French customers, thus preserving Quad9 out of hazard from comparable, even perhaps bigger dangers sooner or later. Our hope is that 30 days might be enough time for conversion, although we remorse that this message will undoubtedly not attain some customers in time.
An enchantment is pending, and we are going to proceed to legally defend our place in court docket on this case and as many different instances as we’re in a position. We will proceed to oppose court-ordered DNS blocking of this nature all over the place. Our assets are restricted, however we’re decided to maintain the web open and free. You can donate here to assist us proceed to ship on our mission and help us within the authorized prices we incur on this and different fights.
What you are able to do subsequent
We assume this drawback is reversible. French residents: inform your legislators that wanting up names will not be a felony offense. The web wants to stay open and freely obtainable to anybody, and impartial intermediaries like Quad9 (or any DNS resolver) shouldn’t be implicated in authorized proceedings as a result of we map names to IP addresses. Further, we all know there are potential plans in consideration in France (and different European nations) to present personal companies and others automated and unvalidated skills to filter DNS content material that they alone decide to be undesirable, making it attainable for a variety of badly-managed or anti-democratic actions to be applied. We imagine you disagree with this as a lot as we do. Make your self heard, or you’ll lose your rights silently.
ARCOM is your regulatory authority, and it is best to inform them this precedent locations France in danger each from a sensible and strategic perspective.
Let them know that underneath their mandate, they should stability your digital rights as residents in addition to the audiovisual rights on sports activities occasion broadcasts of rights holders. Balance can’t be claimed when the privateness and safety of digital customers are the collateral injury.
In conclusion
Fighting piracy by way of DNS resolvers blocking is ineffective. It is disproportionate and misguided, ill-fitted and futile to struggle piracy, because the supply content material stays fully obtainable to resurge underneath one other identify. Forcing Quad9 to depart harms French digital technique and sovereignty in the long term referring to safety, privateness, and integrity – contradicting France’s supreme nationwide pursuits in alternate for a short-term, imaginary business victory.
We deeply remorse that we should depart our French customers with out cybersecurity safety, however we hope the longer term will see a extra affordable interpretation of the regulation which permits us to return.
Sincerely,
The Quad9 Team
* This submit was authored and translated into French by people on the Quad9 Team
Partial List of French Networks Using Quad9
This checklist is extracted from community metrics of an hour or so of typical utilization. Quad9 tracks community autonomous techniques quantity origins as per our privacy policy, however we don’t establish particular person IP addresses or customers inside these networks. There are tons of of extra French networks utilizing Quad9; we picked solely these at random to point out the breadth of utilization. Autonomous techniques will not be solely geographically-mapped and can’t be used as a jurisdictional identifier; although it’s protected to say that the majority of those networks have a good portion of their person base in France.
National authorities & public businesses
60855 — Direction interministérielle du numérique (DINUM) — Prime Minister’s digital directorate; units state digital technique and runs the interministerial state community (RIE).
43717 — Business France (EPIC) — National company that helps French companies export and attracts overseas funding.
205461 — France Travail (EPA; previously Pôle emploi) — National public employment service: job placement, jobseeker help, unemployment profit fee.
777 — CEA Paris-Saclay (EPIC) — Saclay centre of the Commissariat à l’énergie atomique et aux énergies alternate options; public analysis in nuclear and various power, defence and well being expertise.
44850 — Institut de recherche pour le développement (IRD; EPST) — Public analysis institute working with Global South companions on well being, surroundings and social sciences.
29110 — Institut Pasteur (personal basis, recognised as public utility) — Non-profit biomedical analysis basis in Paris (infectious illnesses, vaccines, microbiology); hosts nationwide reference centres.
Research & schooling community
1307, 1712, 1715, 1942, 1945, 2060, 2094, 2198, 2200, 2202, 2259, 2269, 2457, 2470, 2472 — RENATER (GIP) — National analysis and schooling community; its members are the State and public analysis our bodies.
Student-run campus networks
204515 — Crans (affiliation) — ENS Paris-Saclay scholar community affiliation offering connectivity, internet hosting and e mail to members.
212424 — ViaRézo (Association des réseaux de CentraleSupélec) — Student affiliation offering web and IT providers on the CentraleSupélec campus.
207849 — ESIEESPACE — ESIEE Paris scholar membership that runs OpenGate, a scholar non-profit ISP.
Private schooling
56339 — IONIS Education Group (SAS) — Private for-profit higher-education group (EPITA, Epitech, ESME, IPSA, ISG, Sup’Biotech).
Regional & native authorities
208458 — Région Nouvelle-Aquitaine — Regional authority overlaying 12 départements; seat in Bordeaux; created 2016.
208820 — Département de la Seine-Saint-Denis — Île-de-France département; council seated in Bobigny.
50036 — Département des Pyrénées-Atlantiques — Nouvelle-Aquitaine département; council seated in Pau.
34000 — Département des Bouches-du-Rhône — Departmental council.
48799 — Ville et Eurométropole de Strasbourg — Shared administration of the City of Strasbourg and the 33-commune Eurométropole.
204897 — Grand Besançon Métropole — Communauté urbaine of 67 communes round Besançon.
208574 — Communauté de communes du Pays de Bitche — Intercommunal physique of 46 communes in Moselle; owns the Tubéo public fibre-to-the-home community.
202834 — Commune d’Échirolles — Commune south of Grenoble; member of Grenoble-Alpes Métropole.
211127 — SITPI (Syndicat intercommunal pour les télécommunications et les prestations informatiques) — Ten Grenoble-area communes pooling telecom, IT and GIS providers.
Public digital utilities (local-authority networks & IT)
200245 — Manche Numérique (syndicat mixte) — Builds the Manche fibre community; offers IT, e-administration and telecom providers to native authorities.
44842 — Somme Numérique (syndicat mixte) — Owns the Somme fibre community; offers digital providers to native authorities and faculties.
214589 — Essonne Numérique (syndicat mixte ouvert) — Essonne public fibre community, plus interconnection, internet hosting and data-centre providers for public websites.
47608 — Gigalis (GIP) — Pays de la Loire regional fibre community for native authorities, well being, emergency providers and faculties.
41114, 62038 — Orne THD (SPL) — Company owned by Rombas and neighbouring communes in Moselle; sells fibre web and TV over their networks.
39271 — C’Chartres Innovations Numériques (SEM) — Chartres Métropole firm operating fibre, a personal 5G community, an information centre and IT providers.
207430 — SITEC, Société informatique et télématique corse (SEM; Collectivité de Corse 56%) — Hosting, cloud, cybersecurity and IT providers for Corsican public our bodies.
50547 — Régie du réseau câblé du Haut Sundgau (local-authority régie) — Public wired telecom community in southern Alsace.
49011 — MACS THD (SASU, SFR group) — Private firm operating the Maremne-Adour-Côte-Sud (Landes) high-speed community underneath a public-service concession.
Energy & utilities
1301 — Électricité de France (EDF; 100% state-owned) — National electrical energy producer and provider; operates France’s nuclear fleet.
62141 — Compagnie nationale du Rhône (CNR; majority public shareholding, Engie reference shareholder) — Holds the Rhône concession: hydroelectric dams, navigation and irrigation, plus wind and photo voltaic.
39830 — Teréga (personal SA; previously TIGF) — Gas transmission and underground storage operator for south-west France.
43734 — UEM (native SEM; previously Usine d’électricité de Metz) — Metz utility: electrical energy, gasoline, district heating, public lighting.
12727, 42487, 208719 — Vialis (SEM; Colmar largest shareholder) — Colmar utility: electrical energy and gasoline plus cable TV, web and fibre.
204645 — Régie ENES (Régie municipale d’électricité de Creutzwald) — Municipal régie: electrical energy, fibre web, native TV, district heating.
Transport
203885 — SNCF (Société nationale SNCF SA; state-owned) — Parent holding firm of the nationwide railway group.
34809 — Sanef (SA; Abertis subsidiary) — Motorway concession operator for northern and jap France.
Health
201659 — AP-HM (Assistance Publique – Hôpitaux de Marseille) — Marseille’s public college hospital group.
51588 — SESAN (GIP) — Île-de-France regional physique offering shared digital-health providers to care suppliers.
49692 — Compagnie Générale de Santé (SAS; personal) — Name of the hospital group now referred to as Ramsay Santé.
Broadcast & media
24843, 43930 — France Télévisions (state-owned SA) — National public-service tv broadcaster.
43646 — TDF (SASU; owned by utilities funds) — Broadcast transmission and tower utilities operator.
Private trade & expertise
29104 — Thales Services Numériques (SAS; Thales group) — IT providers, cloud, safety operations and integration for defence, area and public-sector purchasers.
49068 — Stormshield (SAS; Airbus Defence and Space) — Cybersecurity vendor (firewalls, endpoint safety, encryption); ANSSI-qualified merchandise.
57226 — IDEMIA Identity & Security France (SAS) — Identity paperwork, biometric identification and border/entry techniques; previously Safran Morpho.
41935 — Dassault Systèmes (SE; listed) — 3D design and simulation software program (CATIA, SOLIDWORKS); not Dassault Aviation.
42924 — VINCI Construction SI (SNC) — In-house IT unit of VINCI Construction.
201647 — SI-nerGIE (GIE of Orano and Framatome) — Shared IT operations for each firms: information centres and native help.
49920 — Flowbird (SAS) — Maker of parking meters and transit ticketing techniques.
20493 — Viparis Le Palais des Congrès de Paris (SA; 50/50 CCI Paris Île-de-France and Unibail-Rodamco-Westfield) — Operates the Palais des Congrès conference centre.
