We have several news to portion alongside you.
Summary
Starting November 24, Quad9 volition no longer be capable to recommendation its liberated cyberprotection assistance to users located in France.
The French courts yesterday handed downward an unfavorable ruling against Quad9 in a important case that undermines the transparency and stability of the internet. This decision in favor of beIN forces Quad9 to obstacle the recursive DNS resolution for a figure of domain names for users located in France.
The fine news is the court considerably reduced the financial penalty, from €580,000 to €1,000 per day. However, for Quad9, this has never been fair a financial issue: it is a matter of principle.
We cannot comply alongside this ruling complete the lengthy term during remaining loyal to our goal to defend your privacy, defend you against cyber threats, and maintain the integrity of the internet. For us, recursive DNS resolution is a neutral and passive service. We categorically refuse to alter or lie to you concerning the DNS responses you obtain in a way that opposes your expectations.
This ruling forces an untenable stance upon us. Compliance is technically unfeasible, and implementation immediately contradicts our command to assist the public. As a result, we have made the difficult decision to retreat Quad9 services from France as of Tuesday, November 24. We deeply regret that French net users volition be remaining without an substitute that can adequately defend their cybersecurity during remaining compliant alongside European privacy law.
Background
beIN, a Qatari business alongside offices in France, earlier sought to power Quad9 to obstacle resolution for a set of domain names they province are participating in copyright infringement of its audiovisual entitlements on sports event broadcasts. Quad9 has no affiliation alongside these domain names, nor alongside the operators of the websites. The French courts have basically misunderstood the operating of the net and the function of the domain name scheme and have allowed a financial penalty to use to Quad9 if we do not obstacle DNS responses to users in France.
Quad9 is a Swiss public-benefit, nonprofit basis established for the definitive intent of protecting the cybersecurity of net users. We accusation nothing for our assistance and assist all group and organizations which search to enhance the safety and privacy of their net use. Our center values are to create privacy, security, and integrity accessible to all net users, and our goal is to universally use these directing principles to recursive DNS resolution services in command to assist end users.
We desire to be extremely clear: we do not condone satisfied piracy. Quad9 exists to create a safer, additional trustworthy net cognition for end users. We recommendation earth blocking as an choice for malicious cyberactivity against users worldwide. We do not obstacle content, and we provision users the choice to use our danger blocking services, or not, according to their interests and needs. Content piracy needs to be dealt alongside at the source: the location anywhere the infringing satisfied is published. Forcing uninvolved third parties to interrupt the essential functioning principles of the net to advantage idiosyncratic parties to the detriment of the earth internet-using community is misguided, counter-productive, and distracts from genuine solutions addressing the hosting of the satisfied directly, or the market pressures which logic piracy to be in the archetypal place. Not lone are DNS recursive resolvers, akin Quad9, the incorrect actors to location piracy, but applying lawful force to Quad9 volition additionally have huge unintended consequences harming the cybersecurity of hundreds of millions of guiltless net users.
For Quad9, complying alongside this ruling is impossible. We have no repository of users associating them alongside jurisdictions. Our assistance is liberated to the community and does not necessitate sign-up or evidence of identity. Recursive DNS is so essential to the underlying procedure of the net that there is no method to map users’ jurisdictions reliably, nor do we think there have to be a way to power users to acknowledge themselves before they can nexus to the internet. Our center goals – privacy of person data and honesty of responses - are immediately opposed to the methods necessary to execute the blocking this court ruling would necessitate us to perform. There is no way we can decide which users this ruling applies to – we have no catalog of French users, since we do not keep dossiers of our users at all.
If we do not comply, we volition visage a regular penalty of 1.000 euros until the blocking concludes on November 14 (i.e., 24.000 euros) not including our lawful defense. Quad9 cannot last the gathering of penalties yet to be assessed in 20 another pending cases, nor those of forthcoming cases akin to the one brought by beIN. Inaction is, therefore, not an choice to difficulty this decision.
Can Quad9 fair comply via earth blocking?
We could add these names to our earth malicious domain blocking database, which is what we use to provision net users alongside malware and phishing protection. This is a single, massive set of names applied to all users of our protective services (9.9.9.9 & secondaries) globally but not to our nonprotective services (9.9.9.10 & secondaries). Blocking these names for all users globally would fulfill the requirements of the court.
However, this would have the “extraterritorial” consequence of applying French lawful decisions to all net person worldwide, whenever they are meant to solely use to France, for the business advantage of a sole private, foreign-owned company. We doubtful if another nations desired to enforce their national law inside France, there would be a powerful reply from French users and authorities. The converse is likewise true: the findings of a French court are not applicable to the remainder of the world. Such a scheme would set a precedent that any nation could enforce their laws, morals, financial demands, or social constructs upon any another nation by the method of blocking DNS names, and thus blocking communication and content.
Therefore, this earth blocking method is entirely unworkable for us as a resolution to be compliant alongside the court order.
What is “France” from the viewpoint of the internet?
There are additional crucial reasons geoIP blocking volition not work. We already prevailed in a akin lawful case in Germany in 2021-2023 in which we learned an crucial lesson: we tried to use geoIP blocking as a “hack” in a akin circumstance at the commencement of the lawful proceedings, allowing us to continue services in Germany until the case concluded. The plaintiff (Sony Music Entertainment GmbH) afterward used a VPN to admission the blocked satisfied from Germany in circumvention of the geoIP blocking. The court accepted alongside Sony in their assertions of noncompliance, and we were fined for disdain of court.
From this experience, we cognize that the geoIP-based example is not lone unfit from a specialized perspective, but we have proven, historic evidence that using geoIP methods results in fines being levied against us by courts. To any technology-aware person, this seems ridiculous and outrageous – but this is what we visage in these lawsuits anywhere there is a disconnect between the courts’ understanding and how (and why) the specialized protocols of the net really operate. We cannot hazard this negative outcome in this or any another forthcoming instance, as ridiculous decisions apparently are de rigueur in these cases.
We eventually won that case against Sony, but it took multiple years, six figures of disbursal to Quad9, and enormous wasted period – all of which set us rear in our capability to provision services and is a asset debt we are motionless paying for today. This case is fair additional of the identical – the opposition has additional lawyers than we have prosperity and time.
The decision of Quad9
Given these conditions and hence of our unwavering mission, our historic experience, our desire to remain inside the law, and the outcome of the court decision, we are remaining alongside an uncomfortable choice.
The demands guide us to an unattainable requirement: we must adhere to the court’s decision, or we visage expanding risks to our existence. However, in implementing the blocking, we must either broaden French law to the entire earth (blocking globally) or create a exposure circumstance whereby we continue to be at hazard since the accessible specialized methods are imprecise, unattainable to validate, and do not encounter any person privacy and safety requirements.
This leads us to the lone decision we can comprehend to eliminate our lawful hazard and keep us true to our mission: we must create our cybersecurity safety and broad services unavailable to French users. Our departure is scheduled for November 24, 2026.
In any event, for Quad9, this is a matter of regulation concerning the possible misuse of these types of blocking measures. Allowing personal corporations to have the capability to obstacle what is seen on the net seems to us to be a hazardous and infinitely profound problem. Actions that appear sensible and infrequent today volition tomorrow rotate into an avalanche of petty demands used to suppress political, religious, economic, or social outcomes. We volition not be equal a small part of that degradation of the liberty of knowledge. Once the tools of censorship are built, they are rarely used sparingly or justly.
This case alongside beIN is not the lone litigation we visage in France. There are about 20 distinct lawsuits pending against Quad9 (and another recursive resolver operators) that petition we comply alongside blocking hundreds of distinct names. We anticipate many of them to escalate to the identical conditions as we have seen alongside beIN, which puts Quad9 at hazard despite of the outcome of this case.
Based on the generalized, high-level traffic data we keep, we cognize we have many users in France. With our departure, those users volition be put at hazard from the threats we have protected them from for nearly 9 years. We deeply regret that result, but we have no another choice. Below is a partial catalog of the networks from which we see traffic in France. You volition see many infrastructure, national security, finance, education, and another networks of crucial importance in supplement to ISP users and mobile users. All these users volition endure assistance on November 24 since of the lawful risks facing Quad9 in France.
What is the intent of this entire lawsuit, anyway?
The most troubling part of this decision is that it is ineffective in practice. Forcing Quad9 to obstacle domain names does not obtain the satisfied out of circulation and has no consequence on the servers that home the data.
We recommendation a liberated service, and there are thousands of another open DNS systems that do what Quad9 does but alongside lesser trust, safety, and reliability. Users seeking blocked satisfied volition merely change their DNS to use one of those another liberated services, perchance using systems in another nations that have less-than-honorable intentions from a privacy and safety perspective. This is akin holding a part of newspaper in forefront of a stadium complete of group to obstacle the perspective of a concert. It is an unsolvable issue via recursive DNS, and the consequence of lawful rulings akin this is not measurable exterior of the amounts paid to lawyers and the figure of words in media releases declaring hollow victory.
Even beIN volition not see any changes. Perhaps that is understood and the cruelty may be the item - we cannot say alongside certainty why specified expenditures have been made against a small nonprofit akin Quad9, which tries lone to bring safer, trusted assistance to users. But of this we are certain: these actions are a tragic discarded of period and resources and create a real, negative outcome for the net community of France, whether or not they are our users.
What we are doing on November 24
Quad9 volition not obstacle the domains in inquiry - we desire to remain committed to our integrity of providing a complete perspective of the DNS for users who desire that service. However, starting on November 24, we volition no longer assist French users, thus keeping Quad9 out of danger from similar, perchance equal larger risks in the future. Our anticipation is that 30 days volition be adequate period for conversion, although we regret that this communication volition undoubtedly not attain several users in time.
An petition is pending, and we volition continue to legally defend our stance in court in this case and as many another cases as we are able. We volition continue to oppose court-ordered DNS blocking of this nature everywhere. Our resources are limited, but we are resolute to keep the net open and free. You can donate here to assistance us continue to provision on our goal and assistance us in the lawful expenses we incur in this and another fights.
What you can do next
We think this issue is reversible. French citizens: inform your legislators that looking up names is not a offender offense. The net needs to remain open and openly accessible to anyone, and neutral intermediaries akin Quad9 (or any DNS resolver) should not be implicated in lawful proceedings since we map names to IP addresses. Further, we cognize there are possible plans in deliberation in France (and another European nations) to provision personal corporations and others automated and unvalidated abilities to display DNS satisfied that they solitary decide to be unwanted, making it imaginable for a broad range of badly-managed or anti-democratic activities to be implemented. We accept you differ alongside this as much as we do. Make yourself heard, or you volition endure your entitlements silently.
ARCOM is your regulatory authority, and you should inform them this precedent places France at hazard the two from a applicable and strategic perspective.
Let them cognize that under their mandate, they have to balance your digital entitlements as citizens as fine as the audiovisual entitlements on sports event broadcasts of entitlements holders. Balance cannot be claimed whenever the privacy and safety of digital users are the collateral damage.
In conclusion
Fighting piracy via DNS resolvers blocking is ineffective. It is disproportionate and misguided, ill-fitted and futile to combat piracy, as the origin satisfied remains entirely accessible to resurge under another name. Forcing Quad9 to depart harms French digital scheme and sovereignty in the lengthy run relating to security, privacy, and integrity - contradicting France’s supreme national interests in toggle for a short-term, imaginary business victory.
We deeply regret that we must depart our French users without cybersecurity protection, but we anticipation the forthcoming volition see a additional sensible explanation of the law which allows us to return.
Sincerely,
The Quad9 Team
* This article was authored and translated into French by humans on the Quad9 Team
Partial List of French Networks Using Quad9
This catalog is extracted from network metrics of an hr or so of representative usage. Quad9 tracks network autonomous systems figure origins as per our privacy policy, but we do not acknowledge idiosyncratic IP addresses or users inside those networks. There are hundreds of additional French networks using Quad9; we picked lone these at random to display the breadth of usage. Autonomous systems are not exclusively geographically-mapped and cannot be used as a jurisdictional identifier; although it is harmless to say that most of these networks have a important part of their person basis in France.
National authorities & community agencies 60855 — Direction interministérielle du numérique (DINUM) — Prime Minister’s digital directorate; sets province digital scheme and runs the interministerial province network (RIE). 43717 — Business France (EPIC) — National agency that helps French firms export and attracts abroad investment. 205461 — France Travail (EPA; formerly Pôle emploi) — National community occupation service: job placement, jobseeker support, unemployment advantage payment. 777 — CEA Paris-Saclay (EPIC) — Saclay centre of the Commissariat à l’énergie atomique et aux énergies alternatives; community investigation in nuclear and substitute energy, defence and health technology. 44850 — Institut de recherche spill le développement (IRD; EPST) — Public investigation institute operating alongside Global South partners on health, surroundings and social sciences. 29110 — Institut Pasteur (private foundation, recognised as community utility) — Non-profit biomedical investigation basis in Paris (infectious diseases, vaccines, microbiology); hosts national citation centres.
Research & learning network 1307, 1712, 1715, 1942, 1945, 2060, 2094, 2198, 2200, 2202, 2259, 2269, 2457, 2470, 2472 — RENATER (GIP) — National investigation and learning network; its members are the State and community investigation bodies.
Student-run evidence networks 204515 — Crans (association) — ENS Paris-Saclay pupil network affiliation providing connectivity, hosting and email to members. 212424 — ViaRézo (Association des réseaux de CentraleSupélec) — Student affiliation providing net and IT services on the CentraleSupélec campus. 207849 — ESIEESPACE — ESIEE Paris pupil association that runs OpenGate, a pupil non-profit ISP.
Private education 56339 — IONIS Education Group (SAS) — Private for-profit higher-education collection (EPITA, Epitech, ESME, IPSA, ISG, Sup’Biotech).
Regional & local government 208458 — Région Nouvelle-Aquitaine — Regional authority covering 12 départements; place in Bordeaux; created 2016. 208820 — Département de la Seine-Saint-Denis — Île-de-France département; assembly seated in Bobigny. 50036 — Département des Pyrénées-Atlantiques — Nouvelle-Aquitaine département; assembly seated in Pau. 34000 — Département des Bouches-du-Rhône — Departmental council. 48799 — Ville et Eurométropole de Strasbourg — Shared administration of the City of Strasbourg and the 33-commune Eurométropole. 204897 — Grand Besançon Métropole — Communauté urbaine of 67 communes about Besançon. 208574 — Communauté de communes du Pays de Bitche — Intercommunal build of 46 communes in Moselle; owns the Tubéo community fibre-to-the-home network. 202834 — Commune d’Échirolles — Commune south of Grenoble; associate of Grenoble-Alpes Métropole. 211127 — SITPI (Syndicat intercommunal spill les télécommunications et les prestations informatiques) — Ten Grenoble-area communes pooling telecom, IT and GIS services.
Public digital infrastructure (local-authority networks & IT) 200245 — Manche Numérique (syndicat mixte) — Builds the Manche fiber network; provides IT, e-administration and telecom services to local authorities. 44842 — Somme Numérique (syndicat mixte) — Owns the Somme fiber network; provides digital services to local authorities and schools. 214589 — Essonne Numérique (syndicat mixte ouvert) — Essonne community fiber network, affirmative interconnection, hosting and data-centre services for community sites. 47608 — Gigalis (GIP) — Pays de la Loire local fiber network for local authorities, health, emergency services and schools. 41114, 62038 — Orne THD (SPL) — Company owned by Rombas and neighbouring communes in Moselle; sells fiber net and TV complete their networks. 39271 — C’Chartres Innovations Numériques (SEM) — Chartres Métropole business operating fibre, a personal 5G network, a data centre and IT services. 207430 — SITEC, Société informatique et télématique corse (SEM; Collectivité de Corse 56%) — Hosting, cloud, cybersecurity and IT services for Corsican community bodies. 50547 — Régie du réseau câblé du Haut Sundgau (local-authority régie) — Public wired telecom network in southernmost Alsace. 49011 — MACS THD (SASU, SFR group) — Private business operating the Maremne-Adour-Côte-Sud (Landes) high-speed network under a public-service concession.
Energy & utilities 1301 — Électricité de France (EDF; 100% state-owned) — National power manufacturer and supplier; operates France’s nuclear fleet. 62141 — Compagnie nationale du Rhône (CNR; bulk community shareholding, Engie citation shareholder) — Holds the Rhône concession: hydroelectric dams, navigation and irrigation, affirmative breeze and solar. 39830 — Teréga (private SA; formerly TIGF) — Gas transfer and underground retention controller for south-west France. 43734 — UEM (local SEM; formerly Usine d’électricité de Metz) — Metz utility: electricity, gas, district heating, community lighting. 12727, 42487, 208719 — Vialis (SEM; Colmar largest shareholder) — Colmar utility: power and gas affirmative cable TV, net and fibre. 204645 — Régie ENES (Régie municipale d’électricité de Creutzwald) — Municipal régie: electricity, fiber internet, local TV, district heating.
Transport 203885 — SNCF (Société nationale SNCF SA; state-owned) — Parent holding business of the national railway group. 34809 — Sanef (SA; Abertis subsidiary) — Motorway concession controller for northern and east France.
Health 201659 — AP-HM (Assistance Publique – Hôpitaux de Marseille) — Marseille’s community university hospital group. 51588 — SESAN (GIP) — Île-de-France local build providing shared digital-health services to attention providers. 49692 — Compagnie Générale de Santé (SAS; private) — Name of the hospital collection now called Ramsay Santé.
Broadcast & media 24843, 43930 — France Télévisions (state-owned SA) — National public-service tv broadcaster. 43646 — TDF (SASU; owned by infrastructure funds) — Broadcast transfer and tower infrastructure operator.
Private industry & technology 29104 — Thales Services Numériques (SAS; Thales group) — IT services, cloud, safety operations and integration for defence, area and public-sector clients. 49068 — Stormshield (SAS; Airbus Defence and Space) — Cybersecurity vendor (firewalls, endpoint protection, encryption); ANSSI-qualified products. 57226 — IDEMIA Identity & Security France (SAS) — Identity documents, biometric acknowledgment and border/access systems; formerly Safran Morpho. 41935 — Dassault Systèmes (SE; listed) — 3D scheme and simulation application (CATIA, SOLIDWORKS); not Dassault Aviation. 42924 — VINCI Construction SI (SNC) — In-house IT component of VINCI Construction. 201647 — SI-nerGIE (GIE of Orano and Framatome) — Shared IT operations for the two companies: data centres and local support. 49920 — Flowbird (SAS) — Maker of parking meters and transit ticketing systems. 20493 — Viparis Le Palais des Congrès de Paris (SA; 50/50 CCI Paris Île-de-France and Unibail-Rodamco-Westfield) — Operates the Palais des Congrès gathering centre.
