When the Toronto-based tech company Tucows Inc. discovered it was providing domain registration services to the Pakistani Taliban, it immediately contacted the RCMP for guidance.
Days later, it was still waiting for a response.
By Tuesday, it had waited long enough and took action on its own, disabling the website’s domain.
The site was one of two using the services of Tucows that were propaganda arms of outlawed terrorist organizations — Tehrik-e-Taliban Pakistan (TTP) and al-Qaeda in the Indian Subcontinent (AQIS).
Although such cases are rare, Tucows said that when they did occur, before taking sites down it notified police “to see if that action is going to disrupt anything that they’re up to.”
“That, I would say, takes longer than we like,” said Graeme Bunton, head of policy at Tucows.
The RCMP declined to comment on the websites.
“National security investigative work is complex by nature and the review of requests, referrals and other material must be done in an appropriate manner,” Cpl. Caroline Duval said.
In the wake of last year’s New Zealand terrorist attack, the Canadian government vowed to crack down on extremist and terrorist internet content, which it blamed for “abhorrent violence and carnage.”
Again during the 2019 federal election, Prime Minister Justin Trudeau promised in his platform book to deal with online extremism, including the “distribution of terrorist propaganda.”
Mary-Liz Power, a spokesperson for Public Safety Minister Bill Blair, said in a statement the government worked with the technology sector “to strengthen our resilience to extremism and keep Canadians safe.”
But it was the Washington-based Middle East Media Research Institute (MEMRI) that first identified the al-Qaeda and Pakistani Taliban sites and their use of a Canadian domain registrar.
In a July 24 report, MEMRI looked under the hood of the website Nawai Ghazwa-e-Hind, and found it had been registered through Tucows on March 20, 2020 and served as the distribution platform for the propaganda magazine of al-Qaeda’s South Asia branch.
Previously called the Voice of Afghan Jihad, the magazine was rebranded Nawai Ghazwa-e-Hind, which means “The Voice of War in the Indian subcontinent” in Pakistan’s national language Urdu.
With a broader ambition and a new website, it was relaunched five months ago and featured accounts of al-Qaeda attacks on Afghan, U.S. and Pakistani forces, tributes to dead al-Qaeda leaders, calls to fight and discussion of Salafi jihadist ideology.
On the AQIS site, Osama bin Laden and the 9/11 attacks were called “blessed,” Christians were described as “dogs,” and Jews were “the worst creatures.”
“I believe this magazine is important for the group’s internal cohesion and politics with rival jihadists,” said Asfandyar Mir, a South Asia analyst at Stanford University’s Center for International Security and Cooperation.
As well as being registered by Tucows, MEMRI found the site was protected by Cloudflare, a proxy service in Texas. After MEMRI released its report, Cloudflare contacted the Washington-based research group for more information.
“And we also worked with the Canadian government to provide further information that they were seeking,” MEMRI deputy director Elliot Zweig said in an interview.
But a Tucows spokesperson said the company was unaware it was the registrar of the AQIS site until it was contacted by Global News on July 30. Upon learning of the site, Tucows said it alerted Cloudflare and contacted police.
“These cases the first thing we typically do is we notify law enforcement. For us that is primarily the RCMP and the FBI. And we give them a heads up that this has been reported to us and that we’d like to take it down,” said Bunton.
The company was not required to notify police, but wanted to make sure that it would not be disrupting police operations by disabling the site’s domain name.
RCMP documents released under the Access to Information Act also indicate that it attempted to work with companies “to request removal of content, by carefully weighing the risk of leaving content on the site against the risk of removing content and negatively impacting an investigation.”
But the RCMP took its time responding.
“We don’t enjoy being on the hook for them to follow that process. And we’re continually trying to figure out ways to optimize that so that we can avoid disrupting law enforcement activities while also still not on the hook for providing that service,” Bunton said.
Tucows said it was was still waiting for a response when AQIS registered a new website with the company on June 30, this time using a .net suffix, and moved its content there.
The two AQIS sites were eventually taken down by Cloudflare, Bunton said. Cloudflare would not confirm it had removed them, but said in a statement it was “committed to complying with our legal obligations, including those that prohibit us from doing business with sanctioned parties like foreign terrorist organizations.”
It was about a week before the RCMP finally got back to Tucows and indicated there was no reason to keep the sites online, Bunton said. Tucows subsequently disabled the two AQIS domain names.
Meanwhile, MEMRI reported on Aug. 6 that Tucows had also registered the website Umar Media TTP, which it described as the “publishing arm” of Tehrik-e-Taliban Pakistan.
The TTP site justified suicide attacks as “legitimate” and “an effective weapon,” rejected democracy and advocated for “armed struggle for the establishment of Islam and its rule.”
Bunton said the company again only learned of the site from Global News. It then contacted the RCMP but was still waiting for a response on Tuesday when it decided to take action on its own, disabling the domain name.
In Canada’s National Strategy on Countering Radicalization the Violence, the government said one of its priorities was to work with tech companies “to reduce the impact of terrorist and violent extremist content online.”
But Bunton said in the future the company may simply give police a window to respond, possibly within 48 to 72 hours.
“It could be that we find ourselves in a spot where this is untenable and our solution is just, ‘We’re going to take it down, if that is disruptive for you, that’s too bad, you could have given us a heads-up,’” he said.
One solution could be for police to tell the company which sites not to take down, “but of course that would expose to us what they’re looking at and monitoring,” Bunton said.
“So I don’t have a good solution for that at the moment, but we’re certainly always trying to discuss with law enforcement better ways to do these things. There’s been no immediate solution presented.”
Located in a former industrial building in Toronto’s Liberty Village, Tucows is the world’s second-largest registrar of web domain names. It is not a web host, so it cannot remove content from the internet, but it can disable domain names.
Tucows is a signatory to the Domain Name System abuse framework, which says certain website content abuses are “so egregious” that registration companies should take action, even without a court order.
“Specific and credible incitement to violence” is one of those abuses.
But when websites are linked to groups not on Canada’s list of terrorist organizations, the role of companies like Tucows becomes more difficult, Bunton said.
Tucows is also listed as the registrar for Stormfront, the white nationalist website founded by former Louisiana Ku Klux Klan leader Don Black. According to the Southern Poverty Law Centre, registered users of the site “have been behind almost 100 murders.”
But Stormfront is not a listed terrorist group.
“Content issues, in particular, are thorny and difficult,” Bunton said, adding a key question is who is best placed to deal with problematic content.
“This is something we think about and struggle with a lot. And there really hasn’t been, I think, enough public debate and discussion about who we want to empower to remove things from the internet,” he said.
He said there was a sense that governments are “abdicating a bit of responsibility here because it’s a thorny issue, that they don’t really want to regulate speech. Do we have an obligation to step into that gap? And if so, how do we do that?”
The RCMP said that for operational reasons it “does not name groups, websites or individuals that may or may not be the subject of an investigation.”
A spokesperson said a judge can “order the removal of terrorist propaganda stored on and made available to the public through a computer system that is within the court’s jurisdiction.”
Police have also “engaged online platforms on a case-by-case basis to request removal of content, and has sought preservation orders to use communications as evidence in criminal proceedings,” Catherine Fortin said.
While terrorist websites can resurface, MEMRI said it was vital to keep after them.
“Certainly, we’ve always felt that it’s important that it be difficult for this type of content to be accessed,” Zweig said.
Not only was it illegal, he said, but it was difficult to imagine the rise of a group like the so-called Islamic State without it having exploited Western technology services.
“So we provide the service. We bridge the language gap. We make it known what this content is. And we hope that between the companies themselves, as well as government regulating bodies, that the content will be removed and not be able to be accessed by Western audiences,” Zweig said.
“I think it’s important to make things as difficult as possible,” he added. “If you make it difficult, then it’s less likely that somebody is going to follow them from site to site to site. It’s not a panacea, but hopefully the damage will be lessened as a result of those efforts.”
Stewart.Bell@globalnews.ca