From Freiheit statt Angst!
This page is about IRSeeK, a Full-Text Search Engine for public IRC conversations, and the story of the rising resistance of the community.
IRSeek service back online
As of January 4th 2008, IRSeek service has been brought back up following several modifications requested and suggested by the community.
IRSeeK shut down!
Since 2007-12-02 (09:30 CET at least) the website of the project, http://www.irseek.com, states:
The site is currently experiencing problems, please try again later.
A member of the Drupal community (chx) had the chance to call Ariel Berkman, CTO of IRSeeK, and had a nice talk with him. He said that IRSeeK will be down until further notice.
IRSeeK won't quit completely but wants to work with the community and networks on clearing out issues like anonymizing of the conversations and making the bots recognizable. On the accusation of covert operation, Berkman said they had used Tor to avoid IP restrictions of the networks.
What is IRSeeK?
IRSeeK is logging every spoken word of mostly popular IRC channels. On their website http://www.irseek.com/ one can search for nicknames and keywords and view the logged conversations. Private chats (Queries) between two chatters are not affected.
The goal is to archive the knowledge of support channels, making it possible to access solutions to previous issues. The problem that we have with that is, that anonymity is not taken care of enough and the bots can't distinguish between private and public conversation in channels.
Who is logged?
According to TechCrunch there have already been about 300 million conversations logged. About 2000 Channels in 10 networks are affected by that, including EFnet, DALnet, Freenode, QuakeNet and Undernet. (30.11.2007).
How is logged?
Analysis of logs of several channels reveal that the bots operate through the Tor anonymising network. This makes it especially hard to spot them. On requests to disclose the client's version via the CTCP protocol the bots say they would be mIRC clients.
How can one protect themself?
Without one of those bots in the channel this logging does not occur. However, it is not easy to spot them especially if the channel has a large amount of users.
What are IRC networks doing against it?
Freenode's demands to IRSeeK are:
- remove all previous logs
- make the bots easily identifiable and on a OPT-IN basis only
- make it easy for a channel owner to part a irseek bot from a channel should he/she change their mind
- its heavily advertised on join of a channel that it is being logged
Additionally, Freenode wants a public apology to all their affected users.
- 01.12.2007 01:17 CET
- Freenode takes first actions. Via a Global Notice they announce the banning of non-gpg Tor connections because of systematic abuse of the network.
- Spotted bots on Freenode can be reported to Freenode Staff
- 01.12.2007 20:35 CET
- Freenode makes an official statement in #irseek-victims.
- Christel, Freenode Head of Staff, states that they take the 'thread' seriously and are in contact with IRSeeK, leaving the possibilty to take further legal actions against them. All normal Tor connections have been blocked. Users of freenode's gpg-tor service are not affected.
- This is an excerpt of the conversation
<jessekeys> christel: what's freenode official position to the issue? <Michitux> and are there already any reactions from irseek? <christel> i am sure most of you are aware of our policies, in particular regarding public logging <christel> so we are, to say the least appalled and shocked to learn about the site <Michitux> some of us mailed them and demanded the stop of the logging in their channels and the deletion of the logs (or the logs of their nicks), but until now there is, afaik, no response <cerridwen> my problem is, he thinks, we should not only concentrate us on irseek, because there might be more <christel> we've been in contact with them and requested that they stop logging on freenode asap and requested removal of all logs <christel> theyve asked to have until tomorrow to formulate a response <christel> in the meantime, we've had no choice but to make the unfortunate decision to block new tor connections to prevent more of their bots from joining, and are killing off those we see <jessekeys> christel: nice <christel> unless they adhere to our requests i will be speaking with our lawyers on monday to see if they may respond better to a letter from a legal representative <christel> we had similar problems in the past, most recently with a site called ircarc, however, unlike irseek their bots were easily identified and were easy to block on connect <jessekeys> christel: i'm glad to hear that freenode takes it seriously <christel> irseek however goes to the trouble of using covert clients with no identifiers, without publishing that its a logging bot, thus making it impossible for anyone to opt-out (tho, in fairness, something like that should be on a opt-in basis only) <christel> jessekeys: well, we have policies in place for a reason, and i for one am pretty appalled that they have nil respect for privacy, in addition to attempting to make a profit of other peoples conversations <Michitux> i read at least one blog where the author told he asked them to log his channel, too <jessekeys> christel: that they try to hide is the most disturbing fact imo <christel> jessekeys: yeah, i very much agree there, if anything it only serves to make it look as though they are aware they are deliberately in breach of policy and dont care <jessekeys> christel: thanks for the clarification, is this an official statement that we can quote on the wiki? <christel> certainly <smg> how can i get rid of it? <smg> i don't want my sentences in irseek <christel> i will update the freenode blog (and likely also the news section of our website) tomorrow evening or monday morning when we have had a response from the irseek peopl <jessekeys> christel: i'm thrilled to hear their response. <christel> if they dont comply with the request for removal, i may also contact godaddys abuse department, it appears they host the irseek domain and from what i understand a fair few users have already done so and seem to believe that route may bear fruit
- 01.12.2007 23:00 CET
- Christel publishes a statement on the Freenode Blog.
Who is behind IRSeeK?
(Unofficial) IRC Support Channel
- English: Channel #irseek-victims at irc.freenode.net
- German: Channel #irseek-victims-de at irc.freenode.net
Press and Blogosphere
- http://www.techcrunch.com/2007/11/30/will-irseek-have-a-chilling-effect-on-irc-chat (English)
- http://www.russellbeattie.com/blog/irseeking-trouble (English)
- http://blog.laxu.de/2007/12/01/privatssphare-im-irc-oder-volltextsuche/ (Yigg it) (German)
- http://geekosphere.org/573/irseek-fragwurdiges-datamining-im-irc/ (Yigg it) (German)
- http://blog.freenode.net/?p=62 (English)
- http://yro.slashdot.org/article.pl?sid=07/12/02/1515247 (English)
- http://www.irseek.com/blog/ (English)
- http://drupal4hu.com/node/97 (English)
- http://eloxoph.com/news.html#irseek (English)
- http://pro.tweakers.net/nieuws/50656/irc-community-schrikt-van-logzoekmachine.html (Dutch)
- SearchIRC Thread "IRSeeK"
- SearchIRC Thread "More IRC spies"
Other Sites that may be logging irc
IRSeeK is not the first service of it's kind. The following may be active right now or have been caught logging in the past:
How to find these sites?
- select a nick that is not a common name (more of a handle) and one who speaks a bit in the bigger tech channels of freenode
- pop over to your favorite search engine
- put in the <handle> and irc
There are other ways to mine this info that will get more directed results, but the above method will get you most of the sites that are logging and publishing to the web.