monitored global spam activity daily, and who knew I was working on a piece about McColo.
“Krebs, what did you do ?” the source asked with a praising laugh. “I’m hardly seeing any more spam, and it looks like McColo has been unplugged from the Internet!”
I don’t recall saying thank you or good-bye—I only remember swearing loudly and slamming the receiver down to quickly dial several other sources on my mobile phone. All of them confirmed the same findings: McColo was gone, and none of its Internet address space was reachable from anywhere on the World Wide Web. Mission accomplished—for the time being.
A call to Benny Ng, Hurricane Electric’s director of marketing, revealed the reason. The ISP had severed ties with McColo that afternoon.
“We looked into it a bit, saw the size and scope of the problem you were reporting, and said ‘Holy cow!’” Ng said. “Within the hour we had terminated all of our connections to them.”
Within a few minutes of confirming the takedown, I wrote and published a blog post about the McColo outage—which quickly became one of the biggest cybercrime stories, in terms of immediate global impact, up until that date—and then began working on a longer story about the incident that was intended for publication on the Washington Post ’s site and possibly in the dead-tree edition (as the print version was affectionately known among us dot-com reporters) the following day.
I worked from my home office that evening and well into the morning, toiling over the follow-up piece until eventually falling asleep in my pajamas at the computer keyboard as I finished the story around dawn.
The piece was edited and published on washingtonpost.com later that morning, and for a brief time the story was featured “above the fold” as one of the most popular on the site that day. That is, until a lawyer for washingtonpost.com found it and went positively ballistic. Apparently, nobody had asked the lawyers for their input, and now the attorneys were clamoring for the story to be unpublished from the website until facts could be triple checked and certain language about alleged illegal activities at McColo could be toned down.
Editors at the Washington Post and other major publications typically request that a pending story be “lawyered” when it contains statements of fact or allegations that could lead to legal trouble down the road, particularly from the parties named in the story who might wish to pursue libel charges. One washingtonpost.com lawyer was extremely uncomfortable with any language that even hinted at illegal activity on the part of McColo’s owners, who had repeatedly ignored requests for comment. (To give a sense of how shady the dealings at McColo were, the sole points of contact listed on its website were anonymous instant messenger accounts.) After all, there was no evidence that anyone associated with McColo had been charged with any crime, so why were we alleging it?
(An important note: The story that ran that morning was full of links to supporting evidence of illegal goings-on at McColo, as gathered by countless security experts in the industry. Unfortunately, the washingtonpost.com lawyer who objected to it being published initially viewed the piece on her mobile phone, which had stripped out all of the hyperlinks that readers could use to view voluminous third-party reports and evidence of said criminal activity. To the attorney, the story appeared to be hurling all kinds of baseless and potentially libelous accusations at McColo, whose business at this point seemed all but ruined.)
The attorney demanded that the McColo story be pulled from the washingtonpost.com website, and after a brief period of defiance, the website news desk acquiesced without asking me whether the story was accurate or what supporting evidence I had to back up my reporting. The piece was simply yanked off the site, with no explanation to the tens of thousands of readers who found