Hosting & CloudGlossaryPart 15 of 17
Abuse, Trust and the Law Glossary
43 terms from the Hosting & Cloud book's Abuse, Trust and the Law part, each defined in a line and linked to the chapter that explains it.
- 50 Percent Rule: OFAC's rule that an entity owned 50 percent or more by blocked persons is itself blocked; control without that ownership doesn't block an entity automatically (Sanctions, Exports & Bulletproof Hosts).
- 512(a) transitory communications: the DMCA safe harbor for a conduit that carries transmissions initiated by others through an automatic technical process, with no notice-and-takedown duty because it has nothing to take down (Conduits, Caches & Blocking Orders).
- 512(b) system caching: the DMCA safe harbor for a cache that doesn't modify the material and follows the originating site's rules, removing cached copies once the origin has removed them or a court has ordered it (Conduits, Caches & Blocking Orders).
- 512(j) injunctions: the DMCA provision that lets a court enjoin an intermediary even inside a safe harbor, the route to blocking a conduit (Conduits, Caches & Blocking Orders).
- Acceptable use policy (AUP): the contract term every abuse action rests on, listing illegal content, infringement, security violations, network abuse and abuse of the provider, with a remedy clause; kept as versioned data (Abuse on Infrastructure).
- Account linking: connecting accounts through shared signals (payment fingerprint, device, phone, IP range, SSH key) so a fraud ring is acted on at once; each link is evidence with a strength, not a verdict (Free-Tier Fraud & Stolen Keys).
- AI Diffusion Rule: the BIS export rule on AI chips and model weights that was rescinded before it took effect in May 2025 (Sanctions, Exports & Bulletproof Hosts).
- Article 5n: the provision of EU Council Regulation 833/2014 barring listed services (IT consultancy, then enterprise-management and design software, including cloud delivery and updates) to the Russian government and entities established in Russia (Sanctions, Exports & Bulletproof Hosts).
- Block BEARD Act: a US Senate discussion draft of July 2025 that would let courts order blocking of foreign piracy sites by intermediaries (Conduits, Caches & Blocking Orders).
- Blocking order: a court or regulator order requiring an intermediary to stop resolving, proxying or serving named domains or IPs in a territory, modeled as a legal notice with its clock and status (Conduits, Caches & Blocking Orders).
- Bulletproof host: a provider whose product is non-enforcement; when designated, such hosts tend to rebrand and move infrastructure to new companies in other countries (Sanctions, Exports & Bulletproof Hosts).
- Containment (fraud): limiting what a new or compromised account can do, through risk quotas on GPUs, mail and egress, the third of four responses to free-tier abuse (Free-Tier Fraud & Stolen Keys).
- Continuous screening: rescreening every account against each sanctions list update and on changes to account data, catching new designations within a day (Sanctions, Exports & Bulletproof Hosts).
- Core services (abuse tier): authoritative DNS, public resolvers, registries, registrars and transit, where the possible actions (remove records, hold, refuse resolution, null-route) reach far beyond one customer and must be narrow (Abuse on Infrastructure).
- Cox v. Sony: the 2026 US Supreme Court decision that a conduit receiving infringement notices and continuing to serve a customer isn't contributorily liable for that alone (Conduits, Caches & Blocking Orders).
- Cryptomining (abuse): the dominant use of stolen and free compute, because it needs only cycles and pays immediately; containment has to be automatic because a human response is too slow (Free-Tier Fraud & Stolen Keys).
- Dynamic blocking order: a blocking order whose target list grows as rights holders report new domains and IPs, each new target carrying its own compliance clock (Conduits, Caches & Blocking Orders).
- FADPA (Foreign Anti-Digital Piracy Act): H.R. 791, introduced in January 2025 to allow site-blocking orders against intermediaries, including large DNS resolvers, with no action after referral (Conduits, Caches & Blocking Orders).
- Free-tier farming: opening many accounts to collect a free tier's allowances or credits; the quotas a new account gets are the real limit, so they belong to the risk system (Free-Tier Fraud & Stolen Keys).
- General License D-2: OFAC's license authorizing services, software and hardware incident to communications for people in Iran, which lets consumer communications and their cloud services reach them (Sanctions, Exports & Bulletproof Hosts).
- Geoblock on the proxy: refusing listed hostnames to requests from the ordering country, with a 451, the narrowest compliance with a blocking order (Conduits, Caches & Blocking Orders).
- Hosted services (abuse tier): shared hosting, VMs, object storage, static sites and managed databases, where the provider holds the content and can remove or quarantine it, suspend or terminate (Abuse on Infrastructure).
- IaaS customer identification rule: the BIS rule proposed in January 2024 under Executive Order 13984 to make US IaaS providers verify foreign customers; listed as withdrawn in December 2025, with no final rule as of October 2026 (Sanctions, Exports & Bulletproof Hosts).
- LLMjacking: using stolen cloud credentials to run hosted AI models at the victim's expense, named in Sysdig's 2024 report (Free-Tier Fraud & Stolen Keys).
- Mere conduit: the liability category for pure transmission (exchange points, access points, VPNs, DNS services and resolvers among the DSA's Recital 29 examples), which carries no duty to remove content (Abuse on Infrastructure).
- Nondisclosure order: a court order under 18 U.S.C. 2705(b) forbidding a provider to tell its customer about a request, which the provider must decide whether to challenge (Law Enforcement at Infrastructure Providers).
- OFAC (Office of Foreign Assets Control): the US Treasury office whose programs prohibit US persons from serving blocked persons on the SDN list and, under comprehensive embargoes, anyone in the embargoed region, unless licensed (Sanctions, Exports & Bulletproof Hosts).
- Own-initiative detection: scanning hosted content for known-bad hashes and phishing kits and watching compute for mining and scanning patterns, finding abuse before anyone reports it (Abuse on Infrastructure).
- Pass-through services (abuse tier): CDN, reverse proxy, WAF, DDoS protection and load balancing in front of a customer origin, which can show an interstitial, stop caching or stop proxying but can't remove the content (Abuse on Infrastructure).
- Piracy Shield: Italy's AGCOM platform under its 2023 anti-piracy law, through which rights holders report domains and IPs that intermediaries must block within 30 minutes (Conduits, Caches & Blocking Orders).
- Preservation (infrastructure): a snapshot of the named volumes and buckets into a restricted store under a legal hold, kept for the statutory period and released if no process follows, without changing the customer's resources (Law Enforcement at Infrastructure Providers).
- Quarantine policy (stolen key): a managed deny policy attached to an exposed credential that blocks launching compute, creating persistence and similar actions while legitimate reads keep working; modeled as a permission ceiling (Free-Tier Fraud & Stolen Keys).
- Redirection to the customer: asking the government to serve an enterprise customer directly rather than producing its data, a disposition only an infrastructure provider has, counted separately in transparency reports (Law Enforcement at Infrastructure Providers).
- Related-account fan-out: acting on every account linked to a confirmed fraud ring at once, with the link strength recorded (Abuse on Infrastructure).
- Resolving the identifier: turning an IP, hostname or timestamp in a request into the account that held it at that instant, minding time zones, shared addresses, pass-through services, resellers and deleted resources (Law Enforcement at Infrastructure Providers).
- Risk quotas: small limits for new and unverified accounts, especially on GPUs and mail, that cap the damage any one account can do (Free-Tier Fraud & Stolen Keys).
- SDN list (Specially Designated Nationals): OFAC's list of blocked persons that a provider screens owners and end customers against, naming the list version each screening used (Sanctions, Exports & Bulletproof Hosts).
- Secret scanning partnership: a code host's program in which token issuers register their token formats and an endpoint, so leaked credentials found in public code are reported to the issuer automatically (Free-Tier Fraud & Stolen Keys).
- Stored Communications Act ladder: the US framework of subpoena, court order and warrant for successively more sensitive records, with preservation, emergency disclosure and nondisclosure orders around it (Law Enforcement at Infrastructure Providers).
- Structured intake: reports from trusted reporters, blocklists and scanners arriving as structured feeds, so a match to a known phishing kit or malware hash can be actioned without a reviewer (Abuse on Infrastructure).
- Three tiers of service: the split of infrastructure into hosted, pass-through and core services, each with different possible actions, recorded on the resource because one account can hold all three (Abuse on Infrastructure).
- Tiered policy: acting on content only where the provider hosts it, acting on pass-through for law, safety and abuse of the provider, and resisting global blocks on core services (Abuse on Infrastructure).
- Voluntary termination: a provider ending service to a customer on its own judgment rather than under law or a report, rare and recorded with its reason as an exception to the ladder (Abuse on Infrastructure).