Submitted by 7666 on

Hold on to your hats for this one, fellas. Here's an image to whet your appetite if you have the attention span of a mosquito:

I'm gonna start with a basic summary of events, a timeline, and then the meat and potatoes of today's article. First and foremost, you read the title right. Nulled LLC got a subpoena from the Department of Homeland Security, signed and validated and all, on February 16th, 2026. It was in regards to acquiring user data on a Pomf file that had been removed already by a prior abuse report which already had been subpoenaed by French authorities, which I had already willingly complied with in a separate request entirely. I'll link to those in the timeline shortly.

What followed was questions on where my position lies as both the owner of Nulled and the target of the subpoena, a very funny email reply back from a mistakenly one-shotted response from my colleague Mori on the matter, some legal consultation from a lawyer who CC's his AI to schedule meetings, and ultimately vindication of my concerns that led to me shutting down Pomf in the first place due to an incompetent government agency that seems to have forgotten how the internet actually works. I hate being justified so quickly, but you'll see what I mean in due time. Also I wrote this whole article listening to this album, so throw it on if you'd like.

https://www.youtube.com/watch?v=nQbNjdO8v_s&list=PLfo7rU6KgPU983YqZ3EBYLUdG0MLz0njn

Here is a timeline of critical events. Please reference this as you go through if anything doesn't chronologically make sense, as there were a lot of things that happened.

  • February 9th, 2026: I get a heads up from a good samaritan that an ISIS video is circulating Pomf. It is removed the same day. https://ghostbin.lain.la/paste/xbj7m
  • February 10th, 2026: A French Subpoena comes in asking for materials on the video. This is a new one for me. The subpoena and response is here, but it wasn't anything crazy and I didn't mind helping because A. the file broke my ToS and B. I barely had anything anyway: https://ghostbin.lain.la/paste/czky4/raw
  • February 16th, 2026: The Subpoena from a Christophe D Benoit, Foreign Service National Investigator (FSN-I), hits the Nulled abuse mailbox. At this period in the acquisition, I did not have access to any mail services yet (Thanks Jade, molasses moves at lightspeed compared to your ass) so Mori sees this first. The due date on the subpoena is February 27th.
  • February 17th, 2026: Mori replies to the email with a generic "We don't have this information" reply (which is true - Nulled and Lain.la are NOT the same thing).
  • February 18th, 2026: I consult a lawyer, a Mr. Charles Mudd, on how to handle this subpoena properly via email. We set some time up the next day to discuss.
  • February 19th, 2026: I have a phone call with Mr. Mudd and we hash out the details on how to handle these subpoenas as well as creating a policy on how to handle these in the future on my own.
  • February 20th, 2026: Mr. Benoit replies back with a really interesting, up-his-own-ass reply to Mori's email, which is then attempted to be recalled an hour later. I guess he regretted what he said. As we don't use Microsoft products, recalling does not work, and just serves to make the sender a laughing stock as I remain in full possession of his reply, and soon you will be too.
  • February 20th, 2026: Using the guidance received from Mr. Mudd, I craft a reply back to Mr. Benoit later that night and it is sent via Mori's functioning Nulled email address, with a section of the reply as the owner of Nulled with the legal language provided by Mr. Mudd, and a second section as the owner of Lain.la restating what I stated for the French subpoena. 
  • March 27th, 2026: One month beyond the due date of the subpoena passes, and I publish this nifty article! I wasn't obligated to wait exactly a month, I just did because these take some time to write, you know?

Now with that out of the way, here is the list of very, very interesting sections to peruse, all of them with the same sort of vigor you'd expect from my scathing criticisms of entities who seem apt at displaying their incompetence or inconveniencing me unjustly in some way, shape or form, and full disclosure of all materials regardless of any scary, unenforceable language tacked on to the materials provided:

Section A: The French Subpoena

This whole saga started with a subpoena from France to the Lain.la abuse mailbox. Well, really it started with the abuse report on the file itself, but those are routine and nothing special occurred there except the reporter was new. The subpoena is what started it all. Here is the link again to the original abuse report, and my response to the subpoena, and a re-upload of the original subpoena here at my new static hosting page. For the record, I have no issue with this subpoena and the way it was provided to me, and the request was reasonable. Mr Adrien Sibille of OFAC, a French government organization I have worked with on many, many occasions, presented me with a request to the correct mailbox and it was quite simple. "Please give us the data on who uploaded this file." That was pretty much it. No problem at all!

I got this foam baguette from Mori as a gift for this ordeal.

I replied with the information that I had, which, in line with my privacy policy, was damn near zero. However, doing my research into the French incident, I realized that they were probably under the impression the idiot kid who did a bomb threat to his school or whatever uploaded the file. The information I do maintain on Pomf consists of a timestamp, hash, and the original file name of the file prior to it being transformed into a randomized Pomf link. These pieces of evidence were actually enough to suggest the kid did NOT upload the file and just found it and used it, because it was uploaded years ago and was actually a reupload from another site entirely. Reference my response for the details there. So even though I didn't have the information they requested, I did have the information they actually needed, and I produced that beyond my obligation to the subpoena. You'd think that'd be more than enough and they'd go about their merry business. Either they didn't get the email, or bureaucracy has strange ways of screwing up...

Section B: The American (French) Subpoena

On the 16th of February, the American subpoena, from the Department of Homeland Security, comes in to the Nulled abuse mailbox. It requests data around the specific file in question again, but in far greater scope, none of which I have (and by extension Nulled), and all of which could have been ascertained from my response to the French subpoena. Now I'm starting to get a little pissy, because I have an innate dislike of people asking the same question twice, and not understanding how my service or a hosting provider works before stuffing their email in my mailbox. In addition, this is the real deal. This is a properly signed and formatted subpoena from a US three letter agency. That's about as bad as it gets. You screw this up and the feds come knocking, and considering the current situation in the great US of A, that experience will have an enjoyability factor on a scale of "extremely inconvenient" to "Waco".

The super secret "please don't share it please please please" subpoena is linked here in full.


This was my favorite part of the email I got. Everything else sucked.

Let's break this subpoena down a bit with a few findings:

  • Mr. Benoit is located in France. Do you think maybe he could have taken a stroll down the street and had a chat with OFAC before wasting my time, maybe?
  • The digital signature section in blue at the bottom of the second page is certainly interesting.
  • "All customer or subscriber account information for any or all accounts registered to or associated with the user that posted the following link linked with the following IP address" Yeah I literally have none of this and never did per my policies and never did Nulled.
  • "For each such account the information shall include the following: All names, addresses, screen names, email addresses, and telephone numbers of all users, customers, or subscribers Recent IP connection records Service and billing address information for account to include any or all alternative billing address information Registered phone number to account Length of service (including start date) and types of services utilized Means of source of payment for such service (including any credit card or account number) Other subscriber numbers or identities (including temporarily assigned network addresses and registration Internet Protocol ("IP") addresses (including carrier grade natting addresses or ports))" So he thinks Nulled is a traditional ISP. I mean, technically we are, but we're not using CGNAT or anything, and he's lost the idea that this is not a single layer of "user generated content" deep, it's two. Nulled provides services to customers, and customers have users of their own. ISPs just have customers/users in one layer generally, although if you consider the humble coffee shop who has free WiFi or college campus who has raucous students, that's the same idea applied to different service models.

So this whole thing overlaps with the French subpoena but tacks on specific ISP provisions, none of which Nulled would have, and none of which Lain.la ever had to begin with. It's an utterly superfluous subpoena, but still has all the compelling elements of one and consequences of not abiding by. Great!

Section C: The First Response, Their Reply, and Subsequent Attempt at Recall

In a momentary lapse of reason, Mori replied with a relatively short reply back to Christophe. I had to remind Mori that Nulled does not talk to the feds without bulletproof legal advice minimizing risk to the company and by extension ourselves. That shouldn't happen again. But, I'm glad it did, because it caused Mr. Benoit to conduct an unforced error of hilarious proportions.

First, Mori's email is here.

Now, Mr. Benoit's reply is here. This one is gold.

And then the kicker!

Maybe threatening a hosting provider and calling them a McDonald's didn't fly with the CC'ed individuals. I know it certainly didn't fly with me. Enter, Charles Mudd.

Section D: The Consultation

Mr. Charles Mudd is an interesting person, to say the least. He will be Nulled's lawyer of choice going forward for thorny issues such as these. You can read about him here. Suffice it to say, we were able to come up with exactly what we needed to respond to this subpoena, and because I prefer to get as much bang for my buck as I can (and many bucks were spent), I also requested language that I can re-use in the future and procedural guidance on how to handle future incidents like these, as well as what our customers' should expect from us when it comes to subpoena handling. I should only need to contact him for new issues rather than additional subpoenas of this nature.

In short, we came to a few conclusions together:

  • There is specific language to use when replying to these subpoenas.
  • Redirect the request to the entity (customer) that actually has this data, if you don't have the data requested.
  • If the requestor cannot identify a method to contact the customer, you may be compelled to provide that data from customer records such as billing.
  • Put language in your Terms of Service to make it very clear how these subpoenas are to be handled by Nulled.

In the interest of transparency and helping out any other hosting provider who may be the target of such a subpoena, the form language is as such:

Dear <Three Letter Agency That Glows So Bright>:

 

I received your email dated <date> with the subject <subject> and the accompanying attached subpoena and related documents.  As a hosting provider, <company> provides services and capacity to third party customers.  As such, with respect to the information sought by your subpoena, <company> does not possess any responsive information apart from certain identifying information related to the applicable customer.

With that said, we will have provided notice and forwarded your subpoena and related documents to the applicable customer.  Our notice will inform the customer that, absent receiving a file-stamped court filing in the form of a motion to quash or equivalent on or before <subpoena due date>, <company> will disclose the customer's identifying information in our possession to you. Should we receive a file-stamped copy of a motion to quash or equivalent on or before the deadline, we shall inform you of the filings. Thereafter, we shall not disclose or produce the customer's identifying information in our possession absent a final court ruling ordering such disclosure.  

Additionally, we shall inform the customer that, although we cannot provide legal advice, we recommend that all relevant information be preserved and consultation with legal counsel be sought.

Should you have any questions, please do not hesitate to respond to this email.

 

Your fill-ins are bolded above. Use as you wish, I paid good money for the damn thing, and since a month has passed and ICE hasn't busted down my door, I think it worked.

Section E: My "Final Nail in the Coffin" Reply

Well, I suggest you go on over to this Ghostbin link, because this is what I sent to Mr. Benoit myself. It contains two parts, myself acting as the owner of Nulled enriched with the legalese provided by Mr. Mudd, and myself acting as the operator of Lain.la which was largely a restatement of what I sent to OFAC. I really hope Mr. Benoit liked the last line, as far as a meandering midwit faguette can enjoy humor, anyway.

Section F: The Implications and Effects of Our First Subpoena

Yeah, you see this part of the new Nulled ToS? This is why that is there now. If you are a customer hosting something publicly: GO ADD AN ABUSE EMAIL TO YOUR SITE!

It should be stated that this subpoena is a remarkable event in the history of Nulled and in the history of Lain.la. Not only did we get our first very much official subpoena, but we got to see the incompetence of the Department of Homeland Security in full force, such as:

  • Submitting an utterly duplicate request from the actual requesting government entity but with US government muscle (and potential consequences) behind it
  • Threatening a hosting provider with being complicit in terrorism despite multiple court cases absolving hosting providers from being responsible for what their customers/users post
  • Comparing Nulled to a McDonalds
  • Recalling the above two items after (assumedly) getting a slap on the wrist for going full mask-off in an email chain

For those of you who read my blog post on why Pomf was shutting down temporarily - I predicted this. That an army of incompetent fools would threaten Pomf's existence not because Pomf is in breach of the law or anything of that nature, but because interpretations and procedures can be wielded as a cudgel against anyone, including someone who just fucking hosts other people's files on the internet. The line from that article which was written a mere TWO WEEKS prior to the receipt of this subpoena "These days, you'd be a fool not to at least wargame out how you would handle a potential federal or state intervention or character assassination and make preparations to counter it, even if you don't think you are vulnerable or special." is so incredibly relevant, because I called that it would happen, and it did. What happens if Mr. Benoit stumbles upon this article and raises hell, stifling my freedom of speech under the First Amendment? How many tens of thousands of dollars and dozens of hours of time will I need to spend to dispel frivolous claims from a scorned low-level official in a foreign office? What happens if it happens to you? That is the world we live in today. The US government is now part of your threat model whether you like it or not, and when the Benoits come knocking, you can either be prepared and arm yourself with the knowledge and implements to protect yourself, or you can get caught with your pants down and end up staring down the long, corrupt arm of "the law", whatever that means these days.

I know as the owner of Nulled, I will be fully aware of this reality going forward, and the preparations I took in response to this subpoena here will cover all customers of Nulled going forward and Pomf when it returns in the far future.

-7666

Lain.la / Nulled LLC