Due Process Required
Policy should not be constructed based on bad apples. A few bad actors having far reaching impact on everyone who owns a domain is simply entirely unreasonable. Privacy of innocent people must be protected. This is on the scale of tearing down bridges because a few people commit suicide by jumping off of them. Publicly listing addresses of anyone who fails to meet arbitrary, poorly defined criteria is has consequences for innocent people. A girl with a photography site suddenly finds herself a victim because it was easy to get her address. Is that what you want? I don't.Let me tell you a story... I found a youtube video that was going viral and I knew this was going to be big. I checked out their website and it loaded poorly. So I got curious as to why and looked it up. It was on a shared host. That isn't however, what struck me. What set off alarm bells was that the domain was registered with a street address in Utah. Not a PO box, not hidden with domain privacy options, just a street address! I emailed them to let them know. They replied and thanked me for informing them of that risk. That was Lindsey Stirling. She's now something of a hot commodity in music having won quite a few awards globally and that level of attention has high odds of drawing out crazy people. That street address in Utah would soon get unwanted fan mail and potentially have people show up to meet her in person. I don't know if that did occur, but it easily could have. Now, let's go back to the girl with her photography site. Her parents decided to support her creative outlet and allowed her to setup the site. She goes to school, has typical friends and places she likes to go. One of her photos makes it to the front page of reddit and it launches a new meme. She didn't even post it to reddit. Someone who happened across her site did it because they thought it was awesome. Someone else decides this is great and wants more and finally locate the girl's site with a reverse image search and excitedly posts the link. People check out her site, hoping for more good content they can soak up or use to pad their internet points (karma as the site calls it) and more of her pictures are linked. One of those pictures is a selfie. Now this girl, who had no idea any of this would happen just got her 15 minutes of fame. The cost? Half the kids at school now know about her site. One of them has an unrelated problem with her and now has a way to get her address because of the domain. Could they get the address through some other means? Sure. But whois is easy, quick, and totally anonymous. Was reddit and 15 minutes of fame required? Not at all. It could have simply been that she linked to it on facebook or twitter and it made the rounds at school. Can you chalk this up to public sharing? Absolutely. However, you can't chalk up the availability of her address to social media -- that's on the shoulders of your policy choices. There are other instances where this would hurt innocent people: live-streamers, podcasts, youtube, you name it. In the case of live streams, there's an unfortunate practice where anonymous calls to police get the person streaming raided by SWAT. That causes real harm and has the potential to get people killed. As a domain owner, I'm frankly upset that you would be so easily swayed to do something that has such obvious negative consequences on all of us who are innocent of any cause to investigate us. I don't really utilize my domain for anything beyond email and pointers for my handy, private use servers, but these use cases still expose me to risks for which I have carefully considered and purchased privacy for my domains. The policy of exposing domain owner contact information is absurd, dangerous, and offensive. It opens ICANN to risks of lawsuits and I would certainly look into any class actions that are likely to be raised to stop this from happening. Privacy has always been important when being a participant on the internet, all the way back to the first chat rooms where we had to drill it into young people not to reveal their names, addresses, and sometimes even admitting to being a girl involved risks. Do not throw away mechanisms for prevention of harm. The correct way to go about this is due process. It works, even if it is inconvenient. The law requires due process to protect innocent people and that should be the focus of any policy written. |