[alac] Draft statement on Whois TF3
This is my first try on a position statement for Whois TF3, which we actually were to submit by March 19th (but don't worry, everybody is late). I just drafted it and didn't even have time to re-read it, so please point out all stupid statements. ===== This statement reflects the views of the At Large Advisory Committee on the matters that are subject to the work of GNSO's Whois Task Force 3. First of all, we express our appreciation for the difficult work that the Task Force has been doing. We think that, to be able to solve a problem, you should first investigate the reasons why it happens. In this case, you could roughly divide the registrants whose data are inaccurate into four categories: 1. Those who purposedly provide inaccurate data for fraudulent reasons. 2. Those who purposedly provide inaccurate data to protect their privacy. 3. Those who mistakenly provide inaccurate data. 4. Those who provide accurate data at registration, but then fail to keep them up to date so that the information becomes inaccurate. Until now, the general discussion on accuracy has been almost completely focused on the first category – and we think this is an error. The purpose of the Whois system is not to provide bullet-proof identification for those who register domains and operate services on top of them, but rather to provide quick contact information for those domain holders who want to be contacted. Turning the Whois system into a certified directory of domain name owners would go beyond its purpose and, as practice shows, is practically incompatible with its spirit and architecture. Also, at the present state of technology and of operational practices, costs of very secure authentification of world-wide registrants for all domain name registrations would be high and would possibly destroy the domain name market as we know it today. We think it might be more cost-effective (and also more respectful of basic civil rights of people) to seek after fraudulent registrants once they actually commit a fraud, rather than to presume that all registrants are to commit frauds and so should be carefully screened in advance. Finally, we point out that there is no verification system, other than requiring a person to physically show up and exhibit a secure proof of identity such as a passport or national ID document, that could tell between true personal data and plausible, but fake, personal data. If going down the path of imposing stricter and stricter checks on data as they are submitted by the registrant during the registration process, after spending lots of time and lots of money on them, we might actually discover that no benefit has arisen in terms of fraud prevention, but that the stricter checks have caused a huge increase in crimes like identity theft, which by the way are made easier by the very existence of the public and anonymously accessible Whois system. Said this, we think that an increased accuracy in the Whois database, if limited to those registrants who actually agree to provide their data, would be highly desirable. This is why we think that future activities in the field of enhanced accuracy should not focus on the first category of the above list, but rather on the other three. We will not discuss here the issue of privacy protection, which is the subject of another task force; we just stress that the overwhelming majority of those who purposedly provide inaccurate data does so for privacy protection reasons, rather than for fraudulent intentions. Just allowing these people not to disclose their data to the public, but just to the registrar, would actually avoid most cases of wilful inaccuracy. The third category is, according to our experience, somewhat small – also because this kind of errors is clerical and can easily be fixed in case there is actual need to contact the owner. Once the registrant's desire to publish their data is ascertained, some simple automated verifications could be made by the registrar's system, to warn the registrant about possible errors. However, creating an automatical verification algorithm for all countries and scripts of the world might prove very difficult and prone to errors for less common countries; the current practical examples only come from TLDs and environments with geographically limited registrants. On the other hand, systems which provide automatical verification only for residents of some countries could be acceptable only as long as they do not prevent or make it unreasonably harder for residents of “unverifiable” countries to register domains. This is why we think that the output of this automated verification algorithms should only be used as a warning to the registrant, but should not prevent the registrant from submitting data that might seem incorrect, as they could possibly be absolutely correct. We also note that requiring Roman-script information for registrants of those countries who do not use Roman characters would be unduly discriminating them in access to gTLDs. All registrants should be asked to provide their data only in their local language and script, and just as an option they could be asked whether they want to provide Romanized data as well. Requiring the ability to type in Roman script to register domains in global generic TLDs is unacceptable. Finally, we think that much could be done to improve the situation of the fourth category – those registrants who would be happy to provide accurate information, but who fail to keep it up to date. In fact, experience shows that updating Whois data is a long and difficult process for registrants. In many cases, the registrant has to send faxes, make phone calls, and suffer other costs while devoting a significant amount of time; in other cases, the authentication mechanism used by registries or registrars is based on the e-mail address (or on a username/password couple which, if forgot, will be resent to the current e-mail address), so that a change in the e-mail address of the registrant will make him/her unable to manage the information, and will make these domains orphan. If you add this to the fact that keeping personal data up to date in a public Whois registry certainly cannot be the first worry of a registrant when he's changing address, phone number or e-mail address, you realize that this is possibly the easiest cause of inaccuracy in Whois databases. Also, in many cases the registrant is only the last link in a long chain of interactions that starts with a registry, then goes through an ICANN-accredited registrar, a domain name reseller, a web hosting company, or even an “Internet-savvy” friend who does the job for the registrant. We think that this is an unavoidable consequence of the average registrant turning from a skilled engineer in a small Internet, as it was when Whois was designed, to a non-technical average person in a mass Internet. It is very difficult to create the awareness of the existence and purpose of the Whois database for non-technical persons on a mass scale, and we think this is another reason why we should never expect the Whois to be a terribly accurate list of all registrants. However, for this category the problem possibly lies in the lack of simple online systems for the registrant to edit his/her data in the database at no cost. Thus we think that one of the two following solutions should be tried: 1. Requiring registries to directly deal with registrants' update requests, by supplying them a virtual certificate or account at registration, plus offline procedures to recover access if such account is lost; 2. Changing the architecture of the Whois database from centralized to distributed. Since the first option would raise many concerns in terms of business models, customer ownership, and cost recovery, the second could possibly be more interesting. After all, the very reason for which the DNS system was created, replacing the old centralized hosts table, was the impossibility of keeping this centralized table up to date. We should simply apply the same principle and move the data at the edge of the network, by embedding Whois servers into DNS server implementations. Whois queries could then be sent directly to the authoritative name servers for the domain, and only if no reply is received, the registry could be used as a fall-back. This way, registrants would be able to keep their Whois information up to date as easily as they keep their zone files up to date, and even if this would not completely solve the problem, it would possibly cause a dramatic increase in the number of Whois records that are actually kept updated. We thus recommend a shift in the focus of accuracy-related discussions, so to deal with those types of inaccuracy that can and should actually be solved, rather than dealing with world-wide verification and law enforcement systems that are not practically conceivable at the present social and political state of our planet, and that would anyway have to be discussed at other political levels. -- .oOo.oOo.oOo.oOo vb. Vittorio Bertola - vb [a] bertola.eu.org http://bertola.eu.org/ <-- Vecchio sito, nuovo toblog!
|