[alac] DRAFT: WHOIS statement for Task Forces 1 & 2

[Thomas Roessler <roessler@xxxxxxxxxxxxxxxxxx>]

Please find attached a draft of our statement for WHOIS Task Forces
one and two, Access to WHOIS Data, and Review of Data Collected and
Displayed.  The statement takes up a policy proposal for tiered
access that has been floating around for quite some time.

Comments appreciated; unfortunately, we're already past deadline for
Task Force one.

Regards,
-- 
Thomas Roessler  <roessler@xxxxxxxxxxxxxxxxxx>
At-Large Advisory Committee: http://alac.info/

***DRAFT***    ALAC remarks on WHOIS -- Task Forces 1 & 2    ***DRAFT***


        Note: Unless we specifically speak about registrars, our
        remarks apply to registrar and to thick registry WHOIS
        systems alike.



1. Access to data

   Policy proposal

        We recommend a simple two-tiered system.
        
        Tier 1 -- public access.  Users who access a future
        WHOIS-like system anonymously get access to non-sensitive
        information concerning a domain name registration, to be
        defined in detail by task force 2.

        Tier 2 -- authenticated access.  Users who want to access a
        more complete data set (to be defined in detail by task
        force 2) need to reliably identify themselves, and indicate
        the purpose for which they want to access the data.

        The identity of the data user and their purpose is recorded
        by registrars and registries, and made available to
        registrants when requested.  This information could be
        withheld for a certain amount of time if the data user is
        (1) a law enforcement authority that is (2) accessing the
        data for law enforcement purposes.

   Implementation remarks
    
        We do not recommend any particular implementation of this
        proposal, but note that "reliable identification" could be
        provided by commercially available SSL certificates.  In
        general, we would favor implementation of our proposal in a
        dedicated protocol (such as IRIS) over implementation
        through Web forms.

   Rationale

        The key aspect for deciding whether access to data gathered
        by registrars can be given to a third party is the purpose
        for which this data is going to be used.  Obviously,
        registrars have no way to verify the purpose for which WHOIS
        data is being accessed.
        
        The best heurisitc we know of is to hold data users
        accountable for their activities, and to put enforcement of
        purpose limitations into the hands of registrants.  This can
        be achieved by reliably identifying data uses and putting
        their identity, contact information, and purpose indication
        in the hands of registrants.

        At the same time, a tiered system -- if implemented
        reasonably -- could preserve the ability of data users to
        automatically access WHOIS data in reasonable quantities.
        Registrars, on the other hand, would be enabled to limit the
        amount of data any particular party can access in a given
        interval of time.

        Identifying data users and their purposes would also enable
        registrars to comply with legal obligations to make this
        kind of information available to data subjects.

   Discussion of other proposals

        There have been suggestions that "automated access" could be
        used as a heuristic to determine illegitimate access.  In
        this scheme, automated access is blocked by attempting to
        require human attention with all queries.  One set of
        implementations of these kinds of tests is known as CAPTCHA.

        There is evidence that automated access is also being used
        for legitimate purposes; on the other hand, there is
        publicly available information on how CAPTCHA-like tests are
        being circumvented in other contexts.  The circumvention
        here is based on a fundamental design problem of CAPTCHAs.
        <http://boingboing.net/2004_01_01_archive.html#107525288693964966>

        One particularly popular CAPTCHA has been broken in academic
        more than a year ago, but is still being used by registrars. 
        <http://www.cs.berkeley.edu/~mori/gimpy/gimpy.html>
        
        Accessibility problems posed by CAPTCHA-like tests are not
        fully understood by now; we note, though, that purely visual
        tests are insufficient from an accessibility point of view.
        <http://www.w3.org/TR/turingtest/>

        In conclusion, CAPTCHA tests address the wrong problem, and
        they address it badly.  We strongly recommend against going
        down this path.



2. Data elements displayed and collected

   Policy proposal
   
        We recommend that the mandatory collection and display of
        personal information about registrants be reduced as far as
        possible.  What information is actually required for placing
        a domain name registration should be a matter of registrars'
        business models, and of applicable law, not of ICANN policy.


        We consider the removal of the following data elements from
        registrars' and registries WHOIS services a priority:

        - registrant name, address, and phone number, unless
          registrant has requested that this information be made
          available.

        - administrative contact name, address, and phone number,
          unless registrant has requested that this information be
          made available.

        - Billing contact.  These data are traditionally not
          published by registrars, but are included in many thick
          registries' public WHOIS services.


        For the purposes of a tiered access system (see
        recommendations for task force 1), we would recommend that
        the following information be included in a public tier:
        
        - Registrar of record.
        - Name servers.
        - Status of domain name.
        
        - Contact data, if the data subject specifically requests
          that these data be included in the public tier.

   Implementation remarks
        
        None.

   Rationale
   
        For personal registrations, the registrant, administrative
        contact, and billing contact data sets are most likely to
        concern sensitive information, such as the registrant's home
        address and phone number.
        
        We recognize that domain name registrations by online
        merchants often imply less privacy concerns; it has been
        argued that online merchants must make privacy information
        public in many jurisdictions.  We are confident that
        businesses will also follow these duties by requesting
        registrars to make contact information about them available
        publicly.  Conversely, if bad actors decide not to make
        contact information publicly available, that could actually
        make bad actors more easily recognizable, and provide
        consumers with a "red flag."

   Discussion of other proposals
   
        At the WHOIS workshop in Rome, we have heared several
        lawyers praise the usefulness of registrant and other
        telephone numbers in WHOIS services.  That way, we were
        told, many cases could be settled by a single phone call.
        The easier the contact, we were told, the merrier.

        This argument is troubling: What we were hearing here is a
        request to ICANN to enable lawyers to make off the record
        contact with other parties to a dispute that may not have a
        lawyer readily available, and to make this contact in a way
        which makes it hard for the registrant to get legal counsel
        involved in early negotiations arising out of the dispute.
        
        Telephone numbers of registrant and administrative contacts
        should be *removed* from WHOIS services for precisely this
        reason: Forcing the non-registrant party to a dispute to
        open up that dispute by on-the-record means (e-mail, fax
        [not universally available], postal mail) ensures that
        registrants have an opportunity to retain legal counsel in
        these disputes, and to fully understand any claims made by
        the non-registrant party.  It also helps to avoid legal
        bluff and plain bullying.

        To summarize, it may be true that availability of phone
        numbers enables quick settlement.  But availability of phone
        numbers also favors situations in which these settlements
        are achieved by dubious means, to the detriment of the
        registrant.