In an attempt to reform outdated policies governing the use of a
registrar’s WHOIS database, Tucows Inc. of Canada is spearheading an effort
to force the Internet Corporate for Assigned
Names and Numbers (ICANN) to protect domain name registrants, which must publicly
disclose critical private information.
Presently, anyone registering domain names must disclose key personal
information such as name, postal address, e-mail address, voice telephone
number, and (where available) fax number into a registrar’s WHOIS database.
And in order to remain accredited by ICANN, this information must be
accurate and publicly accessible to anyone seeking information about a
domain name registrant. The policy
dates back to the Internet’s infancy when Network Solutions Inc., now a part
of Verisign Inc., was the government-sanctioned monopoly administering all
domain names.
But while public access to the registrar WHOIS databases is a boon for
companies offering services to domain holders (i.e. hosting, applications
management, etc.), it clearly opens the door for misuse of the information.
Such was the charge by Register.com, who has sued
Verio Inc., for allegedly spamming its customers. Verio has vehemently denied those charges.
But while Register.com goes after abusers individually on a case-by-case
basis, Tucows is taking a public policy approach, lobbying for reforms to
the outdated rules. In a letter to the ICANN board as well as the general public, Tucows is proposing
“to change the accreditation agreement so that there is a positive burden on
name-holders to elect to have their names and personal information available
for marketing efforts.”
ICANN board officials had no immediate comment.
Support rains down elsewhere
Timothy Denton, a legal consultant to Tucows, explained the existing
provision in the registrar accreditation agreement
that requires registrars provide bulk access was drafted when NSI was a
monopoly and ICANN wanted to prevent it from having exclusive control of
domain registrant data.
“People do not want to have their data used in such a way that they are
the recipient of unwanted mass-marketing from third parties they haven’t
contracted with. We want to make sure that people dealing with domain name
registrars are confident that their personal information is being stored,
handled, and dealt with appropriately,” Denton said.
Surely, registrars such as Tucows, Bulkregister.com and Register.com may
also have their own economic motives. If registrars had the ability to
preserve their customer databases, they themselves can then upsell services,
thereby pushing into additional revenue streams and higher margin
businesses.
Indeed, Register.com, based in Manhattan, contends that companies in
every other industry except domain name registration has the ability to
preserve their own customer lists. However, Register.com officials say it
isn’t that simple.
“For us to say ‘we’re just doing it for selfish purposes’ isn’t
accurate,” said David Hirschler, VP of global marketing at Register.com.
“The public access of WHOIS was done to help the intellectual property
community…it’s been misused quite a bit. Anything that could help our
customers is something we would support. The most paramount concern we have
is the security, privacy and service of our customers. Any misuse that would
compromise that is something we’re very much against.”
Tucow’s proposal must be vetted by the Names Council of ICANN’s Domain
Name Supporting Organization and ultimately approved by the ICANN board.
Paul Kane, chair of the Names Council’s Who-Is committee, welcomed Tucows’
initiative as “the start of an important ongoing evaluation period” that is
in line with the strong data-protection movement in Europe.
Kane said the committee will be soliciting comments from Internet users
on a number of changes to who-is data policies. Besides proposals to
restrict bulk access, the committee will be asking for feedback on a
proposal to allow registrants to prevent the publication of their phone and
fax numbers in who-is look-ups.
And privacy advocates declared the reforms long overdue but warn of the
down side of such policies.
“I say, implement it yesterday. Clearly it’s the right thing to do. Even
if cutting off bulk access doesn’t make a measurable difference in junk mail
or solicitations, it’s fundamentally wrong to have made that data available
given the terms under which it was collected in the first place,” said
Lauren Weinstein, moderator of the Privacy Forum and co-founder of the
People for Internet Responsibility.
But Weinstein said he opposes the notion of limiting who-is look-ups by
individuals or allowing registrants to withold telephone contact
information. “In tracking down privacy, spam or network problems, when
things go wrong, you’ve got to be able to call someone. You can’t always
rely on email. So, what are you going to do, send them a letter?”
Still, Ray Everett-Church, a member of the board of the Coalition Against
Unsolicited Commercial Email (CAUCE), said the proposed change in ICANN’s
bulk access policy won’t stop spammers who harvest e-mails from WHOIS data
using autormated tools without the approval of registrars.
“As long as that information is available in some form, somebody will
probably find a means to abuse the policy. But it’s one thing to fight
abusers, but it’s another thing to have a mandate to have this data sold in
bulk to anybody with a capability of writing a check.”
