Feeds

Mickey Mouse Whois ban threat sparks privacy fears

Days of pretending to be N. O. Body are numbered

3 Big data security analytics techniques

The days of pretending to be Mickey Mouse or Daffy Duck when you register a domain name could be numbered, following demands placed on ICANN by law enforcement agencies and governments.

ICANN is currently locked in contract talks with its accredited domain name registrars, and expects they will agree to make the verification of customer identities mandatory later this year.

If the rule changes go ahead, registrars such as Go Daddy and Network Solutions could be obliged to ensure that the Whois database records submitted by their customers are accurate.

Such a policy would very likely increase the price of .com domain names, due to the registrars' added cost of paying for commercial verification services. While encouraged by law enforcement and intellectual property concerns, which regularly and loudly complain about the difficulty of tracking down crooks online, the proposed rule change has been criticised by privacy advocates.

Today, Whois databases contain the contact information – including name, physical address and phone number – of people who register domain names. Most top-level domains have such a database.

But while registrars are obliged to remind customers annually about Whois accuracy, and can take down domains if they receive complaints, they don't have to proactively check that Whois records are accurate.

This means that nervous domain buyers can either pay an extra fee for a privacy-protection service, or pretend to be Mr Nobody from Nowheresville, Nowhere, giving a phone number of 555-555-5555.

But this could change under amendments to the ICANN Registrar Accreditation Agreement (RAA) currently under negotiation in closed-door talks between ICANN and registrars. On three occasions over the last few weeks, senior ICANN executives have notified the US administration and Congress that they expect a revised RAA to crack down on phoney Whois.

"ICANN expects that the RAA will incorporate – for the first time – Registrar commitments to verify WHOIS data," CEO Rod Beckstrom told the US Department of Commerce earlier this month.

His words were echoed in two letters to concerned congressmen by senior vice president Kurt Pritz last week, following on from Congressional hearings held in December. Beckstrom indicated that the new RAA will be drafted before March, and that registrars with years left on their current contracts – the majority – will be offered incentives to switch to the new version before 2013. The RAA applies to the 21 generic top-level domains – such as .com, .org, .biz and .xxx – and the hundreds of new gTLDs ICANN intends to start approving next year, rather than country-codes such as .uk and .fr. In the UK, individuals are allowed to privacy-protect their .uk Whois records.

The changes would not affect registrars' ability to offer Whois privacy services for an additional fee, though other amendments could formalise the process of unmasking such registrants accused of criminal behaviour or cybersquatting. And it's not certain yet that Whois verification will become mandatory. Registrars generally oppose such moves, largely due to the complexity and because the cost of commercial identity database services could double the price of domain names in some cases.

Members of ICANN's Non-Commercial Users Constituency also oppose Whois verification on privacy grounds, fearing abuse by over-zealous cops and copyright interests. But there's a significant amount of political pressure to make the changes.

Whois verification was part of a package of a dozen measures first proposed by law enforcement agencies in 2009, but it was not until ICANN's public meeting in Senegal last October – when registrars got a good kicking from governments including the US and UK – that talks to amend the RAA began in earnest.

Some registrars, speaking privately to El Reg, are concerned that their industry could be in for a rematch when ICANN convenes its next public meeting in Costa Rica this March.

Now that ICANN has told the US that Whois verification is "expected", if the provision does not make an appearance in the redrafted RAA then ICANN's Governmental Advisory Committee, backed by national law enforcement agencies, will likely claim that the industry is incapable of self-regulation. While the RAA amendments are a separate policy issue to ICANN's recently launch new generic top-level domains programme, interest from Congress has tied the two problems together. If ICANN cannot secure the RAA amendments governments are demanding, it will likely face further criticism that its new gTLDs will be a haven for fraud. ®

3 Big data security analytics techniques

More from The Register

next story
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
Broadband Secretary of SHEEP sensationally quits Cabinet
Maria Miller finally resigns over expenses row
EE dismisses DATA-BURNING glitch with Orange Mail app
Bug quietly slurps PAYG credit - yet EE denies it exists
Like Google, Comcast might roll its own mobile voice network
Says anything's possible if regulators approve merger with Time Warner
Turnbull leaves Australia's broadband blackspots in the dark
New Statement of Expectations to NBN Co offers get-out clauses for blackspot builds
Facebook claims 100 MEEELLION active users in India
Who needs China when you've got the next billion in your sights?
Facebook splats in-app chat, whacks brats into crack yakety-yak app
Jibber-jabbering addicts turfed out just as Zuck warned
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.