Latest news of the domain name industry

Recent Posts

A million domains taken down by email checks

Kevin Murphy, June 24, 2014, 14:34:25 (UTC), Domain Registrars

Over 800,000 domain names have been suspended since the beginning of the year as a result of Whois email verification rules in the new ICANN Registrar Accreditation Agreement.
That’s according to the Registrars Stakeholder Group, which collected suspension data from registrars representing about 75% of all registered gTLD domain names.
The actual number of suspended domains could be closer to a million.
The 2013 RAA requires registrars to verify the email addresses listed in their customers’ Whois records. If they don’t receive the verification, they have to suspend the domain.
The RrSG told the ICANN board in March that these checks were doing more harm than good and today Tucows CEO Elliot Noss presented, as promised, data to back up the claim.
“There have been over 800,000 domains suspended,” Noss said. “We have stories of healthcare sites that have gone down, community groups whose sites have gone down.”
“I think we can safely say millions of internet users,” he said. “Those are real people just trying to use the internet. They are our great unrepresented core constituency.” 
The RrSG wants to see contrasting data from law enforcement agencies and governments — which pushed hard for Whois verification — showing that the RAA requirement has had a demonstrable benefit.
Registrars asked at the Singapore meeting in March that law enforcement agencies (LEA) be put on notice that they can’t ask for more Whois controls until they’ve provided such data and ICANN CEO Fadi Chehade said “It shall be done by London.”
Noss implied that the majority of the 800,000 suspended names belong to innocent registrants, such as those who had simply changed email addresses since registering their names.
“What was a lovely political win that we said time and time again in discussion after discussion was impractical and would provide no benefit, has demonstrably has created harm,” Noss said.
He was received with cautious support by ICANN board members.
Chair Steve Crocker wonder aloud how many of the 800,000 suspended domains are owned by bad guys, and he noted that LEA don’t appear to gather data in the way that the registrars are demanding.
“We were subjected, all of us, to heavy-duty pressure from the law enforcement community over a long period of time. We finally said, ‘Okay, we hear you and we’ll help you get this stuff implemented,'”, he added. “That creates an obligation as far as I’m concerned on their part.”
“We’re in a — at least from a moral position — in a strong position to say, ‘You must help us understand this. Otherwise, you’re not doing your part of the job'”, he said.
Chehade also seemed to support the registrars’ position that LEA needs to justify its demands and offered to take their data and concerns to the LEA and the Governmental Advisory Committee.
“They put restrictions on us that are causing harm, according to these numbers,” he said. “Let’s take this back at them and say, hey, you ask for all these things, this is what happened.”
“If you can’t tell me what good this has done, be aware not to come back and ask for more,” he said. “I’m with you on this 100%. I’m saying let’s use the great findings you seem to have a found and well-package them in a case and I will be your advocate.”
Director Mike Silber also spoke in support of the RrSG’s position.
“My view is if what you are saying is correct, the LEA’s have blown their credibility,” he said. “They’re going to have to do a lot of work before we impose similar disproportional requirements on actors that are not proven to be bad actors.”
So what does this all mean for registrants?
I don’t think there’s any ongoing process right now to get the Whois verification requirements overturned — that would require a renegotiation of the RAA — but it does seem to mean demands from governments and police are going to have to be much more substantiated in future.
Noss attempted to link the problem to the recommendations of the Whois Expert Working Group (EWG), which propose a completely revamped, centralized Whois system with much more verification and not much to benefit registrants.
To paraphrase: if email verification causes so much harm, what harms could be caused by the EWG proposal?
The EWG was not stuffed with LEA or governments, however, so it couldn’t really be characterized as another set of unreasonable demands from the same entities.

Tagged: , , , , , , , ,

Comments (4)

  1. Acro says:
    June 24, 2014 at 3:31 pm

    This BS clause for verification is most likely causing problems to legitimate registrants, versus ‘rogue’ ones. Emails end in spam boxes or get ignored for various reasons. Another failure by ICANN to create a practical process. Example of a suspended domain due to lack of verification at: http://domaingang.com/domain-news/watermelon-woman-want-see-suspended-domain-looks-like/

    Reply
  2. James says:
    June 25, 2014 at 7:52 am

    You are correct that Registrars were not seeking releif from or a “roll back” of the current requirement.
    But Registrars did raise two specific “asks” during our Board-Elliott interaction yesterday: (1) We asked for support in our efforts to push back on requests to expand verification (Frequency or fields), and (2) for ICANN to raise awareness that this was a global requirement, and not something that was being imposed unilaterally by a single registrar, or small group of registrars.

    Reply
  3. Drewbert says:
    June 26, 2014 at 5:58 am

    “They are our great unrepresented core constituency”
    Well, yes, along with REGISTRANTS who still have practically zero voice within ICANN, even though they’re the ones paying the ICANN tax.

    Reply
  4. Unverified says:
    June 26, 2014 at 8:12 am

    The EWG’s requirements, which caused the overbearing data needs in their recommendations, originated from their “use cases” (Annex C and D).
    Their rather poor analytical approach resulted in all needs being addressed by constantly adding more fields. I couldn’t find an argument to no collect data, only to hide it. They also had no use case for the efficacy of validation channels. All channels are presumed to work, so no harm as a result of their failure (like an email bouncing) is foreseen. EWGs don’t seem to be dosed with reality. I daresay the LEAs are in the same boat.
    We all hate bottom up WGs because they are whinge fests. But they do allow for the airing of operational realities in a much more effective manner than groups full of cherry picked participants.
    I used to dread the yearly WDRP email blizzard. that generated thousands of complaints to anti-spam groups and I’d have to respond saying “yeah we know you find this annoying, but ICANN sez we must send these so suck it up and please dont call us spammers”. This verification process is even more obnoxious.

    Reply

Add Your Comment