Feds warn of Covid risk from “dark” Whois

The US Food and Drug Administration has escalated its beef with ICANN, warning that inaccessible Whois data is making it harder to tackle bogus Covid-19 “cures” and the country’s opioid crisis.

Catherine Hermsen from the FDA’s Office of Criminal Investigations wrote to ICANN CEO Göran Marby last week to complain that some registrars do not adequately respond to abuse complaints and that ICANN ignores follow-up complaints from government agencies.

She doubled down on the FDA’s previous complaint that ICANN’s inaction may be because it is funded by the industry, but back-pedaled on previous insinuations that ICANN’s leadership were putting their own big salaries ahead of public safety.

The beef started in early June, when an organization called Coalition for a Secure & Transparent Internet — basically a front for the likes of DomainTools and other companies whose business models are threatened by privacy legislation — held a one-sided webinar entitled “The Threat of a Dark WHOIS”.

On that webinar, Daniel Burke, chief of the FDA’s Investigative Services Division, lamented the lack of cooperation his agency gets when requesting private Whois data from “certain” registrars, and pointed to cases where the FDA’s inability to quickly get fake pharma sites, including those related to Covid-19, shut down have led to deaths.

He also said that complaints to ICANN about non-compliant registrars fall on deaf ears, to the point that it no longer bothers complaining, and suggested that ICANN and domain companies are financially incentivized to be uncooperative.

Burke quoted the writer Upton Sinclair: “It is difficult to get a man to understand something when his salary depends on his not understanding it.”

“I have found that’s the case with my interactions with ICANN and certain registries and registrars,” Burke said. “They just don’t want to listen… it’s a money-maker for them right now, it’s not profitable for them to deal with it.”

Marby also “spoke” on the CSTI webinar, but his brief intervention was actually just an out-of-context snippet — the “GDPR is not my fault!” T-shirt speech — taken from a recording of an ICANN webinar back in January and presented — dishonestly in my opinion — as if it had been filmed as a contribution to the CSTI discussion.

His inability to directly respond to Burke live led him to write to the FDA (pdf) a couple of weeks later to dispute some of his claims.

First, Marby said the the FDA does not need to obtain a subpoena to get access to Whois data. Registrars are obliged to respond to “legitimate interest” requests, when balanced against the privacy rights of the registrant, he said. He added:

In a few instances, government agencies have submitted complaints to ICANN Contractual Compliance regarding registrars’ refusal to provide non-public registration data. These agencies were ultimately successful in gaining access to the requested data without having to obtain a subpoena or lawful order.

Second, Marby disputed the financial motivation claims, writing: “ICANN’s leadership’s salaries are in no way tied to or dependent upon domain name registrations.”

Third, he offered a (pretty weak, in my view) defense against the claim that ICANN ignores complaints from government agencies, pointing out: “ICANN is not political and, therefore, takes actions to ensure that the workings of the Internet are not politicized.”

He also pointed out that ICANN operates a system called DNSTICR which monitors reports of DNS abuse related to the pandemic and alerts the relevant registries and registrars.

The problem here is that ICANN’s definition of abuse is pretty narrow and does not extend to web sites that sell industrial bleach as a Covid cure. That would count as “content” and ICANN is not the “content police”.

That’s pretty much what Hermsen says in the latest missive (pdf) in this row.

DNS security threats such as malware and phishing, however, were not what SA Burke was referring to in his presentation. Given the agency’s public health mission, FDA has been working during the pandemic to protect Americans from unproven or fraudulent medical products claiming to treat, cure, prevent, mitigate or diagnose COVID-19…

Given your stated concerns regarding COVID-19-related malware and phishing activity, we trust that you are equally concerned about registrars who may not be following the [Registrar Accreditation Agreement’s] requirements to “investigate” and “respond appropriately” following receipt of notifications about abuse, particularly complaints reporting activity involving COVID-19-related fraud or activity exacerbated the current opioid addiction crisis — especially in light of ICANN’s singular ability to enforce the terms of RAAs.

She also comes back, splitting hairs in my opinion, on the ICANN salaries claim, stating: “SA Burke was not referring to ICANN’s leadership salaries… SA Burke was referring more generally to the substantial source of funding ICANN receives from domain name registries and registrars.”

ICANN has just started work on a Whois Disclosure System that, while pretty weak, may make it slightly easier for government agencies to obtain the data they want.

Three big registries will take down opioid domains for US govt

Verisign, Public Interest Registry and Neustar (now part of GoDaddy) will suspend domain names being used to illegally sell opioids under a pilot scheme with the US government.

The Food and Drug Administration announced this week that this new “trusted notifier” program will go into effect for 120 days.

When the FDA finds a site suspected of selling opioids illegally, it will notify the registry as well as the web site’s owner and hosting provider.

The registries will then be able to decide whether to suspend the domain or not. It’s voluntary.

The National Telecommunications and Information Administration will also take part in the project.

Verisign runs .com and .net, PIR runs .org and Neustar runs .us, .co and .biz.

Opioids are legal, pharmaceutical pain-killers derived from opium. They’re ridiculously addictive and account for as many drug overdose deaths in the US as heroin, but are over-prescribed by US doctors.

It’s not the first time registries have agreed to trusted notifier programs. Some new gTLD registries have deals with the movie and music industries to suspend domains involved in copyright infringement.

The announcement comes just a few weeks after ICANN rejected a deal that would have seen PIR create a community oversight body with responsibilities to monitor domain-suspension policies in .org.

FDA to get domain name takedown role?

The US Food and Drug Administration may in future take a stronger role in having domain names associated with rogue internet pharmacies shut down.
Following the meeting between domain name registrars and registries and the Obama administration at the White House last week, I reached out to a few attendees to find out what was discussed.
I didn’t have much luck, to be honest. Some said the meeting was quite dull. But Christine Jones, Go Daddy’s general counsel, was good enough to answer a few questions via email.
The meeting was scheduled to discuss voluntary measures domain firms can take to shut down web sites selling counterfeit pharmaceuticals. I asked whether any specific solutions were discussed.
Jones replied: “Not specifically. There could be an FDA-led solution at some point, which Go Daddy supports.”
The FDA has taken action against illegal online pharmacies in the past, but it does not currently appear to do so on a day-to-day basis.
In November 2009, the agency sent warning letters to the operators of 136 web sites that appeared to be selling medicines illegally. The letters were also sent to the registrars of record for the sites’ domains, most of which were taken down.
The FDA said at the time that the intention was to alert the registrars that the registrants in question may have been in violation of their terms of service and eligible for termination.
In general, the FDA says that overseas pharmacies selling prescription drugs into the US, whether counterfeit or not, is illegal. What this would mean for any “FDA-led solution” is a matter for speculation.
It’s well-known that sick people in the US tend to pay more for their prescription drugs than in other nations, due in part to years of protectionist policies designed to keep the pharma business healthy.
While there are plenty of crooks selling potentially dangerous bogus pills online, some say there are also many legitimate Canadian pharmacies online that supply authentic products more cheaply to US-based prescription holders.
Currently, many US registrars use services such as LegitScript to identify potentially infringing sites. Demand Media’s registrar, eNom, is the most recent convert.
LegitScript, which also only approves US pharmacies, is subject to a certain degree of controversy.
Last week it threatened to sue a web site that made a number of allegations about its financing and the motivations of founder John Horton.
Horton founded LegitScript in 2007, shortly after leaving his Bush administration role as associate deputy director of the Office of National Drug Control Policy.
LegitScript’s main competitor, PharmacyChecker.com, recently asked the US Congress to investigate Horton for alleged ethics violations, claiming he set up LegitScript while still in government.
In April 2007, the ONDCP issued a report which harshly criticized PharmacyChecker for approving Canadian pharmacies that sell drugs to US citizens over the internet, which it said was illegal.
The domain name legitscript.com was initially registered on March 20, 2007. The earliest Whois record I can find, from July that year, shows Horton was the registrant.
Horton’s LinkedIn profile says he left the administration in May 2007.
It seems likely that even if LegitScript did not exist until Horton was out of government, he was preparing its foundations months earlier, at the same time as his office was trashing his future competitor.
Finally, to return to last week’s White House meeting, I asked Go Daddy’s Jones whether the focus was on healthcare or IP protection, and she had this to say:

The focus of this particular meeting was definitely not IP protection. Although IPEC [Intellectual Property Enforcement Coordinator] organized the meeting, there were administration officials and law enforcement attending from many areas of the government. The focus was on finding ways to deal with the rogue pharmacy issue, to get non-compliant registrars to join the fight, and to beef up AUPs to cover registrars in these cases.

She also said that the topic of COICA, the Combating Online Infringement and Counterfeits Act, was not raised.
As I’ve previously reported, ICANN did not attend the White House meeting.