UK police have stated an eyebrow-raising “guilty until proven innocent” point of view when it comes to domain name registrations, in comments filed recently with ICANN.
In a Governmental Advisory Committee submission (pdf) to a review of the Whois accuracy rules in the Registrar Accreditation Agreement, unspecified “UK law enforcement” wrote:
Internet governance efforts by Industry, most notably the ICANN 2013 RAA agreement have seen a paradigm shift in Industry in the way a domain name is viewed as “suspicious” before being validated as “good” within the 15 day period of review.
UK law enforcement’s view is that a 45 day period would revert Industry back to a culture of viewing domains “good” until they are proven “bad” therefore allowing crime to propagate and increase harm online.
The GAC submission was made August 13 to a public comment period that closed July 3.
The Whois Accuracy Program Specification Review had proposed a number of measures to bring more clarity to registrars under the 2013 RAA.
One such measure, proposed by the registrars, was to change the rules so that registrars have an extra 30 days — 45 instead of 15 — to validate registrants’ contact information before suspending the domain.
That’s what the UK cops — and the GAC as a whole — don’t like.
They have a point, of course. Criminals often register domains with bogus contact information with the expectation that the domains will not have a long shelf life. Fifteen days is actually quite generous if you want to stop phishing attacks, say.
The Anti-Phishing Working Group says phishing attacks have an average up-time of 29 hours.
Clearly, ICANN’s Whois accuracy program is doing little to prevent phishing as it is; a switch to 45 days would presumably have little impact.
But the number of domains suspended for lack of accuracy at any given time is estimated to be in the hundreds of thousands, and registrars say it’s mostly innocent registrants who are affected.
Verisign said this March that .com domains “on hold” grew from roughly 394,000 names at the end of 2013 to about 870,000 at the end of 2014.
In June 2014, registrars claimed that over 800,000 domains had been suspended for want of Whois accuracy in the first six months the policy was in place.
Electronics firm Sharp wants to remove part of its new gTLD registry contract relating to Whois.
The company has filed a Registry Services Evaluation Process request to get its requirement to offer “searchable Whois” dropped. RSEP is the mechanism registries use to amend their contracts.
ICANN’s initial review has not found any security, stability or competition problems and has now opened the request up for public comment.
Because .sharp will be a dot-brand, all the domains would belong to Sharp and its affiliates, reducing the value of searchable Whois.
Searchable Whois is an enhanced Whois service that allows users to search on all fields (such as registrant, email address, etc) rather than just the domain name.
Such services are not mandatory under ICANN’s new gTLD rules, but applicants that said they would offer them could score an extra point in their Initial Evaluation.
In Sharp’s case, a one-point difference would not have affected the outcome of its IE. In any event, it did not score the extra point.
Sharp said it was requesting the change because it’s switching back-ends from GMO Internet to JPRS, which apparently does not or does not want to support searchable Whois.
Over 20,000 people have put their names to statements slamming proposals that would ban some commercial web sites from using Whois privacy on their domains.
ICANN’s public comment period on a working group’s Whois privacy reform proposals closes today after two months, with roughly 11,000 individual comments — the vast majority against changes that would weaken privacy rights — already filed.
Separately, Michele Neylon of Blacknight Solutions, which hosts SaveDomainPrivacy.org, tells DI that a petition signed by more than 9,000 people will be submitted to ICANN tonight.
If we count the signatories as commenters, that would make this the largest ICANN comment period to date, outstripping the 14,000 comments received when religious groups objected to the approval of .xxx in 2010.
SaveDomainPrivacy.org and RespectOurPrivacy.org, separate registrar-led initiatives, are responsible for the large majority of comments.
While registrars no doubt have business reasons for objecting to the muddling the Whois privacy market, their letter-writing outreach has been based on their claims that they could be forced to unmask the Whois of vulnerable home-business owners and such.
The Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) report, published in May, sketches out a framework that could allow intellectual property owners to have privacy removed from domains they suspect of hosting infringing content.
A minority position appended to the report by MarkMonitor, Facebook, LegitScript and supported by members of the Intellectual Property and Business Constituencies, would put a blanket ban on using privacy on domains used to commercially transact.
What do ICANN’s current Whois privacy reform proposals have to do with the “Gamergate” controversy?
Quite a lot, according to the latest group to slam the proposals as an enabler for “doxing… harassment… swatting… stalking… rape and death threats.”
The Online Abuse Prevention Initiative was formed in March by female software developers in the wake of a sexism slash online abuse scandal that continues to divide the video game community.
Led by Randi Harper, OAPI’s first public move was to today write to ICANN to complain about the GNSO Privacy & Proxy Services Accreditation Issues (PPSAI) Working Group Initial Report.
The report, as previously reported, contains a minority opinion that would ban transactional e-commerce sites from using Whois privacy services.
OAPI said today that this posed a risk of “doxing” — the practice of publishing the home address and other personal information about someone with the aim to encourage harassment — and “swatting”, where people call up America’s notoriously trigger-happy cops to report violent crimes at their intended victim’s home address.
Harper, who was one of the targets of the Gamergate movement (Google her for examples of the vitriol) claims to have been a victim of both. The OAPI letter says she “was swatted based on information obtained from the WHOIS record for her domain.”
The letter, which is signed by groups including the Electronic Frontier Foundation, the National Network to End Domestic Violence, the National Council of Women’s Organizations, and dozens of noted digital rights voices, says:
We strongly oppose the Working Group’s proposal, which will physically endanger many domain owners and disproportionately impact those who come from marginalized communities. People perceived to be women, nonwhite, or LGBTQ are often targeted for harassment, and such harassment inflicts significant harm
Even the most limited definition of a “website handling online financial transactions for commercial purpose” will encompass a wide population that could be severely harmed by doxing, such as:
- women indie game developers who sell products through their own online stores
- freelance journalists and authors who market their work online
- small business owners who run stores or businesses from their homes
- activists who take donations to fund their work, especially those living under totalitarian regimes
- people who share personal stories online to crowdfund medical procedures
To make things worse, the proposed definition of what constitutes “commercial purpose” could be expanded to include other types of activity such as running ads or posting affiliate links.
The letter does not directly refer to Gamergate, but some of the signatories are its most prominent victims and the allusions are clearly there.
Gamergate is described somewhere in its 9,000-word Wikipedia article as “part of a long-running culture war against efforts to diversify the traditionally male video gaming community, particularly targeting outspoken women.”
At its benign end, it was a movement for stronger ethics in video game journalism. At its malignant end, it involved quite a lot of male gamers sending abuse and violent threats to female players and developers.
Go Daddy appears to be putting its money where its mouth is when it comes to arguments about domain privacy.
The company is paying for “sponsored” posts on Facebook that promote the ongoing petition against proposed changes to Whois policy at ICANN.
This has been appearing on Facebook for me all day, seriously interrupting my Farmville time:
Clicking the ad takes you directly to the Save Domain Privacy petition, rather than a Go Daddy sales pitch.
As I reported last week, thousands of internet users have blasted ICANN with template comments complaining about proposed limits on Whois privacy.
There are currently over 10,000 such comments, I estimate, with over a week left until the filing deadline.
Registrars, Go Daddy among them, are largely concerned about a minority proposal emerging from in a proxy/privacy service accreditation working group that would ban transactional e-commerce sites from having private registrations.
They’re also bothered that intellectual property owners could get more rights to unmask privacy users under the proposals.
Despite Go Daddy’s outreach, Repect Our Privacy, letter-writing campaign, backed by NameCheap and the Electronic Frontier Foundation, seems to be responsible for most of the comments filed to date.
Not that it’s necessarily relevant today, but NameCheap and Go Daddy were on opposing sides of the Stop Online Piracy Act debate — a linked controversy — a few years back.