More than half of the remaining US presidential candidates could have risked losing their official campaign web sites under proposed Whois privacy rules.
Today I carried out Whois queries on all 18 candidates to discover that 10, or over 55%, use a Whois privacy service.
Of the three remaining Democrat candidates, only Bernie Sanders uses privacy. Martin O’Malley and Hillary Clinton do not.
Here’s a table of the Republican candidates and their chosen privacy services. N/A means their campaigns are using what appears to be genuine contact information.
The results are interesting because rules under discussion at ICANN earlier this year — which are apparently still on the table in other international fora — would have banned the use of privacy services for commercial web sites that allow financial transactions.
All 18 candidates — even Trump — solicit donations on their campaign sites, and many sell T-shirts, bumper stickers and such.
Back in May, a minority of ICANN’s Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) were in favor of banning privacy for such registrants.
The rationale was that criminals, such as those selling counterfeit drugs, should not be allowed to mask their Whois details.
Judging by a working group report at the ICANN meeting in Dublin last month, the proposed new rules have been killed off by the PPSAI after a deluge of comments — around 22,000 — that were solicited by registrars and civil rights groups.
However, according to the Electronic Frontier Foundation, at the exact same time as the PPSAI was revealing its change of heart, the US government was pushing for virtually identical policy at a meeting of the OECD, the Organization for Economic Cooperation and Development.
The EFF says the proposed OECD Recommendation “would require domain name registration information to be made publicly available for websites that are promoting or engaged in commercial transactions with consumers.”
It’s remarkable that the US government is apparently pushing for rules that are being violated by most of its own hopeful commanders-in-chief as part of the democratic process.
Clearly, fake pharmacies are not the only class of crook to find value in privacy.
UK police have stated an eyebrow-raising “guilty until proven innocent” point of view when it comes to domain name registrations, in comments filed recently with ICANN.
In a Governmental Advisory Committee submission (pdf) to a review of the Whois accuracy rules in the Registrar Accreditation Agreement, unspecified “UK law enforcement” wrote:
Internet governance efforts by Industry, most notably the ICANN 2013 RAA agreement have seen a paradigm shift in Industry in the way a domain name is viewed as “suspicious” before being validated as “good” within the 15 day period of review.
UK law enforcement’s view is that a 45 day period would revert Industry back to a culture of viewing domains “good” until they are proven “bad” therefore allowing crime to propagate and increase harm online.
The GAC submission was made August 13 to a public comment period that closed July 3.
The Whois Accuracy Program Specification Review had proposed a number of measures to bring more clarity to registrars under the 2013 RAA.
One such measure, proposed by the registrars, was to change the rules so that registrars have an extra 30 days — 45 instead of 15 — to validate registrants’ contact information before suspending the domain.
That’s what the UK cops — and the GAC as a whole — don’t like.
They have a point, of course. Criminals often register domains with bogus contact information with the expectation that the domains will not have a long shelf life. Fifteen days is actually quite generous if you want to stop phishing attacks, say.
The Anti-Phishing Working Group says phishing attacks have an average up-time of 29 hours.
Clearly, ICANN’s Whois accuracy program is doing little to prevent phishing as it is; a switch to 45 days would presumably have little impact.
But the number of domains suspended for lack of accuracy at any given time is estimated to be in the hundreds of thousands, and registrars say it’s mostly innocent registrants who are affected.
Verisign said this March that .com domains “on hold” grew from roughly 394,000 names at the end of 2013 to about 870,000 at the end of 2014.
In June 2014, registrars claimed that over 800,000 domains had been suspended for want of Whois accuracy in the first six months the policy was in place.
Electronics firm Sharp wants to remove part of its new gTLD registry contract relating to Whois.
The company has filed a Registry Services Evaluation Process request to get its requirement to offer “searchable Whois” dropped. RSEP is the mechanism registries use to amend their contracts.
ICANN’s initial review has not found any security, stability or competition problems and has now opened the request up for public comment.
Because .sharp will be a dot-brand, all the domains would belong to Sharp and its affiliates, reducing the value of searchable Whois.
Searchable Whois is an enhanced Whois service that allows users to search on all fields (such as registrant, email address, etc) rather than just the domain name.
Such services are not mandatory under ICANN’s new gTLD rules, but applicants that said they would offer them could score an extra point in their Initial Evaluation.
In Sharp’s case, a one-point difference would not have affected the outcome of its IE. In any event, it did not score the extra point.
Sharp said it was requesting the change because it’s switching back-ends from GMO Internet to JPRS, which apparently does not or does not want to support searchable Whois.
Over 20,000 people have put their names to statements slamming proposals that would ban some commercial web sites from using Whois privacy on their domains.
ICANN’s public comment period on a working group’s Whois privacy reform proposals closes today after two months, with roughly 11,000 individual comments — the vast majority against changes that would weaken privacy rights — already filed.
Separately, Michele Neylon of Blacknight Solutions, which hosts SaveDomainPrivacy.org, tells DI that a petition signed by more than 9,000 people will be submitted to ICANN tonight.
If we count the signatories as commenters, that would make this the largest ICANN comment period to date, outstripping the 14,000 comments received when religious groups objected to the approval of .xxx in 2010.
SaveDomainPrivacy.org and RespectOurPrivacy.org, separate registrar-led initiatives, are responsible for the large majority of comments.
While registrars no doubt have business reasons for objecting to the muddling the Whois privacy market, their letter-writing outreach has been based on their claims that they could be forced to unmask the Whois of vulnerable home-business owners and such.
The Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) report, published in May, sketches out a framework that could allow intellectual property owners to have privacy removed from domains they suspect of hosting infringing content.
A minority position appended to the report by MarkMonitor, Facebook, LegitScript and supported by members of the Intellectual Property and Business Constituencies, would put a blanket ban on using privacy on domains used to commercially transact.
What do ICANN’s current Whois privacy reform proposals have to do with the “Gamergate” controversy?
Quite a lot, according to the latest group to slam the proposals as an enabler for “doxing… harassment… swatting… stalking… rape and death threats.”
The Online Abuse Prevention Initiative was formed in March by female software developers in the wake of a sexism slash online abuse scandal that continues to divide the video game community.
Led by Randi Harper, OAPI’s first public move was to today write to ICANN to complain about the GNSO Privacy & Proxy Services Accreditation Issues (PPSAI) Working Group Initial Report.
The report, as previously reported, contains a minority opinion that would ban transactional e-commerce sites from using Whois privacy services.
OAPI said today that this posed a risk of “doxing” — the practice of publishing the home address and other personal information about someone with the aim to encourage harassment — and “swatting”, where people call up America’s notoriously trigger-happy cops to report violent crimes at their intended victim’s home address.
Harper, who was one of the targets of the Gamergate movement (Google her for examples of the vitriol) claims to have been a victim of both. The OAPI letter says she “was swatted based on information obtained from the WHOIS record for her domain.”
The letter, which is signed by groups including the Electronic Frontier Foundation, the National Network to End Domestic Violence, the National Council of Women’s Organizations, and dozens of noted digital rights voices, says:
We strongly oppose the Working Group’s proposal, which will physically endanger many domain owners and disproportionately impact those who come from marginalized communities. People perceived to be women, nonwhite, or LGBTQ are often targeted for harassment, and such harassment inflicts significant harm
Even the most limited definition of a “website handling online financial transactions for commercial purpose” will encompass a wide population that could be severely harmed by doxing, such as:
- women indie game developers who sell products through their own online stores
- freelance journalists and authors who market their work online
- small business owners who run stores or businesses from their homes
- activists who take donations to fund their work, especially those living under totalitarian regimes
- people who share personal stories online to crowdfund medical procedures
To make things worse, the proposed definition of what constitutes “commercial purpose” could be expanded to include other types of activity such as running ads or posting affiliate links.
The letter does not directly refer to Gamergate, but some of the signatories are its most prominent victims and the allusions are clearly there.
Gamergate is described somewhere in its 9,000-word Wikipedia article as “part of a long-running culture war against efforts to diversify the traditionally male video gaming community, particularly targeting outspoken women.”
At its benign end, it was a movement for stronger ethics in video game journalism. At its malignant end, it involved quite a lot of male gamers sending abuse and violent threats to female players and developers.