Latest news of the domain name industry

Recent Posts

Is ICANN over-reacting to Whois privacy law?

Kevin Murphy, March 20, 2018, Domain Policy

Is ICANN pushing the domain industry to over-comply with the European Union’s incoming General Data Protection Regulation privacy law?

Governments and plenty of intellectual property and business lobbyists think so.

After days of criticism from unhappy IP lawyers, ICANN’s public meeting in Puerto Rico last week was capped with a withering critique of the organization’s proposed plan for the industry to become GDPR compliant as pertains Whois.

The Governmental Advisory Committee, in unusually granular terms, picked apart the plan in its usual formal, end-of-meeting advice bomb, which focused on making sure law enforcement and IP owners continue to get unfettered Whois access after GDPR kicks in in May.

Key among the GAC’s recommendations (pdf) is that the post-GDPR public Whois system should continue to publish the email address of each domain registrant.

Under ICANN’s plan — now known as the “Cookbook” — that field would be obscured and replaced with a contact form or anonymized email address.

The GAC advised ICANN to “reconsider the proposal to hide the registrant email address as this may not be proportionate in view of the significant negative impact on law enforcement, cybersecurity and rights protection;”.

But its rationale for the advice is a little wacky, suggesting that email addresses under some unspecified circumstances may not contain “personal data”:

publication of the registrant’s email address should be considered in light of the important role of this data element in the pursuit of a number of legitimate purposes and the possibility for registrants to provide an email address that does not contain personal data.

That’s kinda like saying your mailing address and phone number aren’t personal data, in my view. Makes no sense.

The GAC advice will have won the committee friends in the Intellectual Property Constituency and Business Constituency, which throughout ICANN 61 had been pressuring ICANN to check whether removing email addresses from public Whois was strictly necessary.

ICANN is currently acting as a non-exclusive middleman between community members and the 20-odd Data Protection Authorities — which will be largely responsible for enforcing GDPR — in the EU.

It’s running compliance proposals it compiles from community input past the DPAs in the hope of a firm nod, or just some crumbs of guidance.

But the BC and IPC have been critical that ICANN is only submitting a single, rather Draconian proposal — one which would eschew email addresses from the public Whois — to the DPAs.

In a March 13 session, BC member Steve DelBianco pressed ICANN CEO Goran Marby and other executives and directors repeatedly on this point.

“If they [the DPAs] respond ‘Yes, that’s sufficient,’ we won’t know whether it was necessary,” DelBianco said, worried that the Cookbook guts Whois more than is required.

ICANN general counsel John Jeffrey conceded that the Cookbook given to the DPAs only contains one proposal, but said that it also outlines the “competing views” in the ICANN community on publishing email addresses and asks for guidance.

But email addresses are not the only beef the GAC/IPC/BC have with the ICANN proposal.

On Thursday, the GAC also advised that legal entities that are not “natural persons” should continue to have their full information published in the public Whois, on the grounds that GDPR only applies to people, not organizations.

That’s contrary to ICANN’s proposal, which for pragmatic reasons makes no distinction between people and companies.

There’s also the question of whether the new regime of Whois privacy should apply to all registrants, or just those based in the European Economic Area.

ICANN plans to give contracted parties the option to make it apply in blanket fashion worldwide, but some say that’s overkill.

Downtime for Whois?

While there’s bickering about which fields should be made private under the new regime, there doesn’t seem to be any serious resistance to the notion that, after May, Whois will become a two-tier system with a severely depleted public service and a firewalled, full-fat version for law enforcement and whichever other “legitimate users” can get their feet in the door.

The problem here is that while ICANN envisions an accreditation program for these legitimate users — think trademark lawyers, security researchers, etc — it has made little progress towards actually creating one.

In other words, Whois could go dark for everyone just two months from now, at least until the accreditation program is put in place.

The GAC doesn’t like that prospect.

It said in its advice that ICANN should: “Ensure continued access to the WHOIS, including non-public data, for users with a legitimate purpose, until the time when the interim WHOIS model is fully operational, on a mandatory basis for all contracted parties”.

But ICANN executives said in a session on Thursday that the org plans to ask the DPAs for a deferral of enforcement of GDPR over Whois until the domain industry has had time to come into compliance while continuing to grant access to full Whois to police and special interests.

December appears to be the favored date for this proposed implementation deadline, but ICANN is looking for feedback on its timetable by this coming Friday, March 23.

But the IPC/BC faction are not stting on their hands.

Halfway through ICANN 61 they expressed support for a draft accreditation model penned by consultant Fred Felman, formerly of brand protection registrar MarkMonitor.

The model, nicknamed “Cannoli” (pdf) for some reason, unsurprisingly would give full Whois access to anyone with enough money to afford a trademark registration, and those acting on behalf of trademark owners.

Eligible accreditees would also include security researchers and internet safety organizations with the appropriate credentials.

Once approved, accredited Whois users would have unlimited access to Whois records for defined purposes such as trademark enforcement or domain transfers. All of their queries would be logged and randomly audited, and they could lose accreditation if found to be acting outside of their legitimate purpose.

But Cannoli felt some resistance from ICANN brass, some of whom pointed out that it had been drafted by just one part of the community

“If the community — the whole community — comes up with an accreditation model we would be proud to put that before the DPAs,” Marby said during Thursday’s public forum in Puerto Rico.

It’s a somewhat ironic position, given that ICANN was just a few weeks ago prepared to hand over responsibility for creating the first stage of the accreditation program — covering law enforcement — wholesale to the GAC.

The GAC’s response to that request?

It’s not interested. Its ICANN 61 communique said the GAC “does not envision an operational role in designing and implementing the proposed accreditation programs”.

Now Latvia guts Whois to comply with GDPR

Kevin Murphy, March 19, 2018, Domain Registries

Latvia has become the latest country to announce plans to cut back on Whois provision to comply with incoming European Union privacy law.

Its .lv ccTLD is the first I’m aware of to announce that it plans to cut back on the amount of data it actually collects in addition to how much it publishes.

NIC.lv said it will not longer require registrants to submit one postal address, instead of two. It will not longer require a something called a “fax” number, whatever that is, either.

The registry currently does not publish the names or physical addresses of its natural person registrants, but following the introduction of the General Data Protection Regulation in May it will stop publishing telephone numbers and email addresses too.

It will instead present a form that can be used to contact the registrant, a little like ICANN is proposing for gTLDs.

The company also plans to rate-limit Whois queries to mitigate harvesting.

The proposed changes are open for comments until April 12.

.lv has about 120,000 domains under management, according to its web site.

Austria to stop publishing most Whois data

Kevin Murphy, March 15, 2018, Domain Registries

Austrian ccTLD operator nic.at will no longer publish any Whois information for individual registrants, in order to comply with incoming EU privacy law.

“Natural persons’ data will no longer be published from mid-May 2018,” the company said today.

Data concerning legal entities such as companies will continue to be published, it added.

The move is of course an effort to become compliant with the General Data Protection Regulation, which currently has the industry scrambling around in the dark looking for ways avoid avoid millions of euros of potential fines.

nic.at will continue to collect the private data of individual registrants, but it will only publish technical information such as the name of the registrar and name servers in response to public Whois queries.

Companies will have their names and addresses published, but will have the option to have their email address and phone number hidden.

nic.at said it will disclose records to “law enforcement agencies, lawyers or people who contact nic.at following domain disputes and can prove that their rights have been infringed”.

People will be able to opt-in to having their information published

It’s arguably a more Draconian implementation of GDPR than the one proposed by ICANN for gTLDs, but it appears to be in line with plans already announced by Nominet for .uk and DENIC for .de.

Lawyer: GoDaddy Whois changes a “critical” contract breach

Kevin Murphy, March 13, 2018, Domain Registrars

GoDaddy is in violation of its ICANN registrar contract by throttling access to its Whois database, according to a leading industry lawyer.

Brian Winterfeldt of the Winterfeldt IP Group has written to ICANN to demand its compliance team enforces what he calls a “very serious contractual breach”.

At issue is GoDaddy’s recent practice, introduced in January, of masking key fields of Whois when accessed in an automated fashion over port 43.

The company no longer shows the name, email address or phone number of its registrants over port 43. Web-based Whois, which has CAPTCHA protection, is unaffected.

It’s been presented as an anti-spam measure. In recent years, GoDaddy has been increasingly accused (wrongly) of selling customer details to spammers pitching web hosting and SEO services, whereas in fact those details have been obtained from public Whois.

But many in the industry are livid about the changes.

Back in January, DomainTools CEO Tim Chen told us that, even as a white-listed known quantity, its port 43 access was about 2% of its former levels.

And last week competing registrar Namecheap publicly complained that Whois throttling was hindering inbound transfers from GoDaddy.

Winterfeldt wrote (pdf) that “nothing in their contract permits GoDaddy to mask data elements, and evidence of illegality must be obtained before GoDaddy is permitted to throttle or deny
port 43 Whois access to any particular IP address”, adding:

The GoDaddy whitelist program has created a dire situation where businesses dependent upon unmasked and robust port 43 Whois access are forced to negotiate wholly subjective terms for access, and are fearful of filing complaints with ICANN because they are reticent to publicize any disruption in service, or because they fear retaliation from GoDaddy…

This is a very serious contractual breach, which threatens to undermine the stability and security of the Internet, as well as embolden other registrars to make similar unilateral changes to their own port 43 Whois services. It has persisted for far too long, having been officially implemented on January 25, 2018. The tools our communities use to do our jobs are broken. Cybersecurity teams are flying blind without port 43 Whois data. And illegal activity will proliferate online, all ostensibly in order to protect GoDaddy customers from spam emails. That is completely disproportionate and unacceptable

He did not disclose which client, if any, he was writing on behalf of, presumably due to fear of reprisals.

He added that his initial outreaches to ICANN Compliance have not proved fruitful.

ICANN said last November that it would not prosecute registrar breaches of the Whois provisions of the Registrar Accreditation Agreements, subject to certain limits, as the industry focuses on becoming compliant with the General Data Protection Regulation.

But GoDaddy has told us that the port 43 throttling is unrelated to GDPR and to the compliance waiver.

Masking Whois data, whether over port 43 or not, is likely to soon become a fact of life anyway. ICANN’s current proposal for GDPR compliance would see public Whois records gutted, with only accredited users (such as law enforcement) getting access to full records.

Namecheap accuses GoDaddy of delaying transfers

GoDaddy broke ICANN rules and US competition law by delaying outbound domain transfers yesterday, and not for the first time, according to angry rival Namecheap.

March 6 was Namecheap’s annual Move Your Domain Day, a promotion under which it donates $1.50 to the Electronic Frontier Foundation for every inbound transfer from another registrar.

It’s a tradition the company opportunistically started back in 2011 specifically targeting GoDaddy’s support, later retracted, for the controversial Stop Online Piracy Act, SOPA.

But yesterday GoDaddy was delivering “incomplete Whois information”, which interrupted the automated transfer process and forced Namecheap to resort to manual verification, delaying transfers, Namecheap claims.

“First and foremost this practice is against ICANN rules and regulations. Secondly, we believe it violates ‘unfair competition’ laws,” the company said in a blog post.

Whois verification is a vital part of the transfer process, which is governed by ICANN’s binding Inter-Registrar Transfer Policy.

GoDaddy changed its Whois practices in January. As an anti-spam measure, it no longer publishes contact information, including email addresses vital to the transfer process, when records are accessed automatically over port 43.

However, GoDaddy VP James Bladel told us in January that this was not supposed to affect competing registrars, which have their IP addresses white-listed for port 43 access via a system coordinated by ICANN.

Did GoDaddy balls up its new restrictive Whois practices? Or can the blame be shared?

Namecheap also ran into problems with GoDaddy throttling port 43 on its first Move Your Domain Day in 2011, but DI published screenshots back then suggesting that the company had failed to white-list its IP addresses with ICANN.

This time, the company insists the white-list was not an issue, writing:

As many customers have recently complained of transfer issues, we suspect that GoDaddy is thwarting/throttling efforts to transfer domains away from them. Whether automated or not, this is unacceptable. In preparation for today, we had previously whitelisted IPs with GoDaddy so there would be no excuse for this poor business practice.

Namecheap concluded by saying that all transfers that have been initiated will eventually go through. It also asked affected would-be customers to complain to GoDaddy.

The number of transfers executed on Move Your Domain Day over the last several years appears to be well into six figures, probably amounting to seven figures of annual revenue.