Private Whois requests hit new low after Tucows quits RDRS

March saw the lowest number of requests for private Whois data via ICANN’s Registration Data Request Service since the system launched in late 2023.

ICANN’s latest stats show that there were just 91 requests last month, compared to February’s 143 and the previous low, from last November, of 103.

The dip can probably attributed at least in part to the departure of eight companies from the pool of participating registrars.

Notably, Tucows pulled its four accreditations from the service. Four shell registrars belonging to Tracer (Focus IP) also withdrew because their accreditations have been terminated.

Of the 1,307 domain lookups via RDRS in March, also a new low, 19% were for domains at non-participating registrars. That was up slightly from 17% in February and compares to 25% from the service’s launch.

The average time for a request to be approved was 3.3 days, the second-lowest of any monthly reporting period to date. Denials took on average just over a week. Both metrics were well below the lifetime average.

Intellectual property owners and law enforcement are still the largest categories of requestor, together accounting for almost half of requests in March.

Interestingly, UK cops have now submitted more requests for private data than police from any other country, including the US. Law enforcement requests since last October now stand at 30 for the UK and 29 for the US.

Tucows quits ICANN’s Whois disclosure pilot

Tucows has dramatically dropped out of ICANN’s Registration Data Request Service pilot.

The company said that RDRS provides a poor user experience that harms user privacy and causes ICANN to produce misleading usage statistics that show an artificially high request denial rate.

RDRS is a bit more than half way through a two-year pilot designed to gather data that will help ICANN decide whether to deploy a more permanent and probably more expensive long-term solution.

The service is essentially a clearinghouse that connects people who want to request private Whois data with the registrars that manage domains of interest.

Tucows said in a blog post:

Given that the RDRS Standing Committee has enough data to complete its report, as well as the customer experience challenges and data privacy concerns we’ve outlined above, Tucows Domains has decided to end our participation in the RDRS.

The move makes Tucows the highest-profile registrar to pull out of the service to date. Across its various brands (such as Ascio, Enom, EPAG, and OpenSRS) it has around 10 million domains under management.

As of the end of January, RDRS had 94 registrars on board, covering 60% of all registered gTLD domains.

Tucows said it will continue to offer its TACO service, which also allows entities such as intellectual property interests to request private Whois data but charges requesters at least $3,000 a year, which it calls a “cost recovery fee”.

The TACO fee can be waived for “single-use and non-commercial requestors”, Tucows noted. It has updated its terms accordingly.

$3,000 to do a Whois lookup?

ICANN’s Registration Data Request Service cost hundreds, maybe even thousands, of dollars every time it was used in its first year, according to an analysis of official stats.

RDRS is the system designed to connect entities such as trademark owners, security researchers, and law enforcement with registrars, allowing them to request private domain registration data that is usually redacted in Whois records.

It’s running as a two-year pilot, in order to gauge demand and effectiveness, and its first full month of operation was December 2023.

ICANN has been publishing monthly transparency reports, including data such as number of requests and outcomes, and we know how much it cost the Org to develop and operate, so it should be possible to make some back-of-the-envelope calculations about how much each request costs the ICANN taxpayer.

The cost could range from about $300 to over $3,000 per request, even using some fairly generous assumptions.

RDRS cost $1,647,000 to develop, which is pretty much a shoestring by ICANN standards. Most of that was internal staffing costs, with some also being spent on external security testing services.

The total operational cost for the first 10 months was $685,000. Before ICANN publishes its calendar Q4 financials later this month, we could extrapolate that the first 12 months of operation was around $800,000, but let’s be generous and stick with $685,000 for this particular envelope’s backside.

While there were 7,871 registered requesters at the end of November 2024, they had collectively only submitted 2,260 requests over the same period.

Only 2,057 of those requests had been closed at the end of the period, and only 23% of closed requests resulted in registrar approval and data being fully handed over to the requester.

That works out to 474 approved requests in the first year.

With the most-generous assumptions, $685,000 of ops costs divided by 2,260 requests equals $303 per request.

If we only count approved requests, we’re talking about $1,445 per successful Whois lookup equivalent.

But we should probably switch to an envelope with a larger rear end and include the $1.6 million development costs in our calculations too.

If we factor in half of those costs (it’s a two-year pilot), we’re looking at about $666 per request or $3,181 per successful request in the first 12 months.

If the system was more widely used, the per-request cost would of course fall under this calculation, but there’s no indication that usage is significantly on the increase just yet.

These are only the costs incurred to ICANN. Registrars on one side of the service and requesters on the other also bear their own costs of working with the service.

Dealing with RDRS is not the same as doing a Whois lookup. You have to deal with a much lengthier form, add attachments, make a reasoned legal case for your request, etc. It eats work-hours and staff need to be trained on the system.

It may seem that $3,181 to do a Whois lookup is too expensive for the ICANN taxpayer.

And maybe it is, if it’s being predominantly used to assist (say) Facebook’s trademark enforcement strategy.

But if those Whois lookups help law enforcement more quickly nail a gang of fentanyl dealers or child sexual abuse material distributors, maybe the costs are more than justified.

At the end of November the number of requests from law enforcement was 15.6% of the total, while IP holders accounted for 29.7%, ICANN stats show.

ICANN’s board of directors will decide towards the end of the year whether the RDRS pilot has been successful and whether it should continue indefinitely.

RDRS usage hits new low

ICANN’s Registration Data Request Service was used less often in October than in any other month since it launched a year ago, according to the latest statistics.

There were 131 requests for private Whois data in the month, down from the previous low of 141 recorded in May and September’s 189, the monthly report published by ICANN shows.

There were 98 closed requests — another new low — and the mix of granted/refused requests tilted more towards approval than usual, with almost 35% of requests being approved versus 56% denied.

While it took on average 3.41 days for requests to be approved, the average time for denial was an incredible 41.96 days.

Three new registrars joined the voluntary pilot program in October, giving RDRS coverage of 60% of registered gTLD domain names.

The monthly report breaks down the geographic location of requestors and the requestor type for the first time, showing that the US was by far the biggest, followed by the UK, France and Brazil, with American IP owners and law enforcement most likely to request data.

RDRS usage stabilizing?

Usage of ICANN’s experimental Registration Data Request Service may have hit what might in future pass for normal levels, with not a massive amount of fluctuation across several key statistics for the last few months.

But ICANN’s latest monthly stats report, published late last week, shows that July was the worst month so far in terms of closed Whois data disclosure requests, dipping into double digits for the first time since its launch in late 2023.

There were 164 disclosure request in July, down from 169 in June but up on May’s low point of 154. The mix of requester types tilted towards IP owners — 40% versus a lifetime average of 33% — while law enforcement was down.

Only 97 requests were closed during the period, a third consecutive all-time low down from 134 in June and 140 in May. Approved requests were at 22.72% while denied requests were at 65.79%, a slight improvement in terms of the approved/denied mix compared to June.

It took a bit longer to get a request approved in July — 9.3 days on average versus 6.59 in June and a lifetime average of 7.19 days. The median time-to-approval since launch is still two days.

Getting a request denied took about half as long in the period — 10.7 days versus 19.46 in June. The median value is also still two days.

Two new, smaller registrars — one Chinese, one Moroccan — joined the project, and none quit, leading to a total of 92. Registrar coverage remained at 59% of registered gTLD domains.

The number of RDRS queries for domains held at unsupported registrars was down at 27.86% compared to a lifetime average of 29.7% but up against June’s 23.31%.

RDRS stats improve a little in June

ICANN’s Registration Data Request Service saw a small improvement in usage and response times in June, but it did lose a registrar, according to statistics published today.

There were 170 requests for private Whois data in the month, up a little from May’s historic low of 153, and 20.88% were approved, compared to 20.29% in May.

The mean average response time for an approved request was down to 6.59 days, from 11.34 days in May and April’s huge 14.09 days. Since the RDRS project began last November, the median response time is two days.

Smaller registrar OwnRegistrar opted out of the program during the month, but the coverage in percentage terms held steady at 59%, with 90 registrars of various sizes still participating.

RDRS usage hits all-time low

Usage of ICANN’s Registration Data Request Service, which lets people submit Whois queries to registrars, hit a new low in May, six months after its launch.

RDRS was used to submit 156 requests for private Whois data in the period, the lowest number to date. In December, there were 173 requests; the peak was 290 the following month.

While requests from law enforcement held at 46, requests from IP holders, which had peaked at 117 in February, dipped a little between April and May, going from 43 to 37.

The mix between approved and denied requests was pretty much unchanged — about 20% of requests get approved and about 70% get denied.

The number of RDRS queries (domain lookups that don’t necessarily result in a request) was also at at all-time monthly low, at 1,393, from a December peak of 2,349 and April’s 1,435. Only a quarter of queries were for supported domains, down from 30% in April.

The wait time for approval shortened a little, having topped out at a massive 14 days in April, to an average of 11.34 days. Denials took on average 9.77 days.

Three more registrars joined the voluntary service in May, and none left. One of the newcomers was a second Alibaba accreditation, which brought in 3.5 million domains and raised the overall service coverage from 57% to 59% of all gTLD domains.

One way of spinning the numbers would be to say that RDRS users have become disillusioned with the service, another would be to say they are done kicking the tires and seeing what they can get away with, have discovered its limitations, and are now using it as intended.

ICANN restarts work on controversial Whois privacy rules

ICANN is to bring in new rules for Whois privacy and proxy services, the best part of a decade after they were first proposed to massive controversy.

It’s looking for volunteers to work with Org staff on implementing policy recommendations that in 2015 led to tens of thousands of people expressing outrage about the dangers, as they saw it, of their privacy being breached.

ICANN is putting together an Implementation Review Team to help implement the recommendations of the Privacy and Proxy Services Accreditation Issues Policy Development Process, known as PPSAI, which sought to bring privacy/proxy services under ICANN’s regulatory umbrella.

The recommendations were hugely controversial in their first draft, which in a minority statement expressed the view that people should be banned from using their domains commercially if they were using privacy services.

But the IRT will be tasked with implementing the final draft, which expunged the calls for such a ban.

The policy still calls for ICANN to run an accreditation system for privacy/proxy services in much the same way as it accredits registrars. It also lays out rules for how such services should gather registrant data and how to treat customer interactions.

But the recommendations are undeniably from a different era, thunk up before the EU’s General Data Protection Regulation made privacy-by-default essentially the industry standard for Whois records.

The PPSAI recommendations now interact with policies and practices that have been adopted in the intervening years, such as the recent Registration Data Policy and the Registration Data Request Service.

People willing to donate 10 to 20 hours a month to the new IRT can check out more details here.

It now takes TWO WEEKS to get a Whois record with RDRS

There’s been a shocking increase in the time it takes to get a Whois record disclosed under ICANN’s Registration Data Request Service, according to the latest monthly data.

It took on average 14.09 days to have a request for private Whois data approved using RDRS in April, more than double the previous high, recorded in February, of 6.92 days, the data shows. The average since the system launched at the end of November is 6.73 days.

The average time to have a request denied was 11.26 days, up from 6.17 days in March, the data also shows.

RDRS is a mechanism that allows people — largely intellectual property interests and law enforcement — to request unredacted domain ownership information. ICANN doesn’t handle the requests, it just forwards them to the responsible registrar.

It’s not obvious from the data why requests in April suddenly took so much longer to approve. Any number of reasons, from technical problems to a shift in the mix towards particularly sluggish registrars, could have thrown the average.

The percentage of requests that were approved was down very slightly compared to March, at 19.16% compared to 20.26%. Denied requests were up to 71.26% compared to 69.5% in March. Requests were largely denied because of data protection law or because the requester didn’t provide enough information.

Since RDRS launched five months ago, there have been 1,215 disclosure requests, 210 of which were approved. That works out to about 1.36 approved requests per day.

Registrar coverage improved a little in April, with three registrars newly listed and one (Sweden’s Ilait AB, which has about 6,000 domains) removed. The number of gTLD domains covered as a percentage remained flat at 57%.

ICANN has spent almost $2 million on RDRS to date. It’s a two-year pilot, and at some point it will have to be decided whether the expense is worth it.

Alibaba, Name.com among new RDRS opt-ins

Eleven registrars representing millions of domain names signed up to support ICANN’s Registration Data Request Service last month. One registrar dropped out.

One of Chinese tech giant Alibaba’s registrars was among the additions. Alibaba Cloud Computing (Beijing), which has 2.6 million names under management, is a notable addition given that one of its sister registrars was recently hit with an ICANN Compliance action due to alleged abuse inaction.

Also opting in to the Whois band-aid service were Identity Digital’s Name.com (2.2 million names), three of its sister companies, and Newfold Digital’s Register.com (1.5 million names). Nominalia, P.A Vietnam, and Ubilibet also signed up.

Realtime Register dropped out of the voluntary service, the third registrar to opt out since RDRS launched in Novemeber.

ICANN says its coverage is now 57% of the total gTLD domains out there, up from 55% in February. It has 86 registrars on-board in total, including most of the largest.

RDRS is a two-year pilot that offers people who want access to private Whois records, largely intellectual property interests and law enforcement, a simpler way to connect with the registrars holding that data.