Whois privacy supporters to top 20,000

Over 20,000 people have put their names to statements slamming proposals that would ban some commercial web sites from using Whois privacy on their domains.
ICANN’s public comment period on a working group’s Whois privacy reform proposals closes today after two months, with roughly 11,000 individual comments — the vast majority against changes that would weaken privacy rights — already filed.
Separately, Michele Neylon of Blacknight Solutions, which hosts SaveDomainPrivacy.org, tells DI that a petition signed by more than 9,000 people will be submitted to ICANN tonight.
If we count the signatories as commenters, that would make this the largest ICANN comment period to date, outstripping the 14,000 comments received when religious groups objected to the approval of .xxx in 2010.
SaveDomainPrivacy.org and RespectOurPrivacy.org, separate registrar-led initiatives, are responsible for the large majority of comments.
While registrars no doubt have business reasons for objecting to the muddling the Whois privacy market, their letter-writing outreach has been based on their claims that they could be forced to unmask the Whois of vulnerable home-business owners and such.
The Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) report, published in May, sketches out a framework that could allow intellectual property owners to have privacy removed from domains they suspect of hosting infringing content.
A minority position appended to the report by MarkMonitor, Facebook, LegitScript and supported by members of the Intellectual Property and Business Constituencies, would put a blanket ban on using privacy on domains used to commercially transact.

ICANN dragged into Gamergate as Whois reform cast as misogynist threat

What do ICANN’s current Whois privacy reform proposals have to do with the “Gamergate” controversy?
Quite a lot, according to the latest group to slam the proposals as an enabler for “doxing… harassment… swatting… stalking… rape and death threats.”
The Online Abuse Prevention Initiative was formed in March by female software developers in the wake of a sexism slash online abuse scandal that continues to divide the video game community.
Led by Randi Harper, OAPI’s first public move was to today write to ICANN to complain about the GNSO Privacy & Proxy Services Accreditation Issues (PPSAI) Working Group Initial Report.
The report, as previously reported, contains a minority opinion that would ban transactional e-commerce sites from using Whois privacy services.
OAPI said today that this posed a risk of “doxing” — the practice of publishing the home address and other personal information about someone with the aim to encourage harassment — and “swatting”, where people call up America’s notoriously trigger-happy cops to report violent crimes at their intended victim’s home address.
Harper, who was one of the targets of the Gamergate movement (Google her for examples of the vitriol) claims to have been a victim of both. The OAPI letter says she “was swatted based on information obtained from the WHOIS record for her domain.”
The letter, which is signed by groups including the Electronic Frontier Foundation, the National Network to End Domestic Violence, the National Council of Women’s Organizations, and dozens of noted digital rights voices, says:

We strongly oppose the Working Group’s proposal, which will physically endanger many domain owners and disproportionately impact those who come from marginalized communities. People perceived to be women, nonwhite, or LGBTQ are often targeted for harassment, and such harassment inflicts significant harm
…
Even the most limited definition of a “website handling online financial transactions for commercial purpose” will encompass a wide population that could be severely harmed by doxing, such as:

• women indie game developers who sell products through their own online stores
• freelance journalists and authors who market their work online
• small business owners who run stores or businesses from their homes
• activists who take donations to fund their work, especially those living under totalitarian regimes
• people who share personal stories online to crowdfund medical procedures

To make things worse, the proposed definition of what constitutes “commercial purpose” could be expanded to include other types of activity such as running ads or posting affiliate links.

The letter does not directly refer to Gamergate, but some of the signatories are its most prominent victims and the allusions are clearly there.
Gamergate is described somewhere in its 9,000-word Wikipedia article as “part of a long-running culture war against efforts to diversify the traditionally male video gaming community, particularly targeting outspoken women.”
At its benign end, it was a movement for stronger ethics in video game journalism. At its malignant end, it involved quite a lot of male gamers sending abuse and violent threats to female players and developers.
The PPSAI report is open for comment until July 7. It has so far attracted over 10,000 emails, most of them rustled up by registrar letter-writing campaigns here and here.

Go Daddy advertising privacy petition on Facebook

Go Daddy appears to be putting its money where its mouth is when it comes to arguments about domain privacy.
The company is paying for “sponsored” posts on Facebook that promote the ongoing petition against proposed changes to Whois policy at ICANN.
This has been appearing on Facebook for me all day, seriously interrupting my Farmville time:

Clicking the ad takes you directly to the Save Domain Privacy petition, rather than a Go Daddy sales pitch.
As I reported last week, thousands of internet users have blasted ICANN with template comments complaining about proposed limits on Whois privacy.
There are currently over 10,000 such comments, I estimate, with over a week left until the filing deadline.
Registrars, Go Daddy among them, are largely concerned about a minority proposal emerging from in a proxy/privacy service accreditation working group that would ban transactional e-commerce sites from having private registrations.
They’re also bothered that intellectual property owners could get more rights to unmask privacy users under the proposals.
Despite Go Daddy’s outreach, Repect Our Privacy, letter-writing campaign, backed by NameCheap and the Electronic Frontier Foundation, seems to be responsible for most of the comments filed to date.
Not that it’s necessarily relevant today, but NameCheap and Go Daddy were on opposing sides of the Stop Online Piracy Act debate — a linked controversy — a few years back.

Registrars open floodgate of Whois privacy outrage

A letter-writing campaign orchestrated by the leading domain registrars has resulted in ICANN getting hit with over 8,000 pro-privacy comments in less than a week.
It’s the largest volume of comments received by ICANN on an issue since right-wing Christian activists deluged ICANN with protests about .xxx, back in 2010.
The comments — the vast majority of them unedited template letters — were filed in response to the GNSO Privacy & Proxy Services Accreditation Issues (PPSAI) Working Group Initial Report.
That report attempts to bring privacy and proxy services, currently unregulated by ICANN, under ICANN’s contractual wing.
There are two problematic areas, as far as the registrars are concerned.
The first is the ability of trademark and copyright owners to, under certain circumstances, have the registrant of a privately registered name unmasked.
Upon receiving such a request, privacy services would have 15 days to obtain a response from their customer. They’d then have to make a call as to whether to reveal their contact information to the IP owner or not.
Possibly the most controversial aspect of this is described here:

Disclosure cannot be refused solely for lack of any of the following: (i) a court order; (ii) a subpoena; (iii) a pending civil action; or (iv) a UDRP or URS proceeding; nor can refusal to disclose be solely based on the fact that the request is founded on alleged intellectual property infringement in content on a website associated with the domain name.

In other words, the privacy services (in most cases, also the registrar) would be forced make a judgement on whether web site content is illegal, in the absence of a court order, before removing Whois privacy on a domain.
The second problematic area is an “additional statement” on domains used for commercial activity, appended to the PPSAI report, penned by MarkMonitor on behalf of Facebook, LegitScript, DomainTools, IP attorneys Smith, Gambreall & Russell, and itself.
Those companies believe it should be against the rules for anyone who commercially transacts via their web site to use Whois privacy.
Running ads on a blog, say, would be fine. But asking for, for example, credit card details in order to transact would preclude you from using privacy services.
The PPSAI working group didn’t even approach consensus on this topic, and it’s not a formal recommendation in its report.
Regardless, it’s one of the lynchpins of the current registrar letter-writing campaigns.
A page at SaveDomainPrivacy.org — the site backed by dozens of registrars big and small — describes circumstances under which somebody would need privacy even though they engage in e-commerce.
Home-based businesses, shelters for domestic abuse victims that accept donations, and political activists are all offered up as examples.
Visitors to the site are (or were — the site appears to be down right now (UPDATE: it’s back up)) invited to send a comment to ICANN supporting:

The legitimate use of privacy or proxy services to keep personal information private, protect physical safety, and prevent identity theft
The use of privacy services by all, for all legal purposes, regardless of whether the website is “commercial”
That privacy providers should not be forced to reveal my private information without verifiable evidence of wrongdoing

The content of the site was the subject of a sharp disagreement between MarkMonitor and Tucows executives last Saturday during ICANN 53. I’d tell you exactly what was said, but the recording of the relevant part of the GNSO Saturday session has not yet been published by ICANN.
Another site, which seems to be responsible for the majority of the 8,000+ comments received this week, is backed by the registrar NameCheap and the digital civil rights groups the Electronic Frontier Foundation and Fight For The Future.
NameCheap appears to be trying to build on the reputation it started to create for itself when it opposed the Stop Online Piracy Act a few years ago, going to so far as to link the Whois privacy reforms to SOPA on the campaign web site, which says:

Your privacy provider could be forced to publish your contact data in WHOIS or even give it out to anyone who complains about your website, without due process. Why should a small business owner have to publicize her home address just to have a website?
We think your privacy should be protected, regardless of whether your website is personal or commercial, and your confidential info should not be revealed without due process. If you agree, it’s time to tell ICANN.

The EFF’s involvement seems to have grabbed the attention of many reporters in the general tech press, generating dozens of headlines this week.
The public comment period on the PPSAI initial report ends July 7.
If it continues to attract attention, it could wind up being ICANN’s most-subscribed comment period ever.
Do geeks care about privacy more than Christians care about porn? We’ll find out in a week and a half.

Group uses FOI to demand entire .nyc Whois database

Former .nyc hopeful Connecting.nyc has requested a dump of the entire .nyc Whois database using freedom of information legislation.
According to a blog post, the group has filed a request under the New York Freedom of Information Law for all 75,000 Whois records.
Connecting.nyc says it wants the data in order to plot every .nyc registrant on a map of the city to see “if the name purchasers were spread evenly over the city or concentrated in a particular neighborhood or borough. And if they were from a particular social or economic strata.”
It says it has spent 10 weeks asking for the data via email but has been rebuffed.
Under ICANN Registry Agreements, registries are under no obligation to offer bulk Whois access. Registrars are supposed to allow it under their accreditation agreements, but are allowed to charge huge sums.
The .nyc space does not allow private registrations. Its Whois data is all publicly accessible and could conceivably be mined via sequential queries.
The new gTLD is managed by Neustar but assigned to the City of New York, making it essentially government-owned.
It will be interesting to see whether Whois access falls under FOI law. Many other geographic gTLDs have government links and may fall under their own respective FOI legislation.
Connecting.nyc once intended to apply for .nyc itself, but is now a sort of self-appointed community watchdog for the gTLD. It’s an At-Large structure within ICANN.

Whois privacy reforms incoming

Whois privacy services will become regulated by ICANN under proposals published today, but there’s a big disagreement about whether all companies should be allowed to use them.
A working group has released the first draft of its recommendations covering privacy and proxy services, which mask the identity and contact details of domain registrants.
The report says that P/P services should be accredited by ICANN much like registrars are today.
Registrars should be obliged to disclose which such services they operate or are affilated with, presumably at the risk of their Registrar Accreditation Agreement if they do not comply, the report recommends.
A highlight of the paper is a set of proposed rules governing the release of private Whois data when it is requested by intellectual property interests.
Under the proposed rules, privacy services would not be allowed to reject such requests purely because the alleged infringement deals with the content of a web site rather than just the domain.
So the identity of a private registrant of a non-infringing domain would be vulnerable to disclosure if, for example, the domain hosted bootleg content.
Registrars would be able to charge IP owners a nominal “cost recovery” fee in order to process requests and would be able to ignore spammy automated requests that did not appear to have been manually vetted.
There’d be a new arbitration process that would kick in to resolve disputes between IP interests and P/P service providers.
The 98 pages of recommendations (pdf) were drafted by the Generic Names Supporting Organization’s Privacy & Proxy Services Accreditation Issues Working Group (PPSAI) and opened for public comment today.
There are a lot of gaps in the report. Work, it seems, still needs to be done.
For example, it acknowledges that the working group didn’t reach any conclusions about what should happen when law enforcement agencies ask for private data.
The group was dominated by registrars and IP interests. There was only one LEA representative and only one governmental representative, and they participated in a very small number of teleconferences.
There was also a sharp division on the issue of who should be able to use privacy services, with two dissenting opinions attached to the report.
One faction, led by MarkMonitor and including Facebook, Domain Tools and fake pharmacy watchdog LegitScript, said that any company that engages in e-commerce transactions should be ineligible for privacy, saying: “Transparent information helps prevent malicious activity”.
Another group, comprising a handful of non-commercial stakeholders, said that no kind of activity should prevent you from registering a domain privately, pointing to the example of persecuted political groups using web sites to raise funds.
There was a general consensus, however, than merely being a commercial entity should not alone exclude you from using a P/P service.
Currently, registrar signatories to the 2013 RAA are bound by a temporary P/P policy that is set to expire January 2017 or whenever the P/P accreditation process starts.
There are a lot of recommendations in the report, and I’ve only touched on a handful here. The public comment period closes July 7.

Google leaks 282,000 private Whois records

Google has accidentally revealed registrant contact information for 282,867 domain names that were supposed to be protected by a privacy service.
The bug reportedly affected 94% of the 305,925 domains registered via Google Apps, an eNom reseller.
The glitch was discovered by Cisco and reported to Google February 19. It has since been fixed and customers were notified yesterday.
Google acknowledged in an email to customers that the problem was caused by a “software defect in the Google Apps domain renewal system”.
It seems that anyone who acquired a domain with privacy through Google Apps since mid-2013 and has since renewed the registration will have had their identities unmasked in Whois upon renewal.
Names, addresses, emails and phone numbers were revealed.
Due to services such as DomainTools, which cache Whois records, there’s no putting the genie back in the bottle. The information is out there for good now.
It’s a pretty major embarrassment for Google, which recently launched its own registrar.

Nominet to give nod to .uk privacy services

Nominet plans to start accrediting proxy/privacy services in .uk domain names, and to make it easier to opt-out of having your full contact details published in Whois.
The proposed policy changes are outlined in a consultation opened this morning.
“We’ve never recognized privacy services,” director of policy Eleanor Bradley told DI. “If you’ve registered a .uk with a privacy service, we consider the privacy service to be the registrant of that domain name.”
“We’ve been pretending almost that they didn’t exist,” she said.
Under the proposed new regime, registrars would submit a customer’s full contact details to Nominet, but Nominet would publish the privacy service’s information in the domain’s Whois output.
Nominet, getting its hands on the customer data for the first time, would therefore start treating the end customer as the true registrant of the domain.
The company says that introducing the service would require minimal work and that it does not intend to charge registrars an additional fee.
Currently, use of privacy services in .uk is pretty low — just 0.7% of its domains, up from 0.09% a year ago.
Bradley said such services are becoming increasingly popular due to some large UK registrars beginning to offer them.
One of the reasons for low penetration is that quite a lot of privacy is already baked in to the .uk Whois database.
If you’re an individual, as opposed to a “trading” business, you’re allowed to opt-out of having any personal details other than your name published in Whois.
A second proposed reform would make that opt-out available to a broader spectrum of registrants, Nominet says.
“We’ve found over the last few years that it’s quite a hard distinction to draw,” Bradley said. “We’ve had some criticisms for our overly strict application of that.”
In future, the opt-out would be available according to these criteria:

i. The registrant must be an individual; and,
ii. The domain name must not be used:
a) to transact with customers (merchant websites);
b) to collect personal data from subjects (ie data controllers as defined in the Data Protection Act);
c) to primarily advertise or promote goods, services, or facilities.

The changes would allow an individual blogger to monetize her site with advertising without being considered a “trading” entity, according to Nominet.
But a line would be drawn where an individual collected personal data on users, such as email addresses for a mailing list, Bradley said.
Nominet says in its consultation documents:

Our continued commitment to Nominet’s role as the central register of data will enable us to properly protect registrants’ rights, release contact data where necessary under the existing exemptions, and maintain public confidence in the register. It acknowledges that some registrants may desire privacy, whilst prioritising the core function of the registry in holding accurate records.

The proposals are open for comments until June 3, which means they could potentially become policy later this year.

DreamHost hit with big breach notice

DreamHost, a web hosting provider which says it hosts over 1.3 million web sites, has been hit with a lengthy ICANN compliance notice, largely concerning alleged Whois failures.
The breach notice raises questions about the company’s popular free Whois privacy service.
Chiefly, DreamHost has failed to demonstrate that it properly investigates Whois inaccuracy complaints, as required by the Registrar Accreditation Agreement, according to ICANN.
The notice contains numerous other complaints about alleged failures to publish information about renewal fees, its directors and abuse contacts on its web site.
The domain highlighted by ICANN in relation to the Whois failure is senect.com

ICANN sent three compliance notices to DreamHost concerning a Whois inaccuracy report for the domain name and requested DreamHost demonstrate that it took reasonable steps to investigate the Whois inaccuracy claims. DreamHost’s failure to provide documentation demonstrating the reasonable steps it took to investigate and correct the alleged Whois inaccuracy is a breach of Section 3.7.8 of the RAA.

Weirdly, senect.com has been under private registration at DreamHost since the start of 2012.
ICANN seems to be asking the registrar to investigate itself in this case.
DreamHost offers private registration to its customers for free. It populates the Whois with proxy contact information and the registrant name “A Happy DreamHost Customer”.
DomainTools associates “A Happy DreamHost Customer” with over 710,000 domain names.
As an accredited registrar, DreamHost had over 822,000 gTLD domain names at the last count. According to its web site, it has over 400,000 customers.
The breach notice also demands the company immediately start including the real contact information for its privacy/proxy customers in its data escrow deposits.
ICANN has given the company until November 21 to resolve a laundry list of alleged RAA breaches, or risk losing its accreditation.

A million domains taken down by email checks

Over 800,000 domain names have been suspended since the beginning of the year as a result of Whois email verification rules in the new ICANN Registrar Accreditation Agreement.
That’s according to the Registrars Stakeholder Group, which collected suspension data from registrars representing about 75% of all registered gTLD domain names.
The actual number of suspended domains could be closer to a million.
The 2013 RAA requires registrars to verify the email addresses listed in their customers’ Whois records. If they don’t receive the verification, they have to suspend the domain.
The RrSG told the ICANN board in March that these checks were doing more harm than good and today Tucows CEO Elliot Noss presented, as promised, data to back up the claim.
“There have been over 800,000 domains suspended,” Noss said. “We have stories of healthcare sites that have gone down, community groups whose sites have gone down.”
“I think we can safely say millions of internet users,” he said. “Those are real people just trying to use the internet. They are our great unrepresented core constituency.” 
The RrSG wants to see contrasting data from law enforcement agencies and governments — which pushed hard for Whois verification — showing that the RAA requirement has had a demonstrable benefit.
Registrars asked at the Singapore meeting in March that law enforcement agencies (LEA) be put on notice that they can’t ask for more Whois controls until they’ve provided such data and ICANN CEO Fadi Chehade said “It shall be done by London.”
Noss implied that the majority of the 800,000 suspended names belong to innocent registrants, such as those who had simply changed email addresses since registering their names.
“What was a lovely political win that we said time and time again in discussion after discussion was impractical and would provide no benefit, has demonstrably has created harm,” Noss said.
He was received with cautious support by ICANN board members.
Chair Steve Crocker wonder aloud how many of the 800,000 suspended domains are owned by bad guys, and he noted that LEA don’t appear to gather data in the way that the registrars are demanding.
“We were subjected, all of us, to heavy-duty pressure from the law enforcement community over a long period of time. We finally said, ‘Okay, we hear you and we’ll help you get this stuff implemented,'”, he added. “That creates an obligation as far as I’m concerned on their part.”
“We’re in a — at least from a moral position — in a strong position to say, ‘You must help us understand this. Otherwise, you’re not doing your part of the job'”, he said.
Chehade also seemed to support the registrars’ position that LEA needs to justify its demands and offered to take their data and concerns to the LEA and the Governmental Advisory Committee.
“They put restrictions on us that are causing harm, according to these numbers,” he said. “Let’s take this back at them and say, hey, you ask for all these things, this is what happened.”
“If you can’t tell me what good this has done, be aware not to come back and ask for more,” he said. “I’m with you on this 100%. I’m saying let’s use the great findings you seem to have a found and well-package them in a case and I will be your advocate.”
Director Mike Silber also spoke in support of the RrSG’s position.
“My view is if what you are saying is correct, the LEA’s have blown their credibility,” he said. “They’re going to have to do a lot of work before we impose similar disproportional requirements on actors that are not proven to be bad actors.”
So what does this all mean for registrants?
I don’t think there’s any ongoing process right now to get the Whois verification requirements overturned — that would require a renegotiation of the RAA — but it does seem to mean demands from governments and police are going to have to be much more substantiated in future.
Noss attempted to link the problem to the recommendations of the Whois Expert Working Group (EWG), which propose a completely revamped, centralized Whois system with much more verification and not much to benefit registrants.
To paraphrase: if email verification causes so much harm, what harms could be caused by the EWG proposal?
The EWG was not stuffed with LEA or governments, however, so it couldn’t really be characterized as another set of unreasonable demands from the same entities.