ICANN to change domain whois registrations

[tangor]

The days of pretending to be Mickey Mouse or Daffy Duck when you register a domain name could be numbered, following demands placed on ICANN by law enforcement agencies and governments.

ICANN is currently locked in contract talks with its accredited domain name registrars, and expects they will agree to make the verification of customer identities mandatory later this year.

If the rule changes go ahead, registrars such as Go Daddy and Network Solutions could be obliged to ensure that the Whois database records submitted by their customers are accurate.

[theregister.co.uk...]

[bwnbwn]

I really can't figure out the deal here unless I missed something.

1- You are going to be required to prove your address on the domains you own. Prove one in an account all of them are approved. This will be repeated through the different registers you have names with.
2- Once proven your still able to do the privacy name hidden policy. Your personal info is still hidden all that has changed your now REALLY connected to the domain.

So what's the big deal owning up to whom you are?

[superclown2]

Yep - I think I will go into the Postal PO Box business for domain owners.

Agreed. Whatever measures are put in place, there will be those who will provide ways to circumvent them, for a fee. Result, the criminals will still stay anonymous and all the rest of us will suffer increased costs and the privacy implications.

[Sgt_Kickaxe]

I really can't figure out the deal here unless I missed something.

You have a site about widgets and I am in a position of power and want to oppose widgets for other reasons, I have an agenda. I look up your ICANN information and find your home, your phone number, your email address and I can begin a campaign against you personally.

I happen to have contacts with your boss, your email is now monitored and I'm exploiting what you say against you. You're a day late paying for your dogs license but instead of a reminder you now have animal control at your door and a fine. You spent lunch interviewing a new intern for work but your wife will see pictures with an anonymous warning that you're having an affair. etc..etc.

Point it, before you know it, you're needing a protective order (like others here have gotten over the years) just because, unlike other places that collect your personal information, your personal information is now very public.

The above sounds far fetched but messing with your life, even ruining it, isn't completely uncommon. IF someone starts down that road the only limits are those had by privacy and by court order - if you run a non-business website do you REALLY need it all out there?

More importantly does ICANN REALLY need to reveal it for everyone? I can't call the DMV, your bank or any other agency you deal with to get personal information about you (without court approval) so why should ICANN be any different?

Remember, if you have a legal and legitimate reason to contact me (or sue me) ICANN will provide what you seek if you ask properly, the issue is - should they provide it openly to everyone freely without cause? I see ICANN getting sued for failing to protect information when someone gets stalked and/or hurt by this.

edit: since it's pay the privacy fee or waive your privacy, which may not be entirely legal to start with. Hasn't been an issue, until now, since you were free to provide only partial or alternate information.

[edited by: Sgt_Kickaxe at 8:56 pm (utc) on Jan 31, 2012]

[netmeg]

Once proven your still able to do the privacy name hidden policy.

At up to double the cost of the domain. It's like the old phone book scam where it cost extra NOT to be listed in the phone book.

[bwnbwn]

It is still dirt cheap to register a domain and hide your info. Try leasing an office space and compare the cost. Try hiding your info on the lease this is the same thing.

A website is a business the laws need to be brought up to a level were your personal info is connected to that website. I have a good feeling when done there will be quite a few websites gone and domains up for sale.

[Brett_Tabke]

This will have more of a world wide impact on the Internet, that if both sopa and pipa would have passed.

> Try hiding your info on the lease this is the same thing.

Nonsense - it isn't even remotely the same thing. No one publishes your lease info. Whois is out there for every domain name spammer/sales rep/marketer/bad guy/terrorist to see.

[netmeg]

It is still dirt cheap to register a domain and hide your info.

Not if you have a sizable domain portfolio. And even if you don't - why should you have to pay one extra penny to keep your contact information private?

[commanderW]

A website is a business the laws need to be brought up to a level were your personal info is connected to that website. I have a good feeling when done there will be quite a few websites gone and domains up for sale.

Thanx :o
My website is not. Why does almost everyone here seem to think that all werbsites are businesses?
Many are publications. Should all writers who publish something have to post their real name, address, phone etc. in case they violate someones intellectual property rights?
Many are public services. Should everyone who publishes a link list of valuable resources, or tutorials on a certain subject have to publish their personal data just in case someone somewhere wants to tap their phone or kick down their door?
Furthermore - I have lost my job. In a very short time, I will have also lost my apartment (due to completely different circumstances). I will not have a mailing address for at least 6 months. Maybe a year. If I decide to travel, maybe more. Should I have my domain taken away ?

[lucy24]

Whoa. There are two entirely different things and they're getting hopelessly garbled.

#1 Personal information should exist somewhere.
#2 Personal information should be publicly accessible.

o/t

I will not have a mailing address for at least 6 months.

Don't know about the rest of the world, but in the US, physical address and mailing address are entirely different things. Homeless people can register to vote. PO boxes are available to everyone, mail can be forwarded to another recipient, and most places still have General Delivery.

[zeus]

I have the solution, they can get those info, but then nobody then have access to the whois only with court order. Anyhow I think its a pain that all those scraper sites use all those whois info for content. I think whois should be private for the public.

[stormy]

Real Whois information has always been mandatory. You can even request ICANN to delete a domain name with false contact info. All registrars are required to send a yearly renewal remonder of this policy.

What's the news here?

[Sgt_Kickaxe]

"ICANN expects that the RAA will incorporate – for the first time – Registrar commitments to verify WHOIS data," CEO Rod Beckstrom told the US Department of Commerce earlier this month.

What that means to the average webmaster

~ Increased .com prices to cover the added expense/time your registrar will need to confirm your identity, even if you provided the real identity to ICANN all along.

~ Your personal information is held for ransom, pay the verification costs + privacy costs or have your information in the wind for anyone to use as they want.

This, in my opinion, has nothing to do with hiding - it has to do with a broken system in which your privacy is STILL not a priority. You USED to be able to give 555-5555 as a phone number to ICANN (with real number to your host) to protect your privacy but now you won't be able to AND privacy concerns are still NOT fixed first. It's a very real problem.

I have the solution, they can get those info, but then nobody then have access to the whois only with court order.

Exactly, every regular joe in the web doesn't need your home number/address just because you once ran a fishing blog. The information should not be publicly available to begin with BUT if it wasn't ICANN would not be able to charge hefty privacy fees... so they never fixed it. This presses the issue. The fix is to make everyone's information PRIVATE by default unless you want your business name (if you have one) displayed publicly or someone is suing/charging you. ICANN won't do that because they'd be losing a cash cow, privacy fees are equal to registration costs right now. Privacy advocates are gearing up for a fight right now, the problem needs to be fixed.

[stormy]

ICANN doesn't make a dime on private Whois services, Registrars do.

[commanderW]

Hi Lucy24. It seems my first 2 points were obscured by the mundane personal note added at the end.
#1 Many websites are publications
#2 Many websites are public services
#3 Add many, many other non business uses of the WWW by private citizens.
The Internet is not just a giant business machine built for ecommerce.
A requirement that domain holders should have to 'verify' their identity just in case one of them breaks the law (and that is exactly what this is about) is an authoritarian attitude that has no place in the real world. In America it is 'unamerican' (please reread the Constitution and the Bill of Rights).
In 'less enlightened' areas of the world, it is a recipe for despotism. An ICANN policy requiring this worldwide would eventually result in the torture, rape and murder of many many 1000's of innocent individuals. Have no doubt.
If you were an Egyptian with a website how would you feel about such a regulation, knowing that rousing the ire of the bizarre Egyptian security forces can get a person (male or female) tortured and raped (this was reported during mainstream news coverage of the 'Jasmine Revolution, and published news videos of security forces tearing the clothes off protesters in the streets lend credence to it). And then there's places like Syria. North Korea, etc. etc. etc.

As for my boring life in America, this was intended as a simple real world example of how a requirement for I.D. verification might have a negative impact, if it involves brick and mortar addresses. Your alternative suggestions don't stand up to real world experience.
-You need a mailing address to get a post office box :) and they also cost a lot of money, where I am right now for instance.
- Mail cannot always be forwarded. If you have a mail box that is not an official U.S. Postal Service box, the U.S. Postal Service refuses to provide mail forwarding ;)
-General delivery to every city I visit as I hop from city to city desperately looking for a new job and a new place to live before my money runs out?
Please stop coming up with excuses why there are no excuses :S
1- I should not have to worry about all these arbitrary complications.
2- I should not have to prove anything to anybody for my right to publish, on the internet.

There is an authoritarian mentality taking hold of people these days which says that If you're not doing anything wrong, you don't have anything to worry about'.
That attitude is going to smother many peoples hopes and dreams, and ruin many peoples lives. Eventually it will get us all killed.

[lucy24]

Heh. And there I went to the trouble of re-wording my post because I didn't know if you were talking about real life or throwing out a hypothetical example.

Is someone proposing a rule mandating continuous updates of contact information, the way the DMV says you have to every time you move (but nobody really does)? Or having to get ICANN's permission to go on vacation? Otherwise, you only need to exist once a year.

I'm thinking unlisted phone numbers. The phone company knows what name goes with what number, but other people can't just call Directory Assistance and ask for it.

Someone else is probably thinking: Yes, but emergency services have an override so they know who's calling 911* even if you're unlisted. And what's to stop the bad guys from getting hold of the same technology?


* Or 999 or equivalent. C'mon, work with me here.

[graeme_p]

It is likely to put the cost of registrations up quite significantly

My experience of "commercial verification services" is that if you have recently moved or live the the wrong country they cannot verify you at all.

It will not help at all in dealing with fraud: people who commit serious frauds will know how to fake their identity and address).

This is based on the assumption that the internet is purely for commercial transactions, and ignores the fact that private individuals publish stuff (which politicians would rather then did not, of course - they are harder to spin).

The .uk domains require correct contact info - but it can be hidden from public whois by "non trading" private individuals. There is also no real need to verify it.

[oodlum]

Those here worried about the privacy issue - do you currently use fake information to register your domain names? That would make the purchase contract null and void in the first place (like any other contract). As they are not legally your domain names you should be prepared to lose them.

I've done it myself a few times for disposable sites, but would not complain if they were taken back.

[jecasc]

Those who want to hide will find a way - fake IDs or whatever is used for the identification process.

It is a typical example of security theater [en.wikipedia.org]. Not improving any security at all but only costing those money who don't do anything wrong in the first place.

[Maurice]

@woop01 yes how is this differnt to traditional publishers in other media who publish their address or companies having to register with companies house.

@Brett_Tabke I doubt that domain info is going to be that usefull a source for "stalkers"

[Maurice]

@commanderW in most jurestrictions publishers do have to publish their contact details.

[jecasc]

yes how is this differnt to traditional publishers in other media who publish their address or companies having to register with companies house.

You ALREADY HAVE to use you're correct address information. Else you can loose the domain. The question is: Do we need an additional costly verifcation process?

I do not think we do. And I believe new regulations should only be implemented if there is an additional benefit. "I don't mind" or "I am not affected" is not an additional benefit.

[Maurice]

@jecasc well if its cuts down on low quality scraper domains (that rip off my sites) and makes hosting phishing sites harder I am all for it :-)

[Brett_Tabke]

>You ALREADY HAVE to use you're correct address information.

As other mentioned - no you don't. Most of the major registrars currently offer 'private registrations'. Obviously - all that will go away with the new rules.

[tigger]

What effect will this have with other TLDs such as .co.uk ? thats controlled by Nominet ?

[jecasc]

@jecasc well if its cuts down on low quality scraper domains (that rip off my sites) and makes hosting phishing sites harder I am all for it :-)

If I have a criminal intent I go down on the street, give a homeless guy 20$ for his ID and register the domain on his name.

This is all cost, no gain.

[Samizdata]

What effect will this have with other TLDs such as .co.uk

English law (I believe) already requires any business website to include full contact details on the site itself, as well as in the Whois.

Non-business domain owners can, however, opt for Whois privacy free of charge.

This seems sensible and acceptable to me, though I doubt that it is rigorously policed.

Other countries have their own rules with varying degrees of strictness.

Don't forget that com/org/net are meant to be global.

...

[bwnbwn]

Brett maybe I am wrong I found my lease when searching due to work being done through the city but I will admit I used a bad example.

Would most of us agree here we use our domains as a business?

Can we agree that most internet sites are used for the purpose or represent a business?

If that is the case give me 1 good reason I would want to us a fake name and address on registering a business.

[randle]

Whatever the "law" becomes, with a little ingenuity or money, there will always be ways to effectively deal with it. So if you feel strongly about keeping your ownership of a site private life will go on as you know it, fear not.

However, regardless of the degree to which you wish (or dont wish) to distance your self from this type of easily accessible information, there is a matter of appearance. "Who Is" information is part and parcel of life as we know it in the internet business world. That tooth paste is out of the tube and there's no way to get it back in; people look at who is information as a means to get some sense of a web site they have interest in, and yes a site they may have a problem with.

Presenting well thought out, uniform looking and helpful who is information does not mean including your personal cell phone number and home address; actually far from it.

People are in fact looking at the who is information for your sites; its really more of a question of what you want them to see and the impression they get than what type of crazy law comes about.

[vivalasvegas]

I agree with the opinion that whois info should be properly verified but kept private by default. It's up to me whether or not I want/need to post full contact information on the website itself (depending on business type).

[rogerd]

Third party domain privacy should still work, as far as I can tell. It's just one more corporate barrier. I.e., if I own a corporation that holds the domain, it's the biz info that's listed, not mind. And there could be multiple levels of businesses with ownership or contractual relationships. While this could be unraveled with the proper court orders, random prying would be impossible.