ICANN Proposal To Reveal Persons Identity When Whois Registration is Private

even without a court order or subpoena to privacy service disclosure

[engine]

If you protect your privacy by using a proxy registration service, under ICANN's latest proposals, it will no longer be necessary to obtain a court order or subpoena requiring a proxy registration service to reveal the details of the individual. In some instances, this could be a significant security risk.

You can read the full document here (98 page PDF) [gnso.icann.org...]

There's less than two weeks to go in the public consultation, so if you have an observation/objection, you may wish to get in quick.

[icann.org...]

[toidi]

The registrars must be having a fit by now. I spend a lot of money every year hiding my name and if this goes through i won't be spending that money.

[farmboy]

Has anyone read any statements from any registrars stating how they plan to deal with this? Refunds for anyone who has purchased privacy? Cancellation of privacy services?

FarmBoy

[engine]

Remember, this is only a proposal at the moment.

[bill]

A scary proposal. There are so many potential security and privacy issues here. I don't see how it could go through, but then we're talking about ICANN here...

[Nutterum]

I don`t get the idea of why this is such a big problem for the domain holders. You don`t have any problem revealing your name under public register, when you open a firm, or buy a car or a house, but suddenly when your name is revealed under your domains that a big scary thing? I call this paranoia.

The only issue is that there will be a lot more work for scrappers looking to bruteforce the domain holder e-mail in hopes of generating email spam lists, nothing a good e-mail firewall service can`t fix.

So again what is the real issue here?

[Tonearm]

I don`t get the idea of why this is such a big problem for the domain holders. You don`t have any problem revealing your name under public register, when you open a firm, or buy a car or a house, but suddenly when your name is revealed under your domains that a big scary thing? I call this paranoia.

What is your full name, address, and phone number?

[Xpat]

I run a forum site. I run it in a country that has a lot of dysfunctional English speaking jerks. They find English language forums like mine, people with nothing to do but troll all day. In the eleven years it's been online I've had my share of threats from the internet's detritus.

So, am I now to accept that my home address is to be published for anyone to see? There are weirdos out there that think it's good fun to harass forum admins and moderators. I'll shut the site down and write off the profit as an unforeseen loss before I let that happen. I have kids.

[edited by: Xpat at 3:45 pm (utc) on Jun 26, 2015]

[engine]

Xpat, I agree, and it's not just what you describe. I have a female friend that, in the past, was stalked in the offline world, and she now runs a help and support group for others that are now in her previous predicament. Is she now to expose her details to those other than law enforcement? For some it's a very serious change.

Make sure you all put your objections to ICANN in the consultation. At the time of writing this, there's only 12-days left. Here's the form. [s.zoomerang.com...]

[Selen]

On the other hand, domain registrars have absolutely no problem disabling websites when a webmaster failed to check email to confirm 'domain ownership.' They have no problem because they don't lose any money when a site is disabled.

This proposal will affect their earnings so.. they suddenly care and speak in one voice.

[japonicus]

Maybe I'm missing something, but I can't see where in the linked ICANN proposal it suggests that regular people could compel a proxy service to give out private details. The proposal mostly appears to be aimed at standardizing how registrars deal with request from law enforcement agencies; attorneys (service of cease-and-desist notices etc.) and complaints about malware hosting.

There's also a suggestion that websites that conduct financial transactions (online shops etc.) might be banned from using anonymization - which broadly seems reasonable.

I can't see much to worry about.

[keyplyr]

How about all the registrations w/ bogus admin/tech info: [e-mail]

[lucy24]

bogus admin/tech info:

Isn't that up to the registrar? Some will raise holy hell if they learn that any part of your contact info is bogus*; others won't care. Is there a "beyond the pale" point at which ICANN will yank your registrar authorization if you're too blatant about accepting nonsense?


* Look at enough fine print and sooner or later you'll find someone registered in your very own town, with a mailing address that's equivalent to the middle of the East River.

[farmboy]

I don`t get the idea of why this is such a big problem for the domain holders. You don`t have any problem revealing your name under public register, when you open a firm, or buy a car or a house, but suddenly when your name is revealed under your domains that a big scary thing? I call this paranoia.

The only issue is that there will be a lot more work for scrappers looking to bruteforce the domain holder e-mail in hopes of generating email spam lists, nothing a good e-mail firewall service can`t fix.

So again what is the real issue here?]

I don't look at it as a big problem right now. Too many other things to do.

But I recall years ago when someone showed up at my door after getting my home address from W---S. That was easy for anyone with a small bit of knowledge to obtain and that's when I learned about making things private as much as possible. I don't consider it as so much paranoid, but I wonder what will happen to everyone who runs their business from home if that privacy is removed.

How many people announce on social media they will be out-of-town and away from home next weekend?

FarmBoy

[Samizdata]

In the world of publishing, the impressum, colophon and imprint have been around almost as long as printing itself, and most countries have long had laws requiring publishers to include their full details with each publication.

The reason is to do with accountability - there have always been people who are happy to publish lies and libels or whatever the government of the day considers an official secret or sedition.

The advent of the web has massively expanded the publishing field (and added huge potential for fraud) but the principle remains the same.

Publishing, by definition, is not a private activity.

In Europe, all business websites are legally obliged to publish a snailmail address (usually the registered office) on the website itself. Personal (non-business) websites are treated the same way in Germany, Austria and Switzerland regardless of TLD.

Registrants of UK personal websites (non-business and no PPC advertising) can opt out of the public WHOIS free of charge, but are required to provide accurate details to Nominet (the governing registrar), who will doubtless pass them on to the authorities on request.

Anyone who wants to keep their home address obscured for whatever reason can use an accommodation address (though not a PO Box) - the important point is that the publisher can be reached if any legal issues arise.

Publishing, by definition, is not a private activity.

What is your full name, address, and phone number?

These appear at the top of every page on my business website.

They also appear in the phone book (if such things still exist) and have done for many years.

...

[Tonearm]

So this ICANN proposal would reduce the level of privacy enjoyed by webmasters to a level lower than that currently enjoyed in Europe.

[cabbie]

I still have plenty og bogus names and addresses on my whois.As long as I have access to the email to confirm ownership, I have never had any trouble with fake whois.
I even went through a ICANN dispute over the rights of a domain with a fake identity and the the arbitration was none the wiser and I won it!

[Samizdata]

So this ICANN proposal would reduce the level of privacy enjoyed by webmasters to a level lower than that currently enjoyed in Europe.

No - as stated, Europe requires publication of details on the website itself if it is commercial, and German-speaking countries apply the same rule to all websites (even purely personal ones).

The UK system seems reasonable to me - there is no charge to have details removed from WHOIS for purely personal websites, but steps are taken to verify that the details are correct and the registrant will not be shielded from any legal issues.

As I understand it, ICANN proposes to stop allowing WHOIS obfuscation for commercial websites, so that it will no longer be so easy to get away with making money from pirating other people's content.

And once again, publishing, by definition, is not a private activity.

...

[Tonearm]

WHOIS includes a lot more than a mailing address. So like I said....

[Samizdata]

WHOIS includes a lot more than a mailing address. So like I said....

What you said was that ICANN's proposal would give a lower level of privacy than that in Europe.

This does not seem to be the case at all.

Commercial websites on European ccTLDs already have public WHOIS (ICANN's proposal) and in addition are legally obliged to include details on the site itself.

Privacy is not secrecy.

...

[keyplyr]

Isn't that up to the registrar? Some will raise holy hell if they learn that any part of your contact info is bogus*; others won't care.

Maybe but they sure don't make it appear so. I have TLDs registered at 3 different DNRs and each one sends me a yearly email saying something to the effect:
"Please login in to your account and confirm that your registration information is correct. ICANN requests that all information..."
I think one of my DNRs actually has a punitive action pending if I don't confirm.

[lucy24]

Does "commercial sites" mean only ones that take money directly from the visitor? Or are there alternative criteria?

[Tonearm]

Commercial websites on European ccTLDs already have public WHOIS (ICANN's proposal) and in addition are legally obliged to include details on the site itself.

If that only applies to ccTLDs as you say, then I stand by my previous evaluation:

So this ICANN proposal would reduce the level of privacy enjoyed by webmasters to a level lower than that currently enjoyed in Europe.

[IanKelley]

You don`t have any problem revealing your name under public register, when you open a firm, or buy a car or a house, but suddenly when your name is revealed under your domains that a big scary thing? I call this paranoia.

Our domains are on the internet. There is absolutely no comparison. You come into contact with people online that you would never interact with otherwise. And some of them are plain crazy.

In two decades online I have had all manner of brushes with crazy. I've seen every kind of threat you can imagine, directed both at me and other people. And more than once I've seen it spill over into offline life. It happens so often, especially to women, that it's almost the rule rather than the exception.

I've never taken the threats I've received seriously but that's probably because, delusion or not, I feel like I can defend myself. That's not true for everyone. And what about when it's your family? Small children?

If people want to protect their identity, let them!

[Tonearm]

There is a new decentralized internet coming called MaidSafe and it will set us free (again). Impossible to regulate.

[keyplyr]

There is a new decentralized internet coming called MaidSafe and it will set us free (again). Impossible to regulate.

Never happen

[farmboy]

Never happen

I agree.

However, I remember when I was in college in the state of Oklahoma and saw this new store in town. It was from a company that started over in Arkansas and was named Walmart.

I remarked "They are just trying to copy Kmart. They will never make it."

So don't put any value in my agreement.


FarmBoy

[keyplyr]

Well MaidSafeCoins aren't doing very well so I don't expect much from their new web architecture schema.

[graeme_p]

@Samizdata it depends on the definition of "commercial". I think requiring all websites to do it (as you say Germany does) is going too far. People in this thread have given examples of why that is a bad idea. E-commerce sites should provide contact details, but that should really be a matter for national law (because it needs to reflect national practices, be consistent with other laws etc.). I definitely do not think people should be forced to disclose details just because they stick adsense on their blog, and I definitely think people have a right to anonymous speech.

I think the analogy with book publishing does not work because, although it is conventional (but is it required?) for publishers to provide that information, authors often use pseudonyms. Even anonymous publication can be important as in the case of ... samizdat

[Tonearm]

Never happen

Why? Too good to be true?

Well MaidSafeCoins aren't doing very well so I don't expect much from their new web architecture schema.

That's a strange correlation to make, but anyway, the price of a MaidSafeCoin has more than doubled since the asset was issued.