ICANN Logo WHOIS

ICANN At-Large Advisory Committee Request for Comments on the WHOIS Database

Update

The ALAC is recommending changes to improve notification and consent for the use of individuals’ contact data in the WHOIS system. Responding to a report issued by the Generic Names Supporting Organization’s (GNSO’s) “WHOIS task forces,” the ALAC is suggesting ways of making the proposed WHOIS policy more clear, enhancing registrants’ experience, and strengthening mandatory disclosure on how individuals’ information will be used. Send your comments for public posting to the GNSO and At-Large forum.

The GNSO initiated a process to develop new policy on use of contact data in the WHOIS system in October 2003. Three separate task forces – each with an At-Large liaison – were addressing these issues, and the ALAC has provided advice on: restricting access to WHOIS data for marketing purposes; review of data collected and displayed; and improving accuracy of collected data.

The three task forces issued a “Combined Whois Task Force Preliminary Report” for public comment on 23 April 2005. The report includes recommendations on improving notification and consent for the use of contact data in the WHOIS system, including disclosures to registrants regarding availability and third-party access to personal data associated with domain names. Specifically, the report recommends:

  1. Registrars must ensure that disclosures regarding availability and third-party access to personal data associated with domain names actually be presented to registrants during the registration process. Linking to an external web page is not sufficient.
  2. Registrars must ensure that these disclosures are set aside from other provisions of the registration agreement if they are presented to registrants together with that agreement. Alternatively, registrars may present data access disclosures separate from the registration agreement. The wording of the notice provided by registrars should, to the extent feasible, be uniform.
  3. Registrars must obtain a separate acknowledgement from registrants that they have read and understand these disclosures. This provision does not affect registrars' existing obligations to obtain registrant consent to the use of their contact information in the WHOIS system.

The ALAC is expressing support for the concept of mandatory disclosure that underlies the task forces’ recommendations and is suggesting specific ways to improve it.

Background

ICANN’s Generic Names Supporting Organization (GNSO) initiated a policy development process in October 2003 to address three issues relating to the WHOIS database. Three separate task forces – each with a liaison from the ALAC – are addressing these issues, and the ALAC has provided advice on:

ALAC advice submitted to the task forces thus far is summarized below (with links to the full text of the ALAC submission). Brief descriptions of each task force’s work (and links) also are included below.

*Please share your views on the ALAC’s advice and the work of the task forces. Comments submitted will be publicly posted.*

The deadline for public comments on the three Whois task forces' preliminary reports has been extended until 5 July 2004. The public comments and policy recommendations will then be compiled into a final report, which is expected by 19 July 2004 (all dates subject to change).

Restricting Access to WHOIS Data For Marketing Purposes (WHOIS Task Force 1)

Task Force Purpose: This task force is charged with building on a previous GNSO recommendation to prohibit the use of bulk access WHOIS data for marketing by directly addressing the issue of marketing uses of WHOIS data obtained through Port 43 and web-based access. Through the use of "data mining" processes, large numbers of WHOIS records are easily available for marketing purposes, generally on an anonymous basis (the holders of this information are unknown). The purpose of this task force is to determine what contractual changes (if any) are required to allow registrars and registries to protect domain name holder data from data mining for the purposes of marketing The focus is on the technological means that may be applied to achieve these objectives and whether any contractual changes are needed to accommodate them. Click here for a detailed description of Task Force 1’s work.

ALAC Advise: The ALAC has recommended a simple two-tiered system – one for public access and a second for authenticated access. Under “Tier 1 – public access” users who access a future WHOIS-like system anonymously would get access to non-sensitive information concerning a domain name registration (“non-sensitive information” would be defined in detail by Task Force 2. Under “Tier 2 - authenticated access” users who want to access a more complete data set (to be defined in detail by Task Force 2) need to reliably identify themselves, and indicate the purpose for which they want to access the data.

* Click here for the complete text of the ALAC’s submission to Task Force 1.*

Review of Data Collected and Displayed (WHOIS Task Force 2)

Task Force Purpose: This task force is addressing domain name holders’ concern about privacy, both in terms of data that is collected and held about them, and in terms of what data is made available to other parties. The objective of the task force is to determine:

a) What is the best way to inform registrants of what information about themselves is made publicly available when they register a domain name and what options they have to restrict access to that data and receive notification of its use?

b) What changes, if any, should be made in the data elements about registrants that must be collected at the time of registration to achieve an acceptable balance between the interests of those seeking contact-ability, and those seeking privacy protection?

c) Should domain name holders be allowed to remove certain parts of the required contact information from anonymous (public) access, and if so, what data elements can be withdrawn from public access, by which registrants, and what contractual changes (if any) are required to enable this? Should registrars be required to notify domain name holders when the withheld data is released to third parties? If registrants have the ability to withhold data from public, anonymous access will this increase user incentives to keep the contact information they supply current and accurate.

Click here for a detailed description of Task Force 2’s work.

ALAC Advise: The ALAC has recommended that the mandatory collection and display of personal information about registrants be reduced as far as possible. What information is actually required for placing a domain name registration should be a matter of registrars' business models, and of applicable law, not of ICANN policy. The ALAC considers the removal of the following data elements from registrars' and registries WHOIS services (in a tiered model, from *all* tiers) a priority:

  • Registrant name, address, e-mail address, and phone number, unless registrant has requested that this information be made available.
  • Administrative contact name, address, e-mail address, and phone number, unless registrant (or admin-c) has requested that this information be made available.
  • Billing contact. These data are traditionally not published by registrars, but are included in many thick registries' public WHOIS services.

For the purposes of a tiered access system (see recommendations for Task Force 1), the ALAC recommends that the following information be included in a public tier: registrar of record; name servers; status of domain name; and contact data, if the data subject specifically requests that these data be included in the public tier.

* Click here for the complete text of the ALAC’s submission to Task Force 2.*

Improving Accuracy of Collected Data (WHOIS Task Force 3)

Task Force Purpose: The purpose of this task force is to develop mechanisms to improve the quality of contact data that must be collected at the time of registration, in accordance with the registrar accreditation agreement (in particular clauses 3.3.1 and 3.7.7.1), and the relevant registry agreement (e.g Unsponsored TLD Agreement: Appendix O (.biz)). Click here for a detailed description of Task Force 3’s work.

ALAC Advise:

Additional comments submitted by ALAC

The ALAC votes AGAINST all recommendations made in the proposed TF3 report.

For purposes of giving advice, we respectfully suggest that the report, in its current state, not be presented for public comment, but rather be substantially revised.

The document put up for a vote on TF3 is not even suitable as a basis for public comment or decision-making on the Council and Board levels: Such a document would have to discuss the Task Force's inputs and deliberations, it would have to compare the recommendations made to the baseline policy and practice effective today, and it would also have to include discussion of the effects (and side effects) of the recommendations made. Making the addressees and status (consensus policy?) of individual recommendations transparent would also contribute to enabling an informed discussion of the proposals made.

Specific to the area of WHOIS accuracy, it would also be helpful to compare any recommendations made to the results of the DNSO Whois Task Force's and Implementation Committees work from 2002/2003, and to make sure that the considerable body of public comment and community discussion is taken into account that was generated back then.

We think that, to be able to solve a problem, you should first investigate the reasons why it happens. In this case, you could roughly divide the registrants whose data are inaccurate into four categories:

  1. Those who purposely provide inaccurate data for fraudulent reasons.
  2. Those who purposely provide inaccurate data to protect their privacy.
  3. Those who mistakenly provide inaccurate data.
  4. Those who provide accurate data at registration, but then fail to keep them up to date so that the information becomes inaccurate.

The ALAC suggests it might be more cost-effective (and also more respectful of basic civil rights of people) to pursue fraudulent registrants once they actually commit a fraud, rather than to presume that all registrants are to commit frauds and so should be carefully screened in advance. The ALAC thinks that an increased accuracy in the WHOIS database, if limited to those registrants who actually agree to provide their data, would be highly desirable. This is why we think that future activities in the field of enhanced accuracy should not focus on the first category of the above list, but rather on the other three.

The ALAC recommends a shift in the focus of accuracy-related discussions to deal with those types of inaccuracy that can and should actually be solved, rather than dealing with world-wide verification and law enforcement systems. In particular, to address category 4, the ALAC recommends further consideration of changing the architecture of the WHOIS database from centralized to distributed. After all, the very reason for which the DNS system was created -- replacing the old centralized hosts table -- was the impossibility of keeping this centralized table up to date. We should simply apply the same principle and move the data at the edge of the network, by embedding WHOIS servers into DNS server implementations. WHOIS queries could then be sent directly to the authoritative name servers for the domain, and only if no reply is received, the registry could be used as a fallback. This way, registrants would be able to keep their WHOIS information up to date as easily as they keep their zone files up to date, and even if this would not completely solve the problem, it would possibly cause a dramatic increase in the number of WHOIS records that are actually kept updated.

* Click here for the complete text of the ALAC’s submission to Task Force 3.*

Links to reports and other background information are listed below.

Comments concerning the layout, construction and functionality of this site
should be sent to webmaster@icann.org.

Page Updated 03-Aug-2004
© 2004 The Internet Corporation for Assigned Names and Numbers. All rights reserved.