WHOIS Task Force 3 Interim Report

Interim Report

February 26, 2003

Pursuant to the GNSO Council recommendation of February 19, 2004, Task Force 3 on Whois Data Accuracy (hereinafter "TF3") submits this Interim Report concerning TF3's work to date. The Interim Report will be a starting point for discussions at the Workshop on Whois Data Accuracy, which is tentatively scheduled for Wednesday, March 2, 2004 in Rome.

The GNSO Council orally issued its request for Constituency Statements on February 19 with the statements being due on March 19, 2003. The Task Force is to issue its Preliminary Report, as recognized under the PDP, on April 9, 2004.

In the WHOIS Task Force 3 Description of Work, amended October 29, 2003, the GNSO Council identified five Tasks/Milestones, the first two of which are addressed, to the extent currently possible, in this Interim Report:

The "Tasks/Milestones" for Task Force 3 are as follows:

1) Collect information on the current techniques that registrars use to verify that the data collected is correct. For example techniques to detect typing errors by registrants intending to provide correct information. Survey approaches used by cctlds to verify that the contact data collected is correct.

2) collect publicly available information on the techniques used by other online service providers (to verify that data collected is correct) as well as information on the price of services offered by the online service provider.

3) create a best practices document for improving data verification based on the information collected that can be applied on a global basis

4) determine whether any changes are required in the contracts to specify what data verification is necessary at time of collection to improve accuracy

5) determine what verification mechanisms can be used cost effectively to combat the deliberate provision of false information, and determine whether additional mechanisms are necessary to provide traceability of registrants, or provide more timely responses for misuse of domain names associated with deliberately false information.

In connection with Task 1, TF3 collected limited data from Registrars. TF3 also has sought to survey, via CENTR, the Whois Data Accuracy practices of CENTR members, and has circulated to the CCNSO through ICANN Staff, a survey of Whois Data Accuracy practices by ccTLDs.

Survey of Registrars

The Registrar representative to TF3 informally polled members of the Registrar Constituency regarding their WHOIS Data Accuracy practices. The response to this informal survey was meager with only three or four registrars responding. Hence, the results are at best anecdotal and do not provide statistically relevant information. They are an amalgamation of the four responses received. These results have not been officially endorsed by the Registrar Constituency or its membership.

The results, as summarized by the Registrar representative to the Task Force, were broken down into two categories: gTLD-related and ccTLD-related.

gTLD-Related

There is no verification on submission of WHOIS data other than technical verification to ensure that the appropriate data structure has been submitted and to ensure that all required data elements are collected. Similarly, acceptance of the registration agreement is required, which by its terms requires registrants to submit accurate WHOIS data. Otherwise, the responding registrars indicated that they comply with WDRP and ICANN WHOIS Problem Reports.

cc-TLD-Related

A single ccTLD registrar indicated that it checks to ensure that the registrant is a valid legal entity. There is manual verification of the registrant-provided identity information. However, address and other contact data are not checked for accuracy. Of course, the data verification practices of this single ccTLD registrar do not represent data verification practices of cc-TLDs as a group. Moreover, it is believed that ccTLD data verification practices likely will vary depending upon the policies of each ccTLD registry and the applicable national laws under which ccTLD registries and registrars must operate.

Two conditions were flagged as being primary conditions that must exist as the result of any data verification technique:

a) Is the information submitted representative of an actual person, place or thing? I.e., Is the phone number the real phone number? Is the name the name of a real person? Is the address the location of an actual place?

b) Is the relationship between the data submitted representative of the actual situation? For example, a registrant may state that he or she is submitting registrant data on behalf of a particular corporation and use real street names and phone numbers, but does the story hold up when the connections (or lack thereof) between the data are examined?

Survey of cc-TLDs

As indicated above, TF3 sought to survey the ccTLDs through two means: Submission of survey questions to CENTR for inclusion in a survey to be conducted by CENTR of its members. That survey was to be completed by approximately February 16, 2004. TF3 also submitted, through ICANN Staff, survey questions to other ccTLDs through the CCNSO.

The Task Force submitted the following questions to CENTR for inclusion in its survey and to ICANN Staff for distribution to other ccTLD’s and ccTLD organizations:

a) What steps do you currently take to verify the accuracy of collected WHOIS data?

b) What if any staff members do you employ who have responsibility for verifying the accuracy of collected WHOIS data?

c) What if any automated processes do you use or employ to verify the accuracy of collected WHOIS data?

d) At what stage in the domain name registration process do you verify the accuracy of the collected WHOIS data?

e) What steps, if any, do you take upon learning that submitted WHOIS data is inaccurate or false?

f) Do you employ or retain any outside services for the verification of the accuracy of collected WHOIS data? If so, what is the approximate cost of such services and how are they priced?

g) Do you have a process in place for receiving reports of inaccurate or false WHOIS data? If so, what is that process?

h) What laws or regulations does your country have in place, if any, regarding the accuracy of WHOIS data? Please summarize and provide citations to any such laws.

ICANN Staff reported that it transmitted the Survey to CENTR and to other ccTLDs and ccTLD organizations through the CCNSO.

The Task Force has been informed through ICANN Staff that CENTR determined not to include TF3’s survey questions in the CENTR survey. Similarly, the remaining ccTLDs and ccTLD organizations have decided not to respond to the TF3 survey submitted to them. Instead, TF3 has been informed that Paul Kane has prepared, on behalf of CENTR, a lengthy paper concerning WHOIS data accuracy. This paper was being considered at a meeting of various ccTLD representatives in Salzburg during the week of February 16, 2004 and reportedly will be available to the Task Force at some undisclosed time in the future. As of the date of this report, however, TF3 has not yet received this report and it is not expected before the Rome Meeting.

Task 2 required the Task Force to collect publicly available information on the techniques used by other online service providers to verify that WHOIS data collected is accurate as well as the price of services offered by the online service provider. Toward this end, the Task Force identified the following industries and companies as possible sources of relevant responsive information:

1) Telecommunications/Cellular (including Prepaid Cellular):

AT&T

Verizon

Sprint

British Telecom

Nortel

t-mobile (deutchtelkom)

vodaphone

Virginmobile

2) E-Bay, Paypal, Amazon

3) Verisign, GeoTrust and other Registries offering online services

4) PingID (www.pingid.com)

5) ISPs/Web Hosting Companies

CISPA

TISPA

CAIP

MSN

Earthlink

Sympatico

UOL

Freeserve

Korea Telecom

Xtra

5) Travel: Expedia, Travelocity

6) News:

CNN

New York Times

Wall Street Journal

Washington Post.com

London Times Online

The Survey circulated by the Task Force to most of these companies was as follows:

The Internet Corporation for Assigned Names and Numbers (ICANN) has formed a task force to determine appropriate practices to verify the accuracy of domain name registrant data known as "WHOIS" data. The Task Force involved with studying and making recommendations to ICANN regarding data verification practices is tasked with contacting companies in other industries who engage in online transactions to determine what their practices and methodologies are for determining and verifying the accuracy of the identification of customers with whom they transact business online. The Task Force hopes to gather this information, review and summarize it, and then make a recommendation to ICANN about data verification practices which might be applied in the domain name context to ensure and verify accurate domain name registrant data.

Toward that end, we would greatly appreciate it if your company would complete the following survey and e-mail the results to tf3-survey (at) gnso.icann.org by February 16, 2004.

We greatly appreciate whatever information you can provide.

Here are the questions which we would like you to address:

1. What steps do you take to verify the accuracy of data that is submitted to your company as part of an online transaction?

a) automated review

b) Manual review of all data

c) Random manual review

d) None

e) Other: please describe:

2. How do you ensure that the customer's name, address and other identifying information is correct?

a) check manually

b) check against existing internal/external databases via automated processes

c) no verification

d) other: ___________ please explain: ________________

3. Do you rely on a web GUI, online template or other up front screening

mechanism that the customer must complete to encourage the accurate listing

of identifying information?

Yes: No:

IF yes, please identify which apply:

a) web GUI

b) automated template

c) software "matches"

4. Do you use credit card information and passwords to verify the accuracy of the customer's identity and the legitimacy of the transaction?

Yes: No: Not applicable:

5. Do you believe these systems are effective to provide your company with an upfront warning about inaccurate data or potential frauds in online transactions?

Yes: No: Not applicable:

6. Do you use in-house capabilities or retain outside services to provide

verification services? What are the approximate costs?

Use internal/in-house capabilities:

Use external/outside services:

Both

Neither

Please provide approximate costs per transaction:

7. What steps do you take when you learn that your customer data may be inaccurate or instances of fraud are reported?

a) contact customer for correction

b) initiate internal investigation

c) send notice that transaction or service may be terminated

d) combination of the above (please describe:______________)

e) none of the above (please describe: __________________ )

8. Do you have a process in place for receiving reports of inaccuracies or fraud? What is that process?

a) yes

b) no

c) IF yes; please describe:

Once you have completed the survey, please e-mail the results to tf3-survey (at) gnso.icann.org by February 16, 2004.

We appreciate your time in completing this survey.

ICANN Whois Task Force 3 - Data Accuracy

Although the Task Force requested e-mail responses to the survey by February 16, 2004, it only had received one discernible response as of February 25, 2004.

The Task Force has learned through informal contacts with some of the companies surveyed that they view their data verification practices as confidential, proprietary information which they do not wish to share with competitors. At least for some of these companies, this concern would not be resolved if they were to submit their survey responses anonymously. They simply do not want their data verification practices publicly disclosed. This issue, as well as obtaining survey responses generally, can impact the substance and timing of the preliminary and final reports required by the PDP.

Whois Data Workshop

At the Whois Data Workshop set for March 2, 2004 in Rome, the Task Force plans to review this Interim Report, hear presentations by two or three speakers concerning WHOIS data accuracy issues, and establish a plan of action for completing the Task Force's Work. In light of the limited responses received to the surveys to date, it may be that the schedule adopted by the GNSO Council during its February 19, 2004 conference call, which calls for a preliminary report on April 9, 2004 and a Final Report by May 20, 2004, may need to be adjusted.

ICANN WHOIS Task Force 3

Improving Accuracy of Collected Data

Chair, Brian Darville

February 26, 2004