RE: [council] Motion re Study on WHOIS Misuse

["Terry L Davis, P.E." <tdavis2@xxxxxxxxxxxxx>]

Wendy/All

I also follow the ARIN PPML mailing list for my day job.  The clip below is
from today's discussions and whois issues are the big topic of the day there
also but in their case because of the impeding exhaustion of IPv4 address
space and a desire to recover unused/lost v4 address space.  

However the example gives you an idea of how big the problem appears to be,
and given the source running the POC checks, it would seem that we would
have a very reliable statistic by fall from their efforts for one part of
the study.  And there might be considerable synergy to be gained from our
work running either in parallel or just behind them to harvest their results
into our study.

And there is an expected explosion of IP addressing with the full
introduction of IPv6 so it could get a lot worse a lot faster.  A few of the
big ISPs and hardware vendors are expecting IPv6 based infrastructure to
consume more 10 times the addresses of a similar v4 infrastructure since you
can do a lot of things with v6 and that you can't with v4. 

To me, it's a really big deal.

Take care
Terry


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++

-----Original Message-----
From: arin-ppml-bounces@xxxxxxxx [mailto:arin-ppml-bounces@xxxxxxxx] On
Behalf Of John Curran
Sent: Monday, July 12, 2010 3:02 PM
To: Ted Mittelstaedt
Cc: arin-ppml@xxxxxxxx
Subject: Re: [arin-ppml] How bad is it really?

On Jul 12, 2010, at 2:38 PM, Ted Mittelstaedt wrote:

> Keep in mind that Section 3.6.1 requires ARIN to publish a list of 
> invalid POCS, so we should have in a year or two a list of subnets 
> that are "ripe for mining" as they say.

Ted is right on target here, and we're proceeding with POC validation at an
aggressive rate.  (For more information, see
<https://www.arin.net/resources/services/poc_validation.html>)

We're presently sending out 7500 validation requests each week, and getting
just over a 33% update rate on those requests. It's too early to draw
conclusions, but there's obviously ample space which presently lacks a
responsive contact.  We'll provide a more detailed update on POC validation
during the October PPML meeting.

/John

John Curran
President and CEO
ARIN

_______________________________________________
PPML
You are receiving this message because you are subscribed to the ARIN Public
Policy Mailing List (ARIN-PPML@xxxxxxxx).
Unsubscribe or manage your mailing list subscription at:
http://lists.arin.net/mailman/listinfo/arin-ppml
Please contact info@xxxxxxxx if you experience any issues.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++



-----Original Message-----
From: owner-council@xxxxxxxxxxxxxx [mailto:owner-council@xxxxxxxxxxxxxx] On
Behalf Of Wendy Seltzer
Sent: Wednesday, July 14, 2010 9:15 AM
To: icann@xxxxxxxxxxxxxx
Cc: 'GNSO Council'
Subject: Re: [council] Motion re Study on WHOIS Misuse


On 07/14/2010 11:15 AM, Mike Rodenbaugh wrote:
>
> Hi Wendy,
>
> If you have specific changes to the text in mind, then we can consider as
> potential friendly amendments.

Thanks, Mike.  Since I am against funding this study, I do not think my 
overall amendment would be friendly.  (I think it remains possible that 
other WHOIS studies could be better designed and should be prioritized 
in funding.)  I think the narrative history is interesting, but not 
something that requires a vote of the GNSO Council (and the necessary 
fact-checking that would precede such a vote). I'd move that to a 
separate information page.

>
> As for the additional discussion that Staff calls for, Staff could/should
> have that discussion with the vendor as the contract is negotiated by
Staff.

I think that is too much delegation. Since the validity and utility of 
the study will depend on the outcome of that discussion, I think GNSO 
should not approve until after these important elements have been 
clarified.

--Wendy

>
> Mike Rodenbaugh
> RODENBAUGH LAW
> tel/fax:  +1 (415) 738-8087
> http://rodenbaugh.com
>
> -----Original Message-----
> From: owner-council@xxxxxxxxxxxxxx [mailto:owner-council@xxxxxxxxxxxxxx]
On
> Behalf Of Wendy Seltzer
> Sent: Wednesday, July 14, 2010 8:01 AM
> To: Terry L Davis, P.E.
> Cc: icann@xxxxxxxxxxxxxx; 'GNSO Council'
> Subject: Re: [council] Motion re Study on WHOIS Misuse
>
>
> Two questions: Why do we need so much detail in the Whereas clauses?  I
> don't believe that's necessary or helpful.
>
> Second, I do not believe that we have enough detail in the Resolved, or
> the staff report to which it refers, to be confident that the Misuse
> Study would be a statistically or scientifically valid study.
>
> Even the staff report still indicates  "However, even that [superior]
> proposal did not address key challenges that could diminish the WHOIS
> policy contributions afforded by this study - notably, determining the
> "significance" of misuse and proving a causal relationship between
> misuse reduction and WHOIS anti-harvesting measures. If ICANN and GNSO
> elect to pursue this study, these concerns should be discussed with the
> bidder before a contract is awarded."
>
> Who would be responsible for the "concerns should be discussed"?  I
> think that question remains at the GNSO level.
>
>
> I am therefore planning to vote against this resolution.
>
> Thanks,
> --Wendy
>
>
> On 07/13/2010 11:51 AM, Terry L Davis, P.E. wrote:
>> Mike
>>
>>
>>
>> I didn't that anyone else seconded your motion.  If there is no second
>> still, I second this motion.
>>
>>
>>
>> Take care
>>
>> Terry
>>
>>
>>
>> From: owner-council@xxxxxxxxxxxxxx [mailto:owner-council@xxxxxxxxxxxxxx]
> On
>> Behalf Of Mike Rodenbaugh
>> Sent: Wednesday, July 07, 2010 6:52 PM
>> To: 'GNSO Council'
>> Subject: [council] Motion re Study on WHOIS Misuse
>>
>>
>>
>> I submit the attached motion (copied also below) for consideration by the
>> Council at our meeting next week.
>>
>>
>>
>> Would appreciate a second, and am happy to answer any questions.
>>
>>
>>
>> Thanks,
>>
>> Mike
>>
>>
>>
>> Mike Rodenbaugh
>>
>> RODENBAUGH LAW
>>
>> tel/fax:  +1 (415) 738-8087
>>
>> http://rodenbaugh.com<http://rodenbaugh.com/>
>>
>>
>>
>>
>>
>> GNSO Council motion to pursue study of Whois Misuse.
>>
>> Whereas:
>>
>> In October 2007, the GNSO Council concluded that a comprehensive and
>> objective understanding of key factual issues  regarding the gTLD Whois
>> system would benefit future GNSO policy development efforts (
>> <http://gnso.icann.org/resolutions/>
http://gnso.icann.org/resolutions/).
>>
>> Before defining the details of these studies, the Council solicited
>> suggestions from the community for specific topics of study on WHOIS.
>> Suggestions were submitted (
>> <http://forum.icann.org/lists/WHOIS-comments-2008/>
>> http://forum.icann.org/lists/WHOIS-comments-2008/) and ICANN staff
> prepared
>> a  'Report on Public Suggestions on Further Studies of WHOIS', dated
>> 25-Feb-2008 (
>>
>
<http://gnso.icann.org/issues/Whois-privacy/Whois-study-suggestion-report-25
>> feb08.pdf>
>>
>
http://gnso.icann.org/issues/Whois-privacy/Whois-study-suggestion-report-25f
>> eb08.pdf).
>>
>> On 28-Mar-2008 the GNSO Council resolved to form a WHOIS Study Working
> Group
>> to develop a proposed list, if any, of recommended studies for which
ICANN
>> staff would be asked to provide cost estimates to the Council (
>> <http://gnso.icann.org/meetings/minutes-gnso-27mar08.shtml>
>> http://gnso.icann.org/meetings/minutes-gnso-27mar08.shtml).
>>
>> The WHOIS Study WG did not reach consensus regarding further studies, and
> on
>> 25-Jun-2008 the GNSO Council resolved to form another group of volunteers
>> (WHOIS Hypotheses WG) to review the 'Report on Public Suggestions on
> Further
>> Studies of WHOIS' and the GAC letter on WHOIS studies. (
>> <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
>> http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf).
>>
>> This WG was tasked to prepare a list of hypotheses to be tested, and
>> reported to the Council on 26-Aug-2008.
>>
>
(https://st.icann.org/Whois-hypoth-wg/index.cgi?whois_hypotheses_wg#Whois_st
>> udy_hypotheses_wg_final_report ).
>>
>> On 5-Nov-2008, the Council convened a volunteer group of Councilors and
>> interested constituency members to draft a resolution regarding studies,
> if
>> any, for which cost estimates should be obtained.  The Whois Study
> Drafting
>> Team further consolidated studies and data requested by the GAC (
>> <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
>> http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf ).
>>
>>
>>
>> For each of the consolidated studies, constituencies were invited to
> assign
>> priority rank and assess feasibility.  5 constituencies provided the
>> requested rankings, while 2 constituencies (NCUC and Registrars)
indicated
>> that no further studies were justified.  The GAC was also invited to
> assign
>> priorities, but no reply was received.  The Drafting Team determined that
>> the six studies with the highest average priority scores should be the
>> subject of further research to determine feasibility and obtain cost
>> estimates.
>>
>> On 04-Mar-2009, Council requested Staff to conduct research on
feasibility
>> and cost estimates for selected Whois studies and report its findings to
>> Council.  (See Motion 3 at
>> <https://st.icann.org/gnso-council/index.cgi?04_mar_2009_motions>
>> https://st.icann.org/gnso-council/index.cgi?04_mar_2009_motions).
>>
>>
>>
>> On 23-Mar-2010, Staff presented its latest report on feasibility and cost
>> estimates for Whois Studies. (
>>
>
http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en.
>> pdf) This report included a Staff Analysis and Recommendations for the
> first
>> study, regarding WHOIS Misuse.   The WHOIS Misuse study addressed 3
>> originally requested studies (1, 14, and 21) and GAC data set 2.   The
>> hypothesis of the WHOIS Misuse study is: "Public access to WHOIS data is
>> responsible for a material number of cases of misuse that have caused
harm
>> to natural persons whose registrations do not have a commercial purpose."
>>
>>
>> At ICANN's meeting in Brussels, representatives of the GAC reiterated
> their
>> interest in ICANN's response to the GAC letter of Apr-2008, which
included
>> these requests for further studies of WHOIS (
>> <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
>> http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf),
> stating:
>>
>>
>>
>>
>> First and foremost, the GAC believes that studies of WHOIS gTLD data
> should
>> be undertaken by neutral third parties and should create a factual record
>> that documents the uses and abuses of WHOIS data recognized by the GAC
> WHOIS
>> Principles. The goal should be to initially compile data that provides a
>> documented evidence base regarding:
>>
>>
>>
>> .  the amount and source of traffic accessing WHOIS servers and the types
>> and numbers of different groups of users and what those users are using
>> WHOIS data for; and
>>
>>
>>
>> .  the types and extent of misuses of WHOIS data and what harm is caused
> by
>> each type of misuse, including economic, use of WHOIS data in SPAM
>> generation, abuse of personal data, loss of reputation or identity theft,
>> security costs and loss of data."
>>
>>
>>
>> The Affirmation of Commitments requires that ICANN conduct reviews of
> WHOIS
>> policy and implementation "to assess the extent to which WHOIS policy is
>> effective and its implementation meets the legitimate needs of law
>> enforcement and promotes consumer trust."  The first such review must be
>> organized by 30-Sep-2010.  (
>>
>
<http://www.icann.org/en/documents/affirmation-of-commitments-30sep09-en.htm
>>>
>>
>
http://www.icann.org/en/documents/affirmation-of-commitments-30sep09-en.htm)
>>
>>
>>
>> The proposed budget for FY 2011 includes at least $450,000 for WHOIS
>> studies.
>>
>>
>>
>> Resolved:
>>
>> Council requests ICANN staff to proceed with the WHOIS Misuse Study, as
>> described in Staff's 23-Mar-2010 Report, using the vendor selection
> process
>> described in Annex of that same report. (
>>
>
<http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en
>> .pdf>
>>
>
http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en.
>> pdf).
>>
>>
>>
>>
>
>


-- 
Wendy Seltzer -- wendy@xxxxxxxxxxx
phone: +1.914.374.0613
Fellow, Silicon Flatirons Center at University of Colorado Law School
Fellow, Berkman Center for Internet & Society at Harvard University
http://cyber.law.harvard.edu/seltzer.html
http://www.chillingeffects.org/
https://www.torproject.org/