Re: [council] Motion re Study on WHOIS Misuse

[Wendy Seltzer <wendy@xxxxxxxxxxx>]

Thanks Terry,

I agree WHOIS is an important issue, and that getting real data would be 
helpful in understanding it.  I don't believe that the proposed Misuse 
Study is well tailored to generating valid data (nor that this study 
would generate data helpful toward the questions ARIN is facing).
--Wendy

On 07/14/2010 06:10 PM, Terry L Davis, P.E. wrote:
> Wendy/All
>
> I also follow the ARIN PPML mailing list for my day job.  The clip below is
> from today's discussions and whois issues are the big topic of the day there
> also but in their case because of the impeding exhaustion of IPv4 address
> space and a desire to recover unused/lost v4 address space.
>
> However the example gives you an idea of how big the problem appears to be,
> and given the source running the POC checks, it would seem that we would
> have a very reliable statistic by fall from their efforts for one part of
> the study.  And there might be considerable synergy to be gained from our
> work running either in parallel or just behind them to harvest their results
> into our study.
>
> And there is an expected explosion of IP addressing with the full
> introduction of IPv6 so it could get a lot worse a lot faster.  A few of the
> big ISPs and hardware vendors are expecting IPv6 based infrastructure to
> consume more 10 times the addresses of a similar v4 infrastructure since you
> can do a lot of things with v6 and that you can't with v4.
>
> To me, it's a really big deal.
>
> Take care
> Terry
>
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> +++++++++++++++++++++++++++++++++++++
>
> -----Original Message-----
> From: arin-ppml-bounces@xxxxxxxx [mailto:arin-ppml-bounces@xxxxxxxx] On
> Behalf Of John Curran
> Sent: Monday, July 12, 2010 3:02 PM
> To: Ted Mittelstaedt
> Cc: arin-ppml@xxxxxxxx
> Subject: Re: [arin-ppml] How bad is it really?
>
> On Jul 12, 2010, at 2:38 PM, Ted Mittelstaedt wrote:
>
> > Keep in mind that Section 3.6.1 requires ARIN to publish a list of
> > invalid POCS, so we should have in a year or two a list of subnets
> > that are "ripe for mining" as they say.
> Ted is right on target here, and we're proceeding with POC validation at an
> aggressive rate.  (For more information, see
> <https://www.arin.net/resources/services/poc_validation.html>)
>
> We're presently sending out 7500 validation requests each week, and getting
> just over a 33% update rate on those requests. It's too early to draw
> conclusions, but there's obviously ample space which presently lacks a
> responsive contact.  We'll provide a more detailed update on POC validation
> during the October PPML meeting.
>
> /John
>
> John Curran
> President and CEO
> ARIN
>
> _______________________________________________
> PPML
> You are receiving this message because you are subscribed to the ARIN Public
> Policy Mailing List (ARIN-PPML@xxxxxxxx).
> Unsubscribe or manage your mailing list subscription at:
> http://lists.arin.net/mailman/listinfo/arin-ppml
> Please contact info@xxxxxxxx if you experience any issues.
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> +++++++++++++++++++++++++++++++++++++++++++++++++++
>
>
>
> -----Original Message-----
> From: owner-council@xxxxxxxxxxxxxx [mailto:owner-council@xxxxxxxxxxxxxx] On
> Behalf Of Wendy Seltzer
> Sent: Wednesday, July 14, 2010 9:15 AM
> To: icann@xxxxxxxxxxxxxx
> Cc: 'GNSO Council'
> Subject: Re: [council] Motion re Study on WHOIS Misuse
>
>
> On 07/14/2010 11:15 AM, Mike Rodenbaugh wrote:
> > Hi Wendy,
> >
> > If you have specific changes to the text in mind, then we can consider as
> > potential friendly amendments.
> Thanks, Mike.  Since I am against funding this study, I do not think my
> overall amendment would be friendly.  (I think it remains possible that
> other WHOIS studies could be better designed and should be prioritized
> in funding.)  I think the narrative history is interesting, but not
> something that requires a vote of the GNSO Council (and the necessary
> fact-checking that would precede such a vote). I'd move that to a
> separate information page.
>
> > As for the additional discussion that Staff calls for, Staff could/should
> > have that discussion with the vendor as the contract is negotiated by
> Staff.
>
> I think that is too much delegation. Since the validity and utility of
> the study will depend on the outcome of that discussion, I think GNSO
> should not approve until after these important elements have been
> clarified.
>
> --Wendy
>
> > Mike Rodenbaugh
> > RODENBAUGH LAW
> > tel/fax:  +1 (415) 738-8087
> > http://rodenbaugh.com
> >
> > -----Original Message-----
> > From: owner-council@xxxxxxxxxxxxxx [mailto:owner-council@xxxxxxxxxxxxxx]
> On
> > Behalf Of Wendy Seltzer
> > Sent: Wednesday, July 14, 2010 8:01 AM
> > To: Terry L Davis, P.E.
> > Cc: icann@xxxxxxxxxxxxxx; 'GNSO Council'
> > Subject: Re: [council] Motion re Study on WHOIS Misuse
> >
> >
> > Two questions: Why do we need so much detail in the Whereas clauses?  I
> > don't believe that's necessary or helpful.
> >
> > Second, I do not believe that we have enough detail in the Resolved, or
> > the staff report to which it refers, to be confident that the Misuse
> > Study would be a statistically or scientifically valid study.
> >
> > Even the staff report still indicates  "However, even that [superior]
> > proposal did not address key challenges that could diminish the WHOIS
> > policy contributions afforded by this study - notably, determining the
> > "significance" of misuse and proving a causal relationship between
> > misuse reduction and WHOIS anti-harvesting measures. If ICANN and GNSO
> > elect to pursue this study, these concerns should be discussed with the
> > bidder before a contract is awarded."
> >
> > Who would be responsible for the "concerns should be discussed"?  I
> > think that question remains at the GNSO level.
> >
> >
> > I am therefore planning to vote against this resolution.
> >
> > Thanks,
> > --Wendy
> >
> >
> > On 07/13/2010 11:51 AM, Terry L Davis, P.E. wrote:
> > > Mike
> > >
> > >
> > >
> > > I didn't that anyone else seconded your motion.  If there is no second
> > > still, I second this motion.
> > >
> > >
> > >
> > > Take care
> > >
> > > Terry
> > >
> > >
> > >
> > > From: owner-council@xxxxxxxxxxxxxx [mailto:owner-council@xxxxxxxxxxxxxx]
> > On
> > > Behalf Of Mike Rodenbaugh
> > > Sent: Wednesday, July 07, 2010 6:52 PM
> > > To: 'GNSO Council'
> > > Subject: [council] Motion re Study on WHOIS Misuse
> > >
> > >
> > >
> > > I submit the attached motion (copied also below) for consideration by the
> > > Council at our meeting next week.
> > >
> > >
> > >
> > > Would appreciate a second, and am happy to answer any questions.
> > >
> > >
> > >
> > > Thanks,
> > >
> > > Mike
> > >
> > >
> > >
> > > Mike Rodenbaugh
> > >
> > > RODENBAUGH LAW
> > >
> > > tel/fax:  +1 (415) 738-8087
> > >
> > > http://rodenbaugh.com<http://rodenbaugh.com/>
> > >
> > >
> > >
> > >
> > >
> > > GNSO Council motion to pursue study of Whois Misuse.
> > >
> > > Whereas:
> > >
> > > In October 2007, the GNSO Council concluded that a comprehensive and
> > > objective understanding of key factual issues  regarding the gTLD Whois
> > > system would benefit future GNSO policy development efforts (
> > > <http://gnso.icann.org/resolutions/>
> http://gnso.icann.org/resolutions/).
> > > Before defining the details of these studies, the Council solicited
> > > suggestions from the community for specific topics of study on WHOIS.
> > > Suggestions were submitted (
> > > <http://forum.icann.org/lists/WHOIS-comments-2008/>
> > > http://forum.icann.org/lists/WHOIS-comments-2008/) and ICANN staff
> > prepared
> > > a  'Report on Public Suggestions on Further Studies of WHOIS', dated
> > > 25-Feb-2008 (
> <http://gnso.icann.org/issues/Whois-privacy/Whois-study-suggestion-report-25
> > > feb08.pdf>
> http://gnso.icann.org/issues/Whois-privacy/Whois-study-suggestion-report-25f
> > > eb08.pdf).
> > >
> > > On 28-Mar-2008 the GNSO Council resolved to form a WHOIS Study Working
> > Group
> > > to develop a proposed list, if any, of recommended studies for which
> ICANN
> > > staff would be asked to provide cost estimates to the Council (
> > > <http://gnso.icann.org/meetings/minutes-gnso-27mar08.shtml>
> > > http://gnso.icann.org/meetings/minutes-gnso-27mar08.shtml).
> > >
> > > The WHOIS Study WG did not reach consensus regarding further studies, and
> > on
> > > 25-Jun-2008 the GNSO Council resolved to form another group of volunteers
> > > (WHOIS Hypotheses WG) to review the 'Report on Public Suggestions on
> > Further
> > > Studies of WHOIS' and the GAC letter on WHOIS studies. (
> > > <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
> > > http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf).
> > >
> > > This WG was tasked to prepare a list of hypotheses to be tested, and
> > > reported to the Council on 26-Aug-2008.
> (https://st.icann.org/Whois-hypoth-wg/index.cgi?whois_hypotheses_wg#Whois_st
> > > udy_hypotheses_wg_final_report ).
> > >
> > > On 5-Nov-2008, the Council convened a volunteer group of Councilors and
> > > interested constituency members to draft a resolution regarding studies,
> > if
> > > any, for which cost estimates should be obtained.  The Whois Study
> > Drafting
> > > Team further consolidated studies and data requested by the GAC (
> > > <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
> > > http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf ).
> > >
> > >
> > >
> > > For each of the consolidated studies, constituencies were invited to
> > assign
> > > priority rank and assess feasibility.  5 constituencies provided the
> > > requested rankings, while 2 constituencies (NCUC and Registrars)
> indicated
> > > that no further studies were justified.  The GAC was also invited to
> > assign
> > > priorities, but no reply was received.  The Drafting Team determined that
> > > the six studies with the highest average priority scores should be the
> > > subject of further research to determine feasibility and obtain cost
> > > estimates.
> > >
> > > On 04-Mar-2009, Council requested Staff to conduct research on
> feasibility
> > > and cost estimates for selected Whois studies and report its findings to
> > > Council.  (See Motion 3 at
> > > <https://st.icann.org/gnso-council/index.cgi?04_mar_2009_motions>
> > > https://st.icann.org/gnso-council/index.cgi?04_mar_2009_motions).
> > >
> > >
> > >
> > > On 23-Mar-2010, Staff presented its latest report on feasibility and cost
> > > estimates for Whois Studies. (
> http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en.
> > > pdf) This report included a Staff Analysis and Recommendations for the
> > first
> > > study, regarding WHOIS Misuse.   The WHOIS Misuse study addressed 3
> > > originally requested studies (1, 14, and 21) and GAC data set 2.   The
> > > hypothesis of the WHOIS Misuse study is: "Public access to WHOIS data is
> > > responsible for a material number of cases of misuse that have caused
> harm
> > > to natural persons whose registrations do not have a commercial purpose."
> > >
> > >
> > > At ICANN's meeting in Brussels, representatives of the GAC reiterated
> > their
> > > interest in ICANN's response to the GAC letter of Apr-2008, which
> included
> > > these requests for further studies of WHOIS (
> > > <http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf>
> > > http://www.icann.org/correspondence/karlins-to-thrush-16apr08.pdf),
> > stating:
> > > First and foremost, the GAC believes that studies of WHOIS gTLD data
> > should
> > > be undertaken by neutral third parties and should create a factual record
> > > that documents the uses and abuses of WHOIS data recognized by the GAC
> > WHOIS
> > > Principles. The goal should be to initially compile data that provides a
> > > documented evidence base regarding:
> > >
> > >
> > >
> > > .  the amount and source of traffic accessing WHOIS servers and the types
> > > and numbers of different groups of users and what those users are using
> > > WHOIS data for; and
> > >
> > >
> > >
> > > .  the types and extent of misuses of WHOIS data and what harm is caused
> > by
> > > each type of misuse, including economic, use of WHOIS data in SPAM
> > > generation, abuse of personal data, loss of reputation or identity theft,
> > > security costs and loss of data."
> > >
> > >
> > >
> > > The Affirmation of Commitments requires that ICANN conduct reviews of
> > WHOIS
> > > policy and implementation "to assess the extent to which WHOIS policy is
> > > effective and its implementation meets the legitimate needs of law
> > > enforcement and promotes consumer trust."  The first such review must be
> > > organized by 30-Sep-2010.  (
> <http://www.icann.org/en/documents/affirmation-of-commitments-30sep09-en.htm
> > > >
> http://www.icann.org/en/documents/affirmation-of-commitments-30sep09-en.htm)
> > > The proposed budget for FY 2011 includes at least $450,000 for WHOIS
> > > studies.
> > >
> > >
> > >
> > > Resolved:
> > >
> > > Council requests ICANN staff to proceed with the WHOIS Misuse Study, as
> > > described in Staff's 23-Mar-2010 Report, using the vendor selection
> > process
> > > described in Annex of that same report. (
> <http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en
> > > .pdf>
> http://gnso.icann.org/issues/whois/whois-studies-report-for-gnso-23mar10-en.
> > > pdf).

--
Wendy Seltzer -- wendy@xxxxxxxxxxx
phone: +1.914.374.0613
Fellow, Silicon Flatirons Center at University of Colorado Law School
Fellow, Berkman Center for Internet & Society at Harvard University
http://cyber.law.harvard.edu/seltzer.html
http://www.chillingeffects.org/
https://www.torproject.org/