[tf2-survey] TR: ALAC input to TF2 survey

["GNSO SECRETARIAT" <gnso.secretariat@xxxxxxxxxxxxxx>]

Thomas Roessler [mailto:roessler@xxxxxxxxxxxxxxxxxx] Envoye : vendredi 27
fevrier 2004 01:52 wrote:

Glen, could you please add this to the tf2 survey archive?

Thanks,
--
Thomas Roessler  <roessler@xxxxxxxxxxxxxxxxxx>
At-Large Advisory Committee: http://alac.info/



At Large Advisory Committee (ALAC) input to Task Force 2 Survey:

>1.     For each existing data field within the Whois, please provide
>       feedback to the task force regarding the following:
>
>
>       a) Use How do members of your constituency make use of the
>       data?

We are not aware of any use of WHOIS data that would be typical for
or limited to individual Internet users.  In general, it is safe to
state that individual Internet users use and abuse WHOIS for the
same purposes as members of any other constituency.

>       b) Necessity    Is it necessary that this information be
>       made available to members of your constituency?  If so, why?

As stated above, there is no necessity for individual Internet users
to access any specific WHOIS data element.

However, as a matter of fair design and application of policy, we
would note that if access to WHOIS data is made available on a
limited basis, to some but not to all, that access should generally
be tied to a purpose (or, maybe, heuristics about the legitimacy of
a purpose, such as reliable identification of the data user), not to
membership in any particular constituency group.

Therefore, individual Internet uses should have equal access to all
elements of WHOIS data to which other users have access.  If conditions are
imposed on access, individual Internet users should be able to meet those
same neutral conditions.

>       c) Concerns Describe any concenrs your constituency may have
>       with making this information available.

Concerns are caused by any and all data elements that relate to the
identity and contact information (e-mail, home address, home phone
number) of individual registrants.  This includes, in particular,
the registrant, administrative, and billing contact fields which are
most likely to directly identify individual registrants.

Mandatory collection and disclosure of individual registrants' name
chills online speech. Individual Internet users may be critics,
activists, whistleblowers, harrassment victims, or simply shy.  They
should be able to register a domain for online speech, particularly
for non-commercial use, without identifying themselves.

Mandatory collection and disclosure of registrants' contact data in
general opens the door for harassment and consumer fraud.

The impact of the mandatory collection and disclosure of data is
particularly grave when registrants' phone numbers are published, as
these provide intruders with an express path into registrants'
private lives.  On the othehr hand, we are not aware of any specific
purpose related to domain name registration that would be served by
mandating colllection and publication of registrant and
administrative contact telephone numbers.  We are also not aware of
any specific purpose related to domain name registration that would
be served by mandating publication of any information about the
billing contact.

Additionally, collecting unnecessary contact details at the time of
domain name registration, and then publishing the data collected for
any use or purpose contradicts the Data Quality (relevance), Purpose
Specification and Use Limitation privacy principles.  These
principles have been implemented in applicable law in numerous
countries; these laws are broken when current ICANN policy is
actually applied.

>2.  If there are fields not presently available within Whois that
>       would be of use to members of your constituency, please
>       suggest what those fields may be.

There are no such fields.

>       For each suggestion, provide feedback regarding the
>       following:

>       a) Use How would members of your constituency make use of
>       the data?

>       b) Necessity    Is it necessary that this information be
>       made available to members of your constituency?  If so, why?

>3.     Please comment on any mechanisms that you are aware of to allow
>       anonymous domain registrations, or to limit the amount of contact
>       data made publicly available through Whois?

>       Please also comment on the conditions under which the
>       registrant's anonymity is lifted when these services are
>       used.

In general, we are aware of several registrars, affiliated entities,
or independent organizations that claim to offer pseudonymous
registration (pseudonymous, rather than truly anonymous, in that the
intermediate entity knows the end-user's identity, but publishes its
own information in the WHOIS registry instead).  The chief problem
with these "masking" services is that they may unmask their users on
slight provocation; an allegation of wrongdoing is not the same as
proof that unlawful activity has occurred, and there are many ways
to stop even ongoing wrongdoing short of revealing the name of
someone who may later turn out to be innocent of all charges.
Experience to date has been with Go Daddy's Domains-by-Proxy, which
immediately released a registrant's name and identifying information
on an allegation of wrongdoing, before offering the registrant an
opportunity to rebut the claim or remove the site rather than have
his identity revealed.

At the same time, use of these proxy services means that registrants
give up most of their control over the domain names they "hold,"
since the proxy service provider enters into a formal registration
agreement with the registrar of record, and the domain name is only
licensed to the actual registrant.