Interim At-Large Advisory Committee
Comments on the WHOIS Task Force's Final Report on Accuracy and Bulk Access

Introduction

The Interim At-Large Advisory Committee thanks the WHOIS Task Force for its exhaustive and diligent work on challenging policy issues, and appreciates the opportunity to submit its comments on the Task Force's Final Report on Accuracy and Bulk Access. We have considered the Task Force's recommendations with a focus on their effect on individual Internet users, but also within a broader policy context, and have tried to identify priorities for further work where we believe that it needs to be undertaken.

The committee is aware that the Task Force is currently in the process of producing issues reports on several topics; these issues reports will probably cover many of the broader points we make in this document. We hope that the present statement can serve as a useful contribution to that work. We are also looking forward to further contributing to the issues reports themselves and to the general discussion on WHOIS issues.

WHOIS Accuracy

The impact of any measures for the improvement of WHOIS Accuracy must be considered with two very different classes of registrants in mind.

On the one hand, there are those registrants who welcome (or maybe just accept) the publication of their data through the WHOIS database, and have a desire that accurate data are published that way. There is no need for any formal "enforcement" of accurate WHOIS data with respect to this class of registrants -- instead, any measures to improve WHOIS data accuracy for this class of registrants are about making registrars' processes more registrant-friendly, and easier to use. An annual opportunity to review and easily correct WHOIS data without sanctions in the case of registrant's non-response -- as recommended by the Task Force as policy 1.A -- is one such step.

The second class of registrants is much more complex to handle: Those who do not accept publication of personal data in registrars' and registries' WHOIS systems, and provide "inaccurate" contact information to registrars. There are various reasons registrants may have for this behaviour, both legitimate and illegitimate; even worse, the concepts of legitimate and illegitimate reasons vary across cultures and across constituencies.

A careful balance of diverging interests will have to be found in further policy work. This balance will not only have to involve considerations on how to ensure accurate WHOIS data: It will also have to take into account the uses various parties may have for WHOIS data, and the conditions under which the data are being made accessible. It will, finally, have to take into account legitimate privacy interests of registrants, and applicable laws in force in a wide variety of jurisdictions.

Considering the Task Force's recommendations, the ALAC observes that any measures designed to enforce accuracy of publicly available WHOIS data against the will of the domain name holder will shift the existing de-facto balance in a way which benefits those who want to use the data (for whatever purpose, legitimate or illegitimate), and which causes problems for those who don't want to publish these data (once again, both for legitimate and illegitimate reasons).

The specific steps proposed in chapter II.1.B of the Task Force's report describe a complaint mechanism, by which a third party can trigger registrars to investigate the accuracy of existing WHOIS data. This mechanism is presented as a practical recommendation, not as a consensus policy. It is mostly based on the recommendations of the GNSO's WHOIS Implementation Committee.

The ALAC appreciates that the process attempts to provide some basic safeguards against fraudulent complaints by giving registrars some leeway to ignore obviously unjustified complaints, and protect bona fide registrants.

Once a complaint is found justified, the registrar will send an inquiry to the registrant (through any available contact points), and ask the registrant to provide updated information. Any updated information received is subject to "commercially reasonable steps" to check its plausibility; presumably, these steps will involve automated heuristics. If these heuristics fail, "the registrant should be required to provide further justification." ALAC interprets this to imply that automated heuristic plausibility checks alone should not, in general, be a reason for registrars to place existing domain names on hold, or cancel registrations -- in particular in those situations in which the registrant has been successfully contacted through some communications channel. ALAC also observes that, given that many registrars accept customers around the globe, it may frequently be easy for bad faith registrants to provide "plausible" data which are still not useable as contact information.

The registrant only has limited time to respond to registrar's inquiry, which is not specified in the Task Force's final report. The ALAC believes that the WHOIS Implementation Committee's proposal to apply a 30 day time limit is reasonable. Shorter time limits bear a variety of risks for bona fide registrants which have been pointed out in many of the comments received by the WHOIS Task Force. If necessary, the ALAC is available to contribute to any further discussion of this issue.

When accurate WHOIS data are not provided during the correction period, the domain name is put on hold according to the process proposed by the Task Force; the registration is not immediately cancelled. ALAC appreciates that this is a step designed in order to provide additional safety to registrants, and to avoid certain incentives for abuses of the accuracy complaint mechanism.

Bulk Access

The Task Force's policy 2.A proposes that "use of bulk access WHOIS data for marketing should not be permitted." In order to implement this policy, the Task Force suggests a change to the bulk access agreement which is described in section 3.3.6 of the RAA, and observes that the bulk-access provision in section 3.3.6.6 of the RAA would become inapplicable. The WHOIS Implementation Committee has, in its final report, stated that more specific language defining "marketing activities" would be desirable. The ALAC cautions that any such specification would have to ensure that no marketing use of bulk data is permitted unconditionally which would have been covered by the current RAA language's opt-out provision.

The ALAC appreciates that the Task Force's recommendations are an attempt to limit undesired side effects of bulk access. But it is not clear to what extent the new policy will indeed have the desired effect on marketing uses of WHOIS data, since the enforceability of registrars' bulk access agreements is questionable.

Thus, while the ALAC clearly supports the Task Force's recommendation, a more fundamental review of the RAA's bulk access provisions must be undertaken. Those purposes within the scope of ICANN's mission and core values for which bulk access needs to be granted (if any) should be clearly identified, and bulk access should only be made available for this limited set of purposes, and to trustworthy data users. The review process will also need to take into account legal concerns, such as the ones recently articulated in the European Commission's contribution on WHOIS. The At-Large Advisory Committee considers a review process of the RAA's bulk access provisions a priority, and will contribute to it.

Besides these concerns about the RAA's bulk access provisions, the At-Large Advisory Committee also observes that query-based WHOIS can be abused to automatically obtain WHOIS information about large numbers of domains, as evidenced by a recent attempt to copy Nominet's WHOIS database.

Conclusion

The Task Force's recommendations to systematically enforce the accuracy of WHOIS data shift the existing balance between the interests of data users and data subjects in favor of data users. In an environment where registrants have perceived "inaccurate" data to be one of the most practical methods for protecting their privacy, this shift of balance is reason for concern. It will inevitably increase the need for privacy protection mechanisms to be built into the contractual framework.

The Task Force's recommendations on Bulk Access remove one possibility for undesirable uses of WHOIS data. The effectivity of this step is, however, unclear since other ways to access WHOIS data en masse remain open.

Both observations together lead to the common conclusion that the Task Force's recommendations can only be first steps towards a future WHOIS policy environment. That future WHOIS policy environment will have to be designed with a renewed focus on enforceability. In particular, this implies that the future policy environment will have to directly address major issues left open at this point of time - such as registrants' privacy. Relying upon non-enforcement of policy instead is not an option.

The ALAC is available to contribute to future discussions on revising WHOIS policy. These discussions should begin as swiftly as possible.