39 ms·

Whois public database is in breach of GDPR, according to European authorities

545 points by chasontherobot 8y ago

ckastner 8y ago
Note that since the issue is GDPR compliance, this should only be a problem for registrants who are natural persons. So if Whois data were only collected and published for corporations, there shouldn't be a problem. I always felt uncomfortable having to submit my personal data, specifically: my address and phone number, and for it to be published like that (regarding domains where Whois protection services are not allowed). I can understand the motivation for this with regards to corporations and organizations, but what benefit is there with regards to natural persons?
- chopin 8y ago
  To have IP lawyers go after you. Of course there are no benefits and only downsides for natural persons. I have little sympathy for ICANN with this. Malevolent persons can always go to registrars which do not publish personal information and even accept anonymous registration. The current policy harms only lawful citizens.
  - _o_ 8y ago
    The whois record was highly annoying I and i was getting spam at given email address (which was never posted anywhere else). I dont care what ICANN thinks about whois, it is annoying and it is great if it will go away.
    - jacquesm 8y ago
      The spam won't go away. Once your address is out there it will stay out there (unless you change your email address). Those email lists only tend to get longer, never shorter, I still see spam sent to addresses I haven't used in years (and backlink spam requests for websites that haven't been alive since the 90's!).
      - _o_ 8y ago
        I will just kill the email address. Due to the tracking on internet I am using a customized email address for each site where I register to (for example sha1(news.ycombinator.com-secret)@mydomain.com) while my personal address is never used on any website so my antispam quest is quite simple :) You send spam, you are redirected to /dev/null As a side effect, I know when my address is sold to anyone and by which site, I am already sharpening my papers, after 25. of May, every website that will give away my address is going to get serious papercut.
        sjtgraham 8y ago
        How can you prove a data controller gave away your information and that you didn’t falsely do it yourself?
        mschuster91 8y ago
        The burden of proving the provenance of the data relies on the data controller. Unless the data controller wants to pay a high fine, he has to prove where he got the data, and how/when/where the data owner agreed that the data controller was allowed to use the data.
        sjtgraham 8y ago
        Have you read the GDPR?
        GCU-Empiricist 8y ago
        Can you please post a blog guide on administering these paper-cuts.
- captainmuon 8y ago
  And the ridiculous thing is that European* law mandates that you have an "impressum" on all but the most basic sites. You can hide your personal adress in the WHOIS info by putting a neutral third party. The registry I use, inwx.de, offers this service for a few euros. But you cannot (easily) hide your identity in the impressum - you might be able to use a shell company or find a natural person willing to put their name there, but it is much harder. How can they claim "data protection" in one case and make it mandatory to put your name and phone number their in another? It makes me very uncomfortable to host a website, when I know I will get spam, unwanted telefone calls, maybe even unwanted visits at my home, etc.. And it deters me from posting something even a bit controversial on my own domain - this is probably an intended side-effect of the "impressum" policy. (* well, German law, but there is likely something similar in other countries)
  - detaro 8y ago
    If I'm not mistaken, businesses are EU-wide required to have contact data on their pages. And German courts tend to use a very wide definition of commerce – the best compromise is probably to keep commerce and private opinion on strictly separated domains, even if that means no advertising income from the private page.
    - krageon 8y ago
      "contact data" is already a pretty nebulous term. If my experience with European business websites is anything to go by, this is not the sort of requirement that the GP is talking about.
      - detaro 8y ago
        I said "contact data" as shorthand for the specific requirements, since I would have to look them up. And yes, the "Impressumpflicht" the parent talks about is exactly that, in a very strict form. EDIT: To elaborate, the EU e-commerce directive from 2000 requires all member states to have laws that require commercial sites to have at least name of the entity, physical mailing address, business registration IDs if applicable, e-mail and VAT ID published. Since it's only a directive, the details vary from country to country. E.g. France requires also listing a phone number and an actual person responsible for site content.
- walshemj 8y ago
  But in Germany by law all websites must publish information about the publisher, including their name and address, telephone number or e-mail address, trade registry number, VAT number, and other information depending on the type of company. all this seems fine according to eu law so I am not sure why dns registration is any diferent
  - kuschku 8y ago
    Because you publish yourself, you can change it yourself, and you can take it down again yourself. And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint.
    - dx034 8y ago
      Unless you provide journalistic content. Then you could be required to have an imprint as well. I was always wondering if they overturn this at some point. I don't know of any other country requiring it and I doubt that it helps taking down illicit content. If anything, it helps consultants for offshore companies.
      - cJ0th 8y ago
        I hate this law with a passion. It doesn't seem proportionate to me at all. The main beneficiaries are folks who want to sell addresses in bulk and dodgy lawyers ("Abmahnanwälte"). I'd be fine with depositing my personal date somewhere so that people with legitimate concerns can contact me but it should require some effort so that the function can't be abused.
    - cJ0th 8y ago
      > And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint. I wouldn't be too sure. There is, unfortunately, a lot of room for interpretation with this law. Rather cautious adviser urge you to have one as long as your website isn't private in the sense that can't be accessed by the public (i.e. a website for family members that can only be accessed with a password). This law (IANAL) is just horrible.
- peterwwillis 8y ago
  > what benefit is there with regards to natural persons? [ tries to visit ckastner.com ] [ the website is down ] [ looks up Whois record for ckastner.com ] [ picks up phone, dials number ] "Hello, yes, Christian Kastner? Your website is down. Just thought you should know." That, and for the abuse address, and for dealing with technical issues between different sites, etc. You can use a Whois-hiding service to make it private yet still get the communications.
  - detaro 8y ago
    The ICANN proposal preserves a way to contact the owner (via e-mail), so that's not impacted.
    - peterwwillis 8y ago
      If your website is down, your mail relay may be down, making e-mail unavailable. The phone is also a much better way to contact someone immediately, which you might want when your website is down.
      - jacquesm 8y ago
        If you rely on your visitors to phone you when your website is down you are doing something very wrong.
        peterwwillis 8y ago
        Once I worked for a company where part of the website had been compromised by an attacker, and was being used to host some malware. We only found out when a random visitor found it, then looked through the site and found a random support address (which was supposed to be internal-only), and sent us an e-mail to tell us about it, which luckily generated a ticket which we eventually reviewed. We would have preferred someone called us immediately, in case we didn't see the ticket immediately. But we didn't have a security hotline publicly listed. Putting a phone number in a big public directory of phone numbers for when e-mail doesn't work isn't a bad idea, regardless of what anyone (including the EU) says. We've had phone books forever. This is just a phone book for domains.
- Lunatic666 8y ago
  Most of the whois hiding services cost money, so if I get this “service” for free now, I don’t have much sympathy with the whois guys. If it’s about contacting people, they could make the abuse@ or webmaster@ address mandatory, then you can separate it from your normal email accounts, because the majority will be spam anyway.
  - amaccuish 8y ago
    Or offer an anonimiser service in place of your email, which just redirects to your actual email. Not everyone hosts email on their domain.
  - nabc45 8y ago
    >Most of the whois hiding services cost money Where? I never paid a dime
    - nicky0 8y ago
      Godaddy
      - tazard 8y ago
        At least in Canada, this is absolutely not true. https://ca.godaddy.com/domainaddon/private-registration.aspx https://ca.godaddy.com/domainaddon/private-registration.aspx
        tazard 8y ago
        Sorry, I thought you were replying to the, where it's free parent, not the where it's not free parent. Please ignore what I wrote earlier.
    - ry_ry 8y ago
      123reg charge for whois privacy too, as do a bunch of other registrars. Always felt like mild extortion.
    - 8y ago
- merinowool 8y ago
  What about company officer data that is personal information?
- yummybear 8y ago
  So nefarious entities would just have an employee or owner register the domains personally.
- ams6110 8y ago
  One's address is a matter of public record anyway, so I'm not too concerned about my address appearing in a WHOIS. Phone number, at worst you get some spam calls, but I don't answer numbers I don't recognize so it's of low concern.
  - always_good 8y ago
    Lowering the bar of getting your name + address + phone number just lowers the bar for social engineering. It does you zero favors.
  - Magnets 8y ago
    Personal addresses are not public record in the UK for the vast majority of people, and neither are phone numbers
    - ams6110 8y ago
      You don't have phone directories?
      - nocobot 8y ago
        In Germany you can choose to not be listed in those, I assume it's the same in the UK .
      - return1 8y ago
        you mean, in the US you can't opt out of them?
        ghaff 8y ago
        When everyone had landlines, I believe you could get an unlisted number for a fee. Very few did AFAIK. There is no white pages for cellphones but I still get junk calls anyway.
      - Angostura 8y ago
        YOu can opt out and many people do (ex-directory)
- Animats 8y ago
  Whois info should be available for all businesses under EU law, under the European Directive on Electronic Commerce. In the EU, privacy is only for individuals. If you're in business, the commercial rules apply:[1] Member States shall ensure that the service provider shall render easily, directly and permanently accessible to the recipients of the service and competent authorities, at least the following information: (a) the name of the service provider, (b) the geographic address at which the service provider is established, (c) the details of the service provider, including his electronic mail address, which allow him to be contacted rapidly and communicated with in a direct and effective manner. A "service provider" is basically anyone with a commercial web site. See (17) and (18) in [1] for the detailed definition. [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000L0031:EN:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...
- roymckenzie 8y ago
  "Corporations are people, my friend."
- giobox 8y ago
  One of the few practical uses of WHOIS data is basically so ICANN have an address on file for when someone wants to dispute your ownership of a domain on trademark grounds. Anyone who registers a gTLD is forced to submit to their private dispute resolution process (UDRP) as part of their agreement with their registrar. There’s literally no way to opt out unless you don’t want a gTLD, thanks to ICANN’s total control. There's also (very bad) precedent in the UDRP for using out of date or inaccurate WHOIS information as evidence of Registration/Use in bad faith. There's even been cases where a UDRP panelist has argued using WHOIS privacy services was prima facie evidence of bad faith, which beggars belief. http://www.udrpsearch.com/naf/1684372 http://www.udrpsearch.com/naf/1684372 "This Panel member is persuaded there is bad faith registration and use because of several factors. The first factor is using a privacy service in a commercial context raises a rebuttable presumption of bad faith. Respondent has done nothing to rebut that presumption. Respondent does not need to conceal its identity from the marketplace to be a domain name reseller. Respondent offers no explanation as to why Respondent concealed its identity (and conceals it to this very day). Only people with an intent to deceive conceal their identity, which is the very definition of bad faith. Since Respondent did this at the time of registration and through the present day, there was bad faith registration and use of the domain name." Thankfully other panel members dissented, but the UDRP has a long history of questionable reasoning and decision making, and bizarre WHOIS issues are not unheard of.
verroq 8y ago
Whois is no longer such a good idea in this age of doxing anyway. I don’t know anyone who isn’t hiding their whois details and writing fake names and addresses. I had the misfortune of using namecheap and entered my real details once. Their whois privacy didn’t apply to the particular gtld and I only found out once the spam arrived. Never putting any real details ever again.
- return1 8y ago
  Spam is only the beginning. Wait until a crazy person gets angry at yuor site.
  - egg_head12 8y ago
    Oh no someone is sending nasty messages. If your on the web it's to be expected.
    - return1 8y ago
      not when they start posting stuff with your name on social and other media, or threatening you that they know where u live
    - petepete 8y ago
      It's more of a problem if they know your phone number and where you live.
    - jacquesm 8y ago
      It's all fun & games until your doorbell rings.
      - shiftpgdn 8y ago
        Ain't that the truth.
      - TazeTSchnitzel 8y ago
        Or you hear the police shouting.
dz0ny 8y ago
Whois can perfectly have only technical data. - domain expiry - domain registration date - nameservers Everything else is not needed and as such would comply with GDPR.
- vegardx 8y ago
  If you want EV certs you definitively need more information than that, part of the idea is that there is public verifiable information that only the owner can change.
  - deleted 8y ago
    [deleted]
  - merinowool 8y ago
    But does it need to be personal information?
    - vegardx 8y ago
      I think the short answer: It depends. In some cases it's not enough to register the domain on a legal entity, it needs to be a person, and that person needs to exist in the company and needs to be contactable. You cannot get around this with EV certifications.
  - CydeWeys 8y ago
    There are multiple ways to deliver gated access to registrant data only to those who need to know (like EV cert issuers). See e.g. RDAP, a JSON/REST successor protocol to WHOIS, which displays different amounts of data depending on if you're logged in and what data your account has access to.
billpg 8y ago
Why does WHOIS need someone's phone number anyway? I didn't have a phone number between 1993 and 1998 and I would have liked to have had a domain back then. (I almost did buy one, except they were too expensive back then.)
- giancarlostoro 8y ago
  Probably all so they know which direction to point lawyers / government agencies towards when they come knocking about your domain.
  - realusername 8y ago
    They could just send an email to abuse@[domain] like anybody else.
    - nabc45 8y ago
      Which you could ignore, but you can't ignore a lawyer.
      - realusername 8y ago
        Maybe it's better that way, lawyers have to do actual manual work on cases that matters instead of sending random legal threats to every company they can find. Random legal threats are not substitutes for law enforcement.
    - chrismorgan 8y ago
      In my experience of recent years, addresses like abuse@, webmaster@, hostmaster@ and postmaster@ normally bounce. It’s a real nuisance when I want to report bugs in web systems, or in email systems where they’re doing enough things badly wrong that they trip (or get close to tripping) spam filters, et cetera.
      - giancarlostoro 8y ago
shironineja 8y ago
First ... they came for ICANN, and I did not speak out.
- GenericsMotors 8y ago
  A bit melodramatic, don't you think? Corporations will continue to have their details listed, this covers what info can be stored and published about actual persons.
realusername 8y ago
It sounds like a positive policy to me, I don't understand the backlash of the author of this article, personal details have no relation to domain names and I don't see why they should.
- arcbyte 8y ago
  Something owns a domain, and the details of that something need to be known - personal or not. Easy.
- EpicEng 8y ago
  Personal details related to a car, right? And real estate? I don't understand your argument.
  - ysleepy 8y ago
    So write your name, address and telephone number on the back of your car. Maybe you don't want to, and thats ok.
    - EpicEng 8y ago
      ...I think you're forgetting about that whole registration thing you do each year.
anilakar 8y ago
One month to adapt? They have had two years. Also, I fail to see how this is a problem, considering that quite a few domains nowadays seem to use WhoisGuard or a similar service anyway.
- Crosseye_Jack 8y ago
  >I fail to see how this is a problem... Some TLD's don't allow proxy registrations. whois privacy being a service extra (sometimes included for free sometimes a paid extra which can expire and expose your data if you miss the email) where other TLD's (.uk springs to mind) already have the ability to withheld the personal details of domain registrants (private individuals have the ability to held their data, company registrations have their data shown) at the registry level and not having to use a 3rd party company.
  - martin-adams 8y ago
    Is there a difference between proxy registrations and not making the registrant information public?
    - Crosseye_Jack 8y ago
      Well your still seen as the owner of the domain in the register’s eyes and not a proxy company which may help if you need to transfer the domain away from your registar for any unexpected reason.
    - mschout 8y ago
      I am an engineer working for a registrar and we've been told by at least one TLD that there is no difference. We used to "mask" the registrant email regardless of whether or not the customer had opted-in for proxy registration, and we were told this was not allowed by the TLD operator.
- return1 8y ago
  > I fail to see how this is a problem, > seem to use WhoisGuard or a similar service anyway So it was always a problem, now it is also illegal
nailer 8y ago
Pity this is flagged. It's hacker relevant, the Register is a well regarded technology site, and I'd rather a plain speaking title with some mildly rude words than some Vox clickbait.
- return1 8y ago
  i posted it the other day and it got flagged as well. its an important issue to many. some people need to get their heads out of their arses
- jwilk 8y ago
  > the Register is a well regarded technology site Is it? (Honest question, I have no idea.) Most of the links at https://news.ycombinator.com/from?site=theregister.co.uk https://news.ycombinator.com/from?site=theregister.co.uk are dead for some reason.
  - andybak 8y ago
    Yes. I often disagree with it and they are often sensationalist and abrasive but I always enjoy reading it.
    - jholman 8y ago
      Yeah, I think "often disagree and often sensationalist" is a good assessment. For any given Reg article, I won't rule out that maybe the author is a nutter, but they're usually well-informed or interesting or amusing or some combination.
      - nailer 8y ago
        Yeah, I expect they know what they're talking about, and have an opinion which they'll make obvious - which I may not necessarily agree with. Sysadmin folks would know the term 'BofH' which got popularised by The Register.
  - return1 8y ago
labster 8y ago
Wow, this is the first time I've seen a [dead] article on the front page. Not sure I understand the front page algorithm. Vouched, of course, as it's definitely newsworthy to hackers to know that the law is potentially going to shut down the whois service.
- djsumdog 8y ago
  I think the previous version was removed because it used The Register's sensational title. Also, I thought you couldn't submit anything from The Register. Every time I've tried I've gotten an error, and their titles are always sensational anyway.
  - Doctor_Fegg 8y ago
    It’s not particularly sensational, it’s just British slang. Very much in the tradition of Private Eye et al. I find it a little disappointing that HN mods believe British slang is a reason to depart from the original-headline-only policy when any amount of SV hype is let through unchallenged, tbh.
Anthony-G 8y ago
Original blog post from Michele Neylon of Blacknight (registrar based in Ireland): https://blacknight.blog/game-over-for-public-whois-article-29-gives-icann-the-advice-it-asked-for.html https://blacknight.blog/game-over-for-public-whois-article-2... As an ex-customer, I've found that Blacknight are generally supportive of Internet freedoms and they do a lot to advocate the adoption of IPv6.
- DanBC 8y ago
  That's a much better article.
anfilt 8y ago
I really don't see why DNS records should be in the purview of the GDPR. I also think they are not public enough. It can be hard to contact people. Information is outdated, false or just hidden. Usually being able to call the person responsible for a domain and say hey your email server has relaying enabled and pushing out a lot spam gets them to fix it. I can understand person not wanting to put their address, but I say phone, email, name and points contact should be necessary. It is a public system after all. Spam can be a problem as well, but these records do serve a purpose. They also are important for ownership of a domain if a dispute was to arise.
- Tharkun 8y ago
  You've obviously never been threatened, harassed or stalked simply for running a blog with real contact information in the whois records.
  - egg_head12 8y ago
    Stalking really? Threats and harassment. Just tell them to gtfo! I would be more worried about swatting with the address component. I can see that for corporations/businesses.
    - gambiting 8y ago
      >> Just tell them to gtfo! I see you've also never been threatened before. It doesn't work.
    - krageon 8y ago
      Telling them to GTFO doesn't really comfort you if you receive fake (hopefully) bomb packages at home or whatever else (frequent mailings of poop for example). The local police generally also doesn't do very much for you (unless it's really bad, like a real immediate threat to your life from an actual pipe bomb). Even if they do, that doesn't mean it will stop anytime soon. In the meantime it's slowly eating away at your sanity: Is this real mail? Can I go outside for groceries without getting stabbed? These are not fun concerns to have to have. Seeing as it's 100% avoidable and unnecessary to have this information available in this way, I don't think it is a bad thing to remove it.
therealmarv 8y ago
I hope ICANN will get a huge penalty for continuing their whois service after end of May.
interdrift 8y ago
Correct move :). ave Evropa
tschellenbach 8y ago
It would be fun to compile a list of EU government websites that don't comply with GDPR.
icedchai 8y ago
Absurd. Users "consented" when they signed up for a domain. Don't like it? Use a whois service to anonymize.
- CydeWeys 8y ago
  GDPR requires "freely given, specific, informed and unambiguous" consent. It also says that "Silence, pre-ticked boxes or inactivity, however, is presumed inadequate to confer consent." This kind of explicit consent was not given in the case of most domain registrations, and anyway, GDPR allows for withdrawal of consent, so even if you did grant it in the past, you can withdraw it now.
  - icedchai 8y ago
    That's why I put "consent" in quotes. (I think GDPR is a waste of resources, even though I have profited from some implementation activities.)
    - CydeWeys 8y ago
      They didn't consent though, not by the standards of the GDPR, so their personal information cannot be published in WHOIS. So, no, paying extra for an anonymizing WHOIS service is not necessary; this will be the default level of service from a registrar. I'm not sure what your intended argument is; can you rewrite in plain English and without scare quotes?
      - icedchai 8y ago
        Yes, I understand that. Consent was originally in quotes because it wasn't actually consent in GDPR terms. However, I will continue to argue that it was consent in a more general sense: They bought a domain, therefore their info is published in whois. It is necessary to provide the service. If they do not want their info published, they could have taken action to prevent it (whois service, alternate name, alternate email.)
        8y ago
tehabe 8y ago
It is always the same, a law is enacted and it includes a window of a few years to give everybody time to implement it. A few weeks before the law goes into effect, everybody is screaming that they need more time. I guess we don't leave university after all.
deleted 8y ago
[deleted]
megaman22 8y ago
Yikes, GDPR is a well-intentioned shitshow. It's trying to graft new requirements onto something that was never designed to support them. And it looks like it is going about as well as trying to slap multiplayer on top of a hoary old single-player game engine.
- DanBC 8y ago
  These aren't new requirements. They've been part of EU law since 1995.
martin-adams 8y ago
I wonder if Companies House in the UK is also affected. I tried to get them to remove personal information a while back as it wasn't a requirement for new businesses. They said no. I supplied that information long before Companies House made it easily available. I will try again after the GDPR is place.
- sethgecko 8y ago
  > it wasn't a requirement for new businesses Companies house asks for director name/address/dob when you register a company
  - martin-adams 8y ago
    Correct, but new directors can opt to keep that information private and out of the public domain. So what I meant was, having the information public is no longer a requirement.
y7 8y ago
Interesting, I just queried the WHOIS records of a .im domain which used to display my personal information, but now it displays: This information has been redacted to comply with European Union General Data Protection Regulations (GDPR). Please contact us at info@nic.im if you have any further queries. Domain Managers Name: Redacted Address Redacted Domain Owners / Registrant Name: Redacted Address Redacted [...]
- djsumdog 8y ago
  huh .. I just checked my own .im domain and got the same response. Interesting. That was fast.
  - CydeWeys 8y ago
    It's actually slow when you think about it another way. GDPR has been looming for years, and it's now only a month and a week prior to enforcement date that things have started changing.
- Symbiote 8y ago
  Particularly interesting, as the Isle of Man isn't in the European Union.
  - furyg3 8y ago
    If the TLD authority on the Island is offering a good/service to an EU person, even if they are outside the EU, they will need to protect that data in the way that the GDPR specifies. So they can either decide to not publicize that info for EU persons (based on address?), or not publish any natural person's data. But let's say they didn't want to. No consequences, right? Not quite... the .im authority allows EU businesses (domain registrars) to register domain names (for example, I can go to transip.nl and register a .im domain name). TransIP has to comply with the GDPR. If TransIP collects my information to pass it outside the EU, they need to be certain that the organization they provide it to is also GDPR compliant. If they don't have those assurances, they can't give them the info. So not being GDPR compliant is not great for the .im revenue stream. Finally, I have no clue about the legal regime on the Isle of Man. If I were them, I would probably try to sync up a lot of my laws with the UK (and thus EU, for now) laws. So my guess is they have some sort of data protection act, and that it's in line with the GDPR (or will be very soon).
romanovcode 8y ago
Don't see a problem. I don't get why do I need to provide my full name, address and a phone number to register domain. What's even worse is that someone can just look it up.
chiefalchemist 8y ago
> From the article - "Critics point out that ICANN has largely brought these problems on itself, having ignored official warnings from the Article 29 Working Party for nearly a decade, and only taking the GDPR requirements seriously six months ago when there has been a clear two-year lead time." > From: https://www.icann.org/resources/pages/what-2012-02-25-en https://www.icann.org/resources/pages/what-2012-02-25-en "ICANN was formed in 1998. It is a not-for-profit partnership of people from all over the world dedicated to keeping the Internet secure, stable and interoperable. It promotes competition and develops policy on the Internet’s unique identifiers. ICANN doesn’t control content on the Internet. It cannot stop spam and it doesn’t deal with access to the Internet. But through its coordination role of the Internet’s naming system, it does have an important impact on the expansion and evolution of the Internet." --- Editorial: The disconnect is frightening.
otakucode 8y ago
So block Europe from all DNS. Simple.
- cosinetau 8y ago
  That would be a very aggressive response from ICANN, though it might work from an arms race perspective. I don't think cold war era thinking alone is the solution to these issues; there are likely other, less destructive, paths.
  - CydeWeys 8y ago
    A lot of people involved in ICANN are European themselves anyway, and many believe in user privacy on a personal level. And it's not that ICANN doesn't, either, it's just a big ship to turn around on a dime. So yeah, there's no way any kind of response like this will be happening.
  - otakucode 8y ago
    It would be a pretty aggressive response, and certainly not one anyone would be pleased with at all. Not consumers, not ICANN, and not anyone really. But... the European Union is being extremely aggressive here to start with. They are seeking to dictate global policy and threatening gigantic sanctions if not responded to on a very short timetable. One would have to presume that they would prefer the database being blocked from access to its continued accessibility, and that might be the only possible option in order to avoid those sanctions. I certainly do hope there are other less destructive solutions, but it's not like GDPR or the problems it has with WHOIS just sprung up suddenly. The EU knew this was going to be challenging and would require discussion, but the discussion has apparently reached the point where they have decided going on the offensive is their best option. It's not like ICANN could just flip a switch and change everything to be in compliance but they're refusing to. What the EU wants is a huge change, and you can't just stamp your feet and expect it to magically happen. But that's the unreasonable path they've chosen.
- merinowool 8y ago
  What if EU citizen visits from the US? Still needs to be blocked...
jiveturkey 8y ago
Completely unacceptable response from ICANN. They don't need a special exemption. Turn the service off until you can fix it. And they had plenty of time!
kevin_b_er 8y ago
This will end WHOIS I think. It should provide interesting to see the side effects of abuse/spam where they can't be identified as easily anymore. On the flip side, mass IP demand letters will become much harder when you can't target someone as easily.
ttul 8y ago
A little-known fact: WHOIS is extensively relied on by spam fighters like Spamhaus to do their good work, which collectively saves all of us from an enormous tidal wave of spam that would otherwise consume vast resources. Internally, the anti-spam and more generally the anti-abuse community builds a huge and mostly real-time cross-referenced database of information about domains and IP addresses. This database would be impossible to build without WHOIS. For example, if one domain shares the same contact email address as another, then the domains are related somehow. Doing some data mining on a variety of signals which are apparent in the WHOIS records can help to cluster related domains to help anti-abuse researchers find newly problematic domains by following the trail through WHOIS. I'm not sure how researchers will do their job effectively without WHOIS. This development is truly a disaster for anti-abuse.
- gojomo 8y ago
  Never mind the WHOIS, those other anti-spam databases may be GDPR-violating, as well. Did that spammer affirmatively opt-in to having his origin addresses/domains/IPs and response phone-numbers/etc tracked in your anti-spam data? Probably not!
  - anonymouz 8y ago
    That doesn't seem to be personal information.
    - theptip 8y ago
      I believe IP addresses are considered "PII" under GDPR, since they can be used to identify an individual. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/
      - anonymouz 8y ago
        "PII" only seems to exist in US law, GDPR has "personal data". I am far from an expert an GDPR, but it doesn't seem to be so clear cut. Even if IP addresses in this context are considered personal data, there may be "legitimate interest" in processing them for blacklists, e.g. https://gdpr-info.eu/recitals/no-49/ https://gdpr-info.eu/recitals/no-49/ could apply. I am confident a workable solution for spam blacklists will be found. I have the impression that a lot of the fear around GDPR is unfounded if one uses a reasonable and restrictive approach of processing and storing personal data.
DoctorOetker 8y ago
nobody mentions namecoin?
sbov 8y ago
I didn't mind my info being in whois records. Until websites started hosting that info. And Google started crawling those websites. There's a big difference between your wife's ex guessing your domain and running whois on it to find her home address, vs just being able to Google her name to find it.
- noja 8y ago
  Isn't every single one of those websites violating that TOS of the registry, that the data may be queried, but not stored? (queue the "there's no difference" brigade - yes there is)
  - sbov 8y ago
    I'm guessing they didn't actually store it, because it got cleaned up shortly after I deregistered the domain.
TekMol 8y ago
If whois is not public, how do I even know if I own my domain? What if the company that I register my domain with just registers it for themselfes and when I have built a million dollar business on it, they sell it to somebody else?
- jstarfish 8y ago
  The .tk domain is notorious for this.
- ysleepy 8y ago
  You get a token issued at registration to check with ICANN? It is not that hard a problem.
gwbas1c 8y ago
I get so much SPAM from WHOIS, email, phone, and texts. My hosting service wants to charge me to anonymize it. Twisting ICANN's arm to hide this information is desperately needed.
textmode 8y ago
Why did ICANN require "thick" whois data from registrars? Ms. Jelinek's letter suggests that collecting this user data , possibly for the benefit of various "stakeholders", was outside the scope of ICANN's charter. Why was it a requirement for ICANN-approved registrars to collect and share this user data? What was the rationale?
- mschout 8y ago
  I believe the main reason for this (along with the requirement that registrars "escrow" contact info for all of their domains with an approved third party such as Iron Mountain) is so that the domain ownership information can be recovered in the case of a registrar failure. E.g.: registrar closes unexpectedly, or registrar suffers some catastrophe and loses the contact info.

Note that since the issue is GDPR compliance, this should only be a problem for registrants who are natural persons. So if Whois data were only collected and published for corporations, there shouldn't be a problem. I always felt uncomfortable having to submit my personal data, specifically: my address and phone number, and for it to be published like that (regarding domains where Whois protection services are not allowed). I can understand the motivation for this with regards to corporations and organizations, but what benefit is there with regards to natural persons?

chopin 8y ago
To have IP lawyers go after you. Of course there are no benefits and only downsides for natural persons. I have little sympathy for ICANN with this. Malevolent persons can always go to registrars which do not publish personal information and even accept anonymous registration. The current policy harms only lawful citizens.
- _o_ 8y ago
  The whois record was highly annoying I and i was getting spam at given email address (which was never posted anywhere else). I dont care what ICANN thinks about whois, it is annoying and it is great if it will go away.
  - jacquesm 8y ago
    The spam won't go away. Once your address is out there it will stay out there (unless you change your email address). Those email lists only tend to get longer, never shorter, I still see spam sent to addresses I haven't used in years (and backlink spam requests for websites that haven't been alive since the 90's!).
    - _o_ 8y ago
      I will just kill the email address. Due to the tracking on internet I am using a customized email address for each site where I register to (for example sha1(news.ycombinator.com-secret)@mydomain.com) while my personal address is never used on any website so my antispam quest is quite simple :) You send spam, you are redirected to /dev/null As a side effect, I know when my address is sold to anyone and by which site, I am already sharpening my papers, after 25. of May, every website that will give away my address is going to get serious papercut.
      - sjtgraham 8y ago
        How can you prove a data controller gave away your information and that you didn’t falsely do it yourself?
        mschuster91 8y ago
        The burden of proving the provenance of the data relies on the data controller. Unless the data controller wants to pay a high fine, he has to prove where he got the data, and how/when/where the data owner agreed that the data controller was allowed to use the data.
        sjtgraham 8y ago
        Have you read the GDPR?
      - GCU-Empiricist 8y ago
        Can you please post a blog guide on administering these paper-cuts.
captainmuon 8y ago
And the ridiculous thing is that European* law mandates that you have an "impressum" on all but the most basic sites. You can hide your personal adress in the WHOIS info by putting a neutral third party. The registry I use, inwx.de, offers this service for a few euros. But you cannot (easily) hide your identity in the impressum - you might be able to use a shell company or find a natural person willing to put their name there, but it is much harder. How can they claim "data protection" in one case and make it mandatory to put your name and phone number their in another? It makes me very uncomfortable to host a website, when I know I will get spam, unwanted telefone calls, maybe even unwanted visits at my home, etc.. And it deters me from posting something even a bit controversial on my own domain - this is probably an intended side-effect of the "impressum" policy. (* well, German law, but there is likely something similar in other countries)
- detaro 8y ago
  If I'm not mistaken, businesses are EU-wide required to have contact data on their pages. And German courts tend to use a very wide definition of commerce – the best compromise is probably to keep commerce and private opinion on strictly separated domains, even if that means no advertising income from the private page.
  - krageon 8y ago
    "contact data" is already a pretty nebulous term. If my experience with European business websites is anything to go by, this is not the sort of requirement that the GP is talking about.
    - detaro 8y ago
      I said "contact data" as shorthand for the specific requirements, since I would have to look them up. And yes, the "Impressumpflicht" the parent talks about is exactly that, in a very strict form. EDIT: To elaborate, the EU e-commerce directive from 2000 requires all member states to have laws that require commercial sites to have at least name of the entity, physical mailing address, business registration IDs if applicable, e-mail and VAT ID published. Since it's only a directive, the details vary from country to country. E.g. France requires also listing a phone number and an actual person responsible for site content.
walshemj 8y ago
But in Germany by law all websites must publish information about the publisher, including their name and address, telephone number or e-mail address, trade registry number, VAT number, and other information depending on the type of company. all this seems fine according to eu law so I am not sure why dns registration is any diferent
- kuschku 8y ago
  Because you publish yourself, you can change it yourself, and you can take it down again yourself. And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint.
  - dx034 8y ago
    Unless you provide journalistic content. Then you could be required to have an imprint as well. I was always wondering if they overturn this at some point. I don't know of any other country requiring it and I doubt that it helps taking down illicit content. If anything, it helps consultants for offshore companies.
    - cJ0th 8y ago
      I hate this law with a passion. It doesn't seem proportionate to me at all. The main beneficiaries are folks who want to sell addresses in bulk and dodgy lawyers ("Abmahnanwälte"). I'd be fine with depositing my personal date somewhere so that people with legitimate concerns can contact me but it should require some effort so that the function can't be abused.
  - cJ0th 8y ago
    > And as a reminder, the German rule only applies to commercial sites — a site with no ads and no way to pay such as quasseldroid.info does not need an Imprint. I wouldn't be too sure. There is, unfortunately, a lot of room for interpretation with this law. Rather cautious adviser urge you to have one as long as your website isn't private in the sense that can't be accessed by the public (i.e. a website for family members that can only be accessed with a password). This law (IANAL) is just horrible.
peterwwillis 8y ago
> what benefit is there with regards to natural persons? [ tries to visit ckastner.com ] [ the website is down ] [ looks up Whois record for ckastner.com ] [ picks up phone, dials number ] "Hello, yes, Christian Kastner? Your website is down. Just thought you should know." That, and for the abuse address, and for dealing with technical issues between different sites, etc. You can use a Whois-hiding service to make it private yet still get the communications.
- detaro 8y ago
  The ICANN proposal preserves a way to contact the owner (via e-mail), so that's not impacted.
  - peterwwillis 8y ago
    If your website is down, your mail relay may be down, making e-mail unavailable. The phone is also a much better way to contact someone immediately, which you might want when your website is down.
    - jacquesm 8y ago
      If you rely on your visitors to phone you when your website is down you are doing something very wrong.
      - peterwwillis 8y ago
        Once I worked for a company where part of the website had been compromised by an attacker, and was being used to host some malware. We only found out when a random visitor found it, then looked through the site and found a random support address (which was supposed to be internal-only), and sent us an e-mail to tell us about it, which luckily generated a ticket which we eventually reviewed. We would have preferred someone called us immediately, in case we didn't see the ticket immediately. But we didn't have a security hotline publicly listed. Putting a phone number in a big public directory of phone numbers for when e-mail doesn't work isn't a bad idea, regardless of what anyone (including the EU) says. We've had phone books forever. This is just a phone book for domains.
Lunatic666 8y ago
Most of the whois hiding services cost money, so if I get this “service” for free now, I don’t have much sympathy with the whois guys. If it’s about contacting people, they could make the abuse@ or webmaster@ address mandatory, then you can separate it from your normal email accounts, because the majority will be spam anyway.
- amaccuish 8y ago
  Or offer an anonimiser service in place of your email, which just redirects to your actual email. Not everyone hosts email on their domain.
- nabc45 8y ago
  >Most of the whois hiding services cost money Where? I never paid a dime
  - nicky0 8y ago
    Godaddy
    - tazard 8y ago
      At least in Canada, this is absolutely not true. https://ca.godaddy.com/domainaddon/private-registration.aspx https://ca.godaddy.com/domainaddon/private-registration.aspx
      - tazard 8y ago
        Sorry, I thought you were replying to the, where it's free parent, not the where it's not free parent. Please ignore what I wrote earlier.
  - ry_ry 8y ago
    123reg charge for whois privacy too, as do a bunch of other registrars. Always felt like mild extortion.
  - 8y ago
merinowool 8y ago
What about company officer data that is personal information?
yummybear 8y ago
So nefarious entities would just have an employee or owner register the domains personally.
ams6110 8y ago
One's address is a matter of public record anyway, so I'm not too concerned about my address appearing in a WHOIS. Phone number, at worst you get some spam calls, but I don't answer numbers I don't recognize so it's of low concern.
- always_good 8y ago
  Lowering the bar of getting your name + address + phone number just lowers the bar for social engineering. It does you zero favors.
- Magnets 8y ago
  Personal addresses are not public record in the UK for the vast majority of people, and neither are phone numbers
  - ams6110 8y ago
    You don't have phone directories?
    - nocobot 8y ago
      In Germany you can choose to not be listed in those, I assume it's the same in the UK .
    - return1 8y ago
      you mean, in the US you can't opt out of them?
      - ghaff 8y ago
        When everyone had landlines, I believe you could get an unlisted number for a fee. Very few did AFAIK. There is no white pages for cellphones but I still get junk calls anyway.
    - Angostura 8y ago
      YOu can opt out and many people do (ex-directory)
Animats 8y ago
Whois info should be available for all businesses under EU law, under the European Directive on Electronic Commerce. In the EU, privacy is only for individuals. If you're in business, the commercial rules apply:[1] Member States shall ensure that the service provider shall render easily, directly and permanently accessible to the recipients of the service and competent authorities, at least the following information: (a) the name of the service provider, (b) the geographic address at which the service provider is established, (c) the details of the service provider, including his electronic mail address, which allow him to be contacted rapidly and communicated with in a direct and effective manner. A "service provider" is basically anyone with a commercial web site. See (17) and (18) in [1] for the detailed definition. [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000L0031:EN:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...
roymckenzie 8y ago
"Corporations are people, my friend."
giobox 8y ago
One of the few practical uses of WHOIS data is basically so ICANN have an address on file for when someone wants to dispute your ownership of a domain on trademark grounds. Anyone who registers a gTLD is forced to submit to their private dispute resolution process (UDRP) as part of their agreement with their registrar. There’s literally no way to opt out unless you don’t want a gTLD, thanks to ICANN’s total control. There's also (very bad) precedent in the UDRP for using out of date or inaccurate WHOIS information as evidence of Registration/Use in bad faith. There's even been cases where a UDRP panelist has argued using WHOIS privacy services was prima facie evidence of bad faith, which beggars belief. http://www.udrpsearch.com/naf/1684372 http://www.udrpsearch.com/naf/1684372 "This Panel member is persuaded there is bad faith registration and use because of several factors. The first factor is using a privacy service in a commercial context raises a rebuttable presumption of bad faith. Respondent has done nothing to rebut that presumption. Respondent does not need to conceal its identity from the marketplace to be a domain name reseller. Respondent offers no explanation as to why Respondent concealed its identity (and conceals it to this very day). Only people with an intent to deceive conceal their identity, which is the very definition of bad faith. Since Respondent did this at the time of registration and through the present day, there was bad faith registration and use of the domain name." Thankfully other panel members dissented, but the UDRP has a long history of questionable reasoning and decision making, and bizarre WHOIS issues are not unheard of.

verroq 8y ago

Whois is no longer such a good idea in this age of doxing anyway. I don’t know anyone who isn’t hiding their whois details and writing fake names and addresses. I had the misfortune of using namecheap and entered my real details once. Their whois privacy didn’t apply to the particular gtld and I only found out once the spam arrived. Never putting any real details ever again.

return1 8y ago
Spam is only the beginning. Wait until a crazy person gets angry at yuor site.
- egg_head12 8y ago
  Oh no someone is sending nasty messages. If your on the web it's to be expected.
  - return1 8y ago
    not when they start posting stuff with your name on social and other media, or threatening you that they know where u live
  - petepete 8y ago
    It's more of a problem if they know your phone number and where you live.
  - jacquesm 8y ago
    It's all fun & games until your doorbell rings.
    - shiftpgdn 8y ago
      Ain't that the truth.
    - TazeTSchnitzel 8y ago
      Or you hear the police shouting.

dz0ny 8y ago

Whois can perfectly have only technical data. - domain expiry - domain registration date - nameservers Everything else is not needed and as such would comply with GDPR.

vegardx 8y ago
If you want EV certs you definitively need more information than that, part of the idea is that there is public verifiable information that only the owner can change.
- deleted 8y ago
  [deleted]
- merinowool 8y ago
  But does it need to be personal information?
  - vegardx 8y ago
    I think the short answer: It depends. In some cases it's not enough to register the domain on a legal entity, it needs to be a person, and that person needs to exist in the company and needs to be contactable. You cannot get around this with EV certifications.
- CydeWeys 8y ago
  There are multiple ways to deliver gated access to registrant data only to those who need to know (like EV cert issuers). See e.g. RDAP, a JSON/REST successor protocol to WHOIS, which displays different amounts of data depending on if you're logged in and what data your account has access to.

billpg 8y ago

Why does WHOIS need someone's phone number anyway? I didn't have a phone number between 1993 and 1998 and I would have liked to have had a domain back then. (I almost did buy one, except they were too expensive back then.)

giancarlostoro 8y ago
Probably all so they know which direction to point lawyers / government agencies towards when they come knocking about your domain.
- realusername 8y ago
  They could just send an email to abuse@[domain] like anybody else.
  - nabc45 8y ago
    Which you could ignore, but you can't ignore a lawyer.
    - realusername 8y ago
      Maybe it's better that way, lawyers have to do actual manual work on cases that matters instead of sending random legal threats to every company they can find. Random legal threats are not substitutes for law enforcement.
  - chrismorgan 8y ago
    In my experience of recent years, addresses like abuse@, webmaster@, hostmaster@ and postmaster@ normally bounce. It’s a real nuisance when I want to report bugs in web systems, or in email systems where they’re doing enough things badly wrong that they trip (or get close to tripping) spam filters, et cetera.
    - giancarlostoro 8y ago

shironineja 8y ago

First ... they came for ICANN, and I did not speak out.

GenericsMotors 8y ago
A bit melodramatic, don't you think? Corporations will continue to have their details listed, this covers what info can be stored and published about actual persons.

realusername 8y ago

It sounds like a positive policy to me, I don't understand the backlash of the author of this article, personal details have no relation to domain names and I don't see why they should.

arcbyte 8y ago
Something owns a domain, and the details of that something need to be known - personal or not. Easy.
EpicEng 8y ago
Personal details related to a car, right? And real estate? I don't understand your argument.
- ysleepy 8y ago
  So write your name, address and telephone number on the back of your car. Maybe you don't want to, and thats ok.
  - EpicEng 8y ago
    ...I think you're forgetting about that whole registration thing you do each year.

anilakar 8y ago

One month to adapt? They have had two years. Also, I fail to see how this is a problem, considering that quite a few domains nowadays seem to use WhoisGuard or a similar service anyway.

Crosseye_Jack 8y ago
>I fail to see how this is a problem... Some TLD's don't allow proxy registrations. whois privacy being a service extra (sometimes included for free sometimes a paid extra which can expire and expose your data if you miss the email) where other TLD's (.uk springs to mind) already have the ability to withheld the personal details of domain registrants (private individuals have the ability to held their data, company registrations have their data shown) at the registry level and not having to use a 3rd party company.
- martin-adams 8y ago
  Is there a difference between proxy registrations and not making the registrant information public?
  - Crosseye_Jack 8y ago
    Well your still seen as the owner of the domain in the register’s eyes and not a proxy company which may help if you need to transfer the domain away from your registar for any unexpected reason.
  - mschout 8y ago
    I am an engineer working for a registrar and we've been told by at least one TLD that there is no difference. We used to "mask" the registrant email regardless of whether or not the customer had opted-in for proxy registration, and we were told this was not allowed by the TLD operator.
return1 8y ago
> I fail to see how this is a problem, > seem to use WhoisGuard or a similar service anyway So it was always a problem, now it is also illegal

nailer 8y ago

Pity this is flagged. It's hacker relevant, the Register is a well regarded technology site, and I'd rather a plain speaking title with some mildly rude words than some Vox clickbait.

return1 8y ago
i posted it the other day and it got flagged as well. its an important issue to many. some people need to get their heads out of their arses
jwilk 8y ago
> the Register is a well regarded technology site Is it? (Honest question, I have no idea.) Most of the links at https://news.ycombinator.com/from?site=theregister.co.uk https://news.ycombinator.com/from?site=theregister.co.uk are dead for some reason.
- andybak 8y ago
  Yes. I often disagree with it and they are often sensationalist and abrasive but I always enjoy reading it.
  - jholman 8y ago
    Yeah, I think "often disagree and often sensationalist" is a good assessment. For any given Reg article, I won't rule out that maybe the author is a nutter, but they're usually well-informed or interesting or amusing or some combination.
    - nailer 8y ago
      Yeah, I expect they know what they're talking about, and have an opinion which they'll make obvious - which I may not necessarily agree with. Sysadmin folks would know the term 'BofH' which got popularised by The Register.
- return1 8y ago

labster 8y ago

Wow, this is the first time I've seen a [dead] article on the front page. Not sure I understand the front page algorithm. Vouched, of course, as it's definitely newsworthy to hackers to know that the law is potentially going to shut down the whois service.

djsumdog 8y ago
I think the previous version was removed because it used The Register's sensational title. Also, I thought you couldn't submit anything from The Register. Every time I've tried I've gotten an error, and their titles are always sensational anyway.
- Doctor_Fegg 8y ago
  It’s not particularly sensational, it’s just British slang. Very much in the tradition of Private Eye et al. I find it a little disappointing that HN mods believe British slang is a reason to depart from the original-headline-only policy when any amount of SV hype is let through unchallenged, tbh.

Anthony-G 8y ago

Original blog post from Michele Neylon of Blacknight (registrar based in Ireland): https://blacknight.blog/game-over-for-public-whois-article-29-gives-icann-the-advice-it-asked-for.html https://blacknight.blog/game-over-for-public-whois-article-2... As an ex-customer, I've found that Blacknight are generally supportive of Internet freedoms and they do a lot to advocate the adoption of IPv6.

DanBC 8y ago
That's a much better article.

anfilt 8y ago

I really don't see why DNS records should be in the purview of the GDPR. I also think they are not public enough. It can be hard to contact people. Information is outdated, false or just hidden. Usually being able to call the person responsible for a domain and say hey your email server has relaying enabled and pushing out a lot spam gets them to fix it. I can understand person not wanting to put their address, but I say phone, email, name and points contact should be necessary. It is a public system after all. Spam can be a problem as well, but these records do serve a purpose. They also are important for ownership of a domain if a dispute was to arise.

Tharkun 8y ago
You've obviously never been threatened, harassed or stalked simply for running a blog with real contact information in the whois records.
- egg_head12 8y ago
  Stalking really? Threats and harassment. Just tell them to gtfo! I would be more worried about swatting with the address component. I can see that for corporations/businesses.
  - gambiting 8y ago
    >> Just tell them to gtfo! I see you've also never been threatened before. It doesn't work.
  - krageon 8y ago
    Telling them to GTFO doesn't really comfort you if you receive fake (hopefully) bomb packages at home or whatever else (frequent mailings of poop for example). The local police generally also doesn't do very much for you (unless it's really bad, like a real immediate threat to your life from an actual pipe bomb). Even if they do, that doesn't mean it will stop anytime soon. In the meantime it's slowly eating away at your sanity: Is this real mail? Can I go outside for groceries without getting stabbed? These are not fun concerns to have to have. Seeing as it's 100% avoidable and unnecessary to have this information available in this way, I don't think it is a bad thing to remove it.

therealmarv 8y ago

I hope ICANN will get a huge penalty for continuing their whois service after end of May.

interdrift 8y ago

Correct move :). ave Evropa

tschellenbach 8y ago

It would be fun to compile a list of EU government websites that don't comply with GDPR.

icedchai 8y ago

Absurd. Users "consented" when they signed up for a domain. Don't like it? Use a whois service to anonymize.

CydeWeys 8y ago
GDPR requires "freely given, specific, informed and unambiguous" consent. It also says that "Silence, pre-ticked boxes or inactivity, however, is presumed inadequate to confer consent." This kind of explicit consent was not given in the case of most domain registrations, and anyway, GDPR allows for withdrawal of consent, so even if you did grant it in the past, you can withdraw it now.
- icedchai 8y ago
  That's why I put "consent" in quotes. (I think GDPR is a waste of resources, even though I have profited from some implementation activities.)
  - CydeWeys 8y ago
    They didn't consent though, not by the standards of the GDPR, so their personal information cannot be published in WHOIS. So, no, paying extra for an anonymizing WHOIS service is not necessary; this will be the default level of service from a registrar. I'm not sure what your intended argument is; can you rewrite in plain English and without scare quotes?
    - icedchai 8y ago
      Yes, I understand that. Consent was originally in quotes because it wasn't actually consent in GDPR terms. However, I will continue to argue that it was consent in a more general sense: They bought a domain, therefore their info is published in whois. It is necessary to provide the service. If they do not want their info published, they could have taken action to prevent it (whois service, alternate name, alternate email.)
      - 8y ago

tehabe 8y ago

It is always the same, a law is enacted and it includes a window of a few years to give everybody time to implement it. A few weeks before the law goes into effect, everybody is screaming that they need more time. I guess we don't leave university after all.

deleted 8y ago

[deleted]

megaman22 8y ago

Yikes, GDPR is a well-intentioned shitshow. It's trying to graft new requirements onto something that was never designed to support them. And it looks like it is going about as well as trying to slap multiplayer on top of a hoary old single-player game engine.

DanBC 8y ago
These aren't new requirements. They've been part of EU law since 1995.

martin-adams 8y ago

I wonder if Companies House in the UK is also affected. I tried to get them to remove personal information a while back as it wasn't a requirement for new businesses. They said no. I supplied that information long before Companies House made it easily available. I will try again after the GDPR is place.

sethgecko 8y ago
> it wasn't a requirement for new businesses Companies house asks for director name/address/dob when you register a company
- martin-adams 8y ago
  Correct, but new directors can opt to keep that information private and out of the public domain. So what I meant was, having the information public is no longer a requirement.

y7 8y ago

Interesting, I just queried the WHOIS records of a .im domain which used to display my personal information, but now it displays: This information has been redacted to comply with European Union General Data Protection Regulations (GDPR). Please contact us at info@nic.im if you have any further queries. Domain Managers Name: Redacted Address Redacted Domain Owners / Registrant Name: Redacted Address Redacted [...]

djsumdog 8y ago
huh .. I just checked my own .im domain and got the same response. Interesting. That was fast.
- CydeWeys 8y ago
  It's actually slow when you think about it another way. GDPR has been looming for years, and it's now only a month and a week prior to enforcement date that things have started changing.
Symbiote 8y ago
Particularly interesting, as the Isle of Man isn't in the European Union.
- furyg3 8y ago
  If the TLD authority on the Island is offering a good/service to an EU person, even if they are outside the EU, they will need to protect that data in the way that the GDPR specifies. So they can either decide to not publicize that info for EU persons (based on address?), or not publish any natural person's data. But let's say they didn't want to. No consequences, right? Not quite... the .im authority allows EU businesses (domain registrars) to register domain names (for example, I can go to transip.nl and register a .im domain name). TransIP has to comply with the GDPR. If TransIP collects my information to pass it outside the EU, they need to be certain that the organization they provide it to is also GDPR compliant. If they don't have those assurances, they can't give them the info. So not being GDPR compliant is not great for the .im revenue stream. Finally, I have no clue about the legal regime on the Isle of Man. If I were them, I would probably try to sync up a lot of my laws with the UK (and thus EU, for now) laws. So my guess is they have some sort of data protection act, and that it's in line with the GDPR (or will be very soon).

romanovcode 8y ago

Don't see a problem. I don't get why do I need to provide my full name, address and a phone number to register domain. What's even worse is that someone can just look it up.

chiefalchemist 8y ago

> From the article - "Critics point out that ICANN has largely brought these problems on itself, having ignored official warnings from the Article 29 Working Party for nearly a decade, and only taking the GDPR requirements seriously six months ago when there has been a clear two-year lead time." > From: https://www.icann.org/resources/pages/what-2012-02-25-en https://www.icann.org/resources/pages/what-2012-02-25-en "ICANN was formed in 1998. It is a not-for-profit partnership of people from all over the world dedicated to keeping the Internet secure, stable and interoperable. It promotes competition and develops policy on the Internet’s unique identifiers. ICANN doesn’t control content on the Internet. It cannot stop spam and it doesn’t deal with access to the Internet. But through its coordination role of the Internet’s naming system, it does have an important impact on the expansion and evolution of the Internet." --- Editorial: The disconnect is frightening.

otakucode 8y ago

So block Europe from all DNS. Simple.

cosinetau 8y ago
That would be a very aggressive response from ICANN, though it might work from an arms race perspective. I don't think cold war era thinking alone is the solution to these issues; there are likely other, less destructive, paths.
- CydeWeys 8y ago
  A lot of people involved in ICANN are European themselves anyway, and many believe in user privacy on a personal level. And it's not that ICANN doesn't, either, it's just a big ship to turn around on a dime. So yeah, there's no way any kind of response like this will be happening.
- otakucode 8y ago
  It would be a pretty aggressive response, and certainly not one anyone would be pleased with at all. Not consumers, not ICANN, and not anyone really. But... the European Union is being extremely aggressive here to start with. They are seeking to dictate global policy and threatening gigantic sanctions if not responded to on a very short timetable. One would have to presume that they would prefer the database being blocked from access to its continued accessibility, and that might be the only possible option in order to avoid those sanctions. I certainly do hope there are other less destructive solutions, but it's not like GDPR or the problems it has with WHOIS just sprung up suddenly. The EU knew this was going to be challenging and would require discussion, but the discussion has apparently reached the point where they have decided going on the offensive is their best option. It's not like ICANN could just flip a switch and change everything to be in compliance but they're refusing to. What the EU wants is a huge change, and you can't just stamp your feet and expect it to magically happen. But that's the unreasonable path they've chosen.
merinowool 8y ago
What if EU citizen visits from the US? Still needs to be blocked...

jiveturkey 8y ago

Completely unacceptable response from ICANN. They don't need a special exemption. Turn the service off until you can fix it. And they had plenty of time!

kevin_b_er 8y ago

This will end WHOIS I think. It should provide interesting to see the side effects of abuse/spam where they can't be identified as easily anymore. On the flip side, mass IP demand letters will become much harder when you can't target someone as easily.

ttul 8y ago

A little-known fact: WHOIS is extensively relied on by spam fighters like Spamhaus to do their good work, which collectively saves all of us from an enormous tidal wave of spam that would otherwise consume vast resources. Internally, the anti-spam and more generally the anti-abuse community builds a huge and mostly real-time cross-referenced database of information about domains and IP addresses. This database would be impossible to build without WHOIS. For example, if one domain shares the same contact email address as another, then the domains are related somehow. Doing some data mining on a variety of signals which are apparent in the WHOIS records can help to cluster related domains to help anti-abuse researchers find newly problematic domains by following the trail through WHOIS. I'm not sure how researchers will do their job effectively without WHOIS. This development is truly a disaster for anti-abuse.

gojomo 8y ago
Never mind the WHOIS, those other anti-spam databases may be GDPR-violating, as well. Did that spammer affirmatively opt-in to having his origin addresses/domains/IPs and response phone-numbers/etc tracked in your anti-spam data? Probably not!
- anonymouz 8y ago
  That doesn't seem to be personal information.
  - theptip 8y ago
    I believe IP addresses are considered "PII" under GDPR, since they can be used to identify an individual. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/
    - anonymouz 8y ago
      "PII" only seems to exist in US law, GDPR has "personal data". I am far from an expert an GDPR, but it doesn't seem to be so clear cut. Even if IP addresses in this context are considered personal data, there may be "legitimate interest" in processing them for blacklists, e.g. https://gdpr-info.eu/recitals/no-49/ https://gdpr-info.eu/recitals/no-49/ could apply. I am confident a workable solution for spam blacklists will be found. I have the impression that a lot of the fear around GDPR is unfounded if one uses a reasonable and restrictive approach of processing and storing personal data.

DoctorOetker 8y ago

nobody mentions namecoin?

sbov 8y ago

I didn't mind my info being in whois records. Until websites started hosting that info. And Google started crawling those websites. There's a big difference between your wife's ex guessing your domain and running whois on it to find her home address, vs just being able to Google her name to find it.

noja 8y ago
Isn't every single one of those websites violating that TOS of the registry, that the data may be queried, but not stored? (queue the "there's no difference" brigade - yes there is)
- sbov 8y ago
  I'm guessing they didn't actually store it, because it got cleaned up shortly after I deregistered the domain.

TekMol 8y ago

If whois is not public, how do I even know if I own my domain? What if the company that I register my domain with just registers it for themselfes and when I have built a million dollar business on it, they sell it to somebody else?

jstarfish 8y ago
The .tk domain is notorious for this.
ysleepy 8y ago
You get a token issued at registration to check with ICANN? It is not that hard a problem.

gwbas1c 8y ago

I get so much SPAM from WHOIS, email, phone, and texts. My hosting service wants to charge me to anonymize it. Twisting ICANN's arm to hide this information is desperately needed.

textmode 8y ago

Why did ICANN require "thick" whois data from registrars? Ms. Jelinek's letter suggests that collecting this user data , possibly for the benefit of various "stakeholders", was outside the scope of ICANN's charter. Why was it a requirement for ICANN-approved registrars to collect and share this user data? What was the rationale?

mschout 8y ago
I believe the main reason for this (along with the requirement that registrars "escrow" contact info for all of their domains with an approved third party such as Iron Mountain) is so that the domain ownership information can be recovered in the case of a registrar failure. E.g.: registrar closes unexpectedly, or registrar suffers some catastrophe and loses the contact info.