8 ms·

European regulators reject latest proposal by ICANN over its Whois data service

82 points by yulaow 8y ago

cesis 8y ago
I love the fact that "whois privacy protection" has become a free service now thanks to GDPR.
- throwbacktictac 8y ago
  Nothing is truly free. You're paying for it in one way or another.
  - toyg 8y ago
    But you are not paying the same amount of profit, likely.
  - IshKebab 8y ago
    That's not how it works. Supply and demand is a bit more complicated. To simplify though, services and goods aren't priced purely according to what they cost to produce. You're thinking "the cost of production is the same, but a source of secondary profit is gone, so they have to raise the price of domains to compensate". But actually the price also depends on what people are willing to pay. And that hasn't changed.
  - marticode 8y ago
    In this case the cost of the service is close to zero, so it's virtually free. It was similar to phone operator charging for caller ID, an easy way to make a quick buck by flipping a bit somewhere.
  - detaro 8y ago
    Could you please explain how in the specific example discussed here?
cJ0th 8y ago
As a German this rather doesn't make any sense to me. ICANN is not allowed to offer the whois service, but I have to publish my full address on my website according to German law. How can this be?
- namibj 8y ago
  ICANN is relevant for email-only.
- catalin_dev 8y ago
  If you're offering a service, then yes, you have to do that.
  - cJ0th 8y ago
    Last time I checked, I found out that you're providing a commercial service if you put a button for paypal donations on your website. I don't know whether this is how things are today but it lead me to believe that it is not so simple to decide whether or not you do need an Impressum.
- pjc50 8y ago
  https://www.rockit-internet.de/en/what-is-an-impressum/ https://www.rockit-internet.de/en/what-is-an-impressum/ ? Ah, the complicated boundary between "commercial" and "personal" ..
- tscs37 8y ago
  Not all EU countries require that or have different rules around it (in germany only business-like websites require the imprint)
- foepys 8y ago
  You only need to put an email address on your personal websites. If you choose to do business (which includes showing ads), you will need your full contact information on there.
  - 8y ago
mirimir 8y ago
> It should have been obvious that the legislation would also impact the Whois service, which requires anyone buying a domain name to provide their names, address and personal contact details – and then publishes it all on the internet for anyone to see. Even using "whois privacy protection", I've always anonymized my contact information. I've used a working email address, of course, so I can manage the domain. But there's no reason to provide a physical address or telephone number. I tend to use hostels and business hotels. Also, while this will protect those registering or obtaining domains going forward, historical data is widely available.
- jlgaddis 8y ago
  > But there's no reason to provide a physical address or telephone number. I tend to use hostels and business hotels. Except for that ICANN rule that if your information is incorrect, your domain name can go bye-bye at any time.
  - mirimir 8y ago
    True. But I've never had that happen. And that's why I've used valid addresses and numbers. You mainly need to pass validity checks. And for critical domains, you can just hire trusted third parties to manage them. There are law firms that specialize in stuff like that.
    - imron 8y ago
      > But I've never had that happen. Well, I guess that means it will never happen in the future either then.
- dingo_bat 8y ago
  > I've always anonymized my contact information. So you've lied on the form. While this may have worked for you, it obviously cannot be the standard way. The law cannot be made on the assumption that users can just lie.
  - 8y ago
blattimwind 8y ago
Rightly so.
ggm 8y ago
I work in a registry which has whois obligations over number resources and I find this very troubling. I'm not going to say there is no right to privacy here, but I suspect states inside the EU will be seeking high privileged rights to information not in whois, come what may. So, this disempowers people seeking redress from harm as outsiders but doesnt stop state actors or lawyers or police. Apart from my dayjob I have whois objects in DNS registries so i know there is the other side of the coin. I see the bad stuff from choosing not to hide my ID.
- lucb1e 8y ago
  I'm fine with governments being the only ones who can view domain registration details. Heck, I'd be fine with nobody having access, forget the whole whois system: if the government needs to find who runs freemovies.example.net, they can ask (or subpoena) whoever was paid to register it (i.e. the registrar). As far as I understand, the WHOIS system was made in the 80s when it was useful to be able to look and ring someone up. Literally everything was in beta on the arpanet, and direct communication makes debugging a lot easier. But it's 2018, and I do not want 4chan to be able to look up my home address in that system. That creates more mayhem than it's worth by far. Thinking about what use I ever had from the whois system, I guess it's only abuse email addresses for IP addresses. And I hear that people make use of the registration date of domains to calculate spam scores. Neither of those require the registrant's private information to be in there.
  - ggm 8y ago
    Problem is, some domain and number holders have no incorperated body: they hold the resource as a private individual. Hard to formulate consistent data law around WHOIS when its both people, and corporate entities. I was in the WHOIS as was from SRI-NIC. I kept GM85 in my current nic-hdl for resources as a memory of the days gone by: they even published a paper copy of the listing.. the phone book of the internet, how .. quaint. Yes, the protocol is designed for days gone by. but the GDPR laws apply to RDAP, even though it has HTTPS and could in principle use Oauth or similar to constrain whats shown to open access.
drtillberg 8y ago
It seems to me that ICANN came up with a plausible interpretation and the pushback from the regulator should be a wake-up call to those who naively claimed GDPR was reasonable and no big deal. I think it makes a lot of sense for a domain registrar to keep basic information in the long-term, about who registered what. I find it odd that this has become a point of contention.
- detaro 8y ago
  Then require registrars to do so legally. They probably already are in many cases, due to long-running storage requirements for business documents (e.g. they probably keep "we billed Mr. X for example.com on $date, and he paid using the credit card on file" for many years). Less clear why ICANN needs to store that data too, I think it's right that they should have to properly justify that. ICANN has made up rules however they liked forever and ignored warnings about privacy for over a decade, and about GDPR specifically for years, so I have to admit I have little compassion for their self-created problem here.
- Tijdreiziger 8y ago
  Sure, but why should that information be public?
- galadran 8y ago
  Did you read the letter [1] that was linked in the article? It is much less hyperbolic than the article makes out. Paraphrased: Yes, of course you can keep registration data for your own legitimate usage. Contact information for the lifetime of the domain is fine. Storing it for 2 years after expiry is not necessarily problematic, but you need to document why you legitimately need it. You can't make private contact information public without consent. However, you can disclose it to 3rd parties who make a legitimate request, but you should record the request. [1] https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf
  - drtillberg 8y ago
    It also sets up peculiar legal fictions, i.e., it is ok to keep contact info for 'legal' persons, but not 'natural' persons and if the 'legal' contact info hints indirectly about a 'natural' person, that's a violation, unless, I'm sure a series of other conditions and legal fictions are satisfied. The 8 pages are dense with impenetrable legalese, and the message essentially is that ICANN is not allowed under GDPR to fulfill its mission of publishing the identities of website owners to the public. That is not a reasonable position, from a US perspective. Why is only a government inquirer allowed to know such things automatically, why must my request as a member of the public be logged for ICANN to fulfill it? Is that actually beneficial to 'privacy' or a derivative GDPR minefield? GDPR is a negative development for openness, tranparancy and interconnectivity.
lucb1e 8y ago
The article speaks about "the critical Whois service". Can anyone tell me what it's critical for? I can think of two reasons: - abuse contact info - registration date (The latter is used in spam score calculations, I've heard.) Neither of those are the registrant's private information. I don't understand why we're pushing to have private data in a public directory in the first place. (I never understood this, but being young, I first registered a domain around 2008, long after it was common to ring Joe from USAF up because their FTP was down.) The registrar has to store it for billing anyway, so if a domain is used for something illegal, the police can get at the info anyway...
- realusername 8y ago
  Exactly my thoughts, if Whois can die in the process, it won't be missed by anybody. It's been useless at its purpose since the early 2000's at least. There's no point in keeping it, GDPR or not... I can't even think of a non-spam application these days.
  - andy_ppp 8y ago
    Sometimes I want to email the domain owner to see if they are interested in selling their domain. I don’t see this as spam personally because the emails are always bespoke and “hand written” making a specific case. What would you advise be done in this situation instead?
    - fwn 8y ago
      If the domain owner doesn't provide an email on the website reached through the respective domain itself it's probably a signal that they don't want to be approached. So ideally, in case they don't provide an email, one would not do that.
      - hahla 8y ago
        I have purchased a number of websites from individuals who have had a private Whois or no means of contact listed on their website. It requires a significant amount of sleuthing but the point is these people all sold their sites anyway. You may not ever be actively looking to sell but it’s short sighted to not provide a means of contact for an asset that has value and can be sold.
j16sdiz 8y ago
My inner self is kind of in the 'watch the world burn' mode. Given ICANN is a US based company, I believe they can terminate the contract with all European registries for unable to fullfill the terms in contract.

82 points by yulaow 8y ago

cesis 8y ago

I love the fact that "whois privacy protection" has become a free service now thanks to GDPR.

throwbacktictac 8y ago
Nothing is truly free. You're paying for it in one way or another.
- toyg 8y ago
  But you are not paying the same amount of profit, likely.
- IshKebab 8y ago
  That's not how it works. Supply and demand is a bit more complicated. To simplify though, services and goods aren't priced purely according to what they cost to produce. You're thinking "the cost of production is the same, but a source of secondary profit is gone, so they have to raise the price of domains to compensate". But actually the price also depends on what people are willing to pay. And that hasn't changed.
- marticode 8y ago
  In this case the cost of the service is close to zero, so it's virtually free. It was similar to phone operator charging for caller ID, an easy way to make a quick buck by flipping a bit somewhere.
- detaro 8y ago
  Could you please explain how in the specific example discussed here?

cJ0th 8y ago

As a German this rather doesn't make any sense to me. ICANN is not allowed to offer the whois service, but I have to publish my full address on my website according to German law. How can this be?

namibj 8y ago
ICANN is relevant for email-only.
catalin_dev 8y ago
If you're offering a service, then yes, you have to do that.
- cJ0th 8y ago
  Last time I checked, I found out that you're providing a commercial service if you put a button for paypal donations on your website. I don't know whether this is how things are today but it lead me to believe that it is not so simple to decide whether or not you do need an Impressum.
pjc50 8y ago
https://www.rockit-internet.de/en/what-is-an-impressum/ https://www.rockit-internet.de/en/what-is-an-impressum/ ? Ah, the complicated boundary between "commercial" and "personal" ..
tscs37 8y ago
Not all EU countries require that or have different rules around it (in germany only business-like websites require the imprint)
foepys 8y ago
You only need to put an email address on your personal websites. If you choose to do business (which includes showing ads), you will need your full contact information on there.
- 8y ago

mirimir 8y ago

> It should have been obvious that the legislation would also impact the Whois service, which requires anyone buying a domain name to provide their names, address and personal contact details – and then publishes it all on the internet for anyone to see. Even using "whois privacy protection", I've always anonymized my contact information. I've used a working email address, of course, so I can manage the domain. But there's no reason to provide a physical address or telephone number. I tend to use hostels and business hotels. Also, while this will protect those registering or obtaining domains going forward, historical data is widely available.

jlgaddis 8y ago
> But there's no reason to provide a physical address or telephone number. I tend to use hostels and business hotels. Except for that ICANN rule that if your information is incorrect, your domain name can go bye-bye at any time.
- mirimir 8y ago
  True. But I've never had that happen. And that's why I've used valid addresses and numbers. You mainly need to pass validity checks. And for critical domains, you can just hire trusted third parties to manage them. There are law firms that specialize in stuff like that.
  - imron 8y ago
    > But I've never had that happen. Well, I guess that means it will never happen in the future either then.
dingo_bat 8y ago
> I've always anonymized my contact information. So you've lied on the form. While this may have worked for you, it obviously cannot be the standard way. The law cannot be made on the assumption that users can just lie.
- 8y ago

blattimwind 8y ago

Rightly so.

ggm 8y ago

I work in a registry which has whois obligations over number resources and I find this very troubling. I'm not going to say there is no right to privacy here, but I suspect states inside the EU will be seeking high privileged rights to information not in whois, come what may. So, this disempowers people seeking redress from harm as outsiders but doesnt stop state actors or lawyers or police. Apart from my dayjob I have whois objects in DNS registries so i know there is the other side of the coin. I see the bad stuff from choosing not to hide my ID.

lucb1e 8y ago
I'm fine with governments being the only ones who can view domain registration details. Heck, I'd be fine with nobody having access, forget the whole whois system: if the government needs to find who runs freemovies.example.net, they can ask (or subpoena) whoever was paid to register it (i.e. the registrar). As far as I understand, the WHOIS system was made in the 80s when it was useful to be able to look and ring someone up. Literally everything was in beta on the arpanet, and direct communication makes debugging a lot easier. But it's 2018, and I do not want 4chan to be able to look up my home address in that system. That creates more mayhem than it's worth by far. Thinking about what use I ever had from the whois system, I guess it's only abuse email addresses for IP addresses. And I hear that people make use of the registration date of domains to calculate spam scores. Neither of those require the registrant's private information to be in there.
- ggm 8y ago
  Problem is, some domain and number holders have no incorperated body: they hold the resource as a private individual. Hard to formulate consistent data law around WHOIS when its both people, and corporate entities. I was in the WHOIS as was from SRI-NIC. I kept GM85 in my current nic-hdl for resources as a memory of the days gone by: they even published a paper copy of the listing.. the phone book of the internet, how .. quaint. Yes, the protocol is designed for days gone by. but the GDPR laws apply to RDAP, even though it has HTTPS and could in principle use Oauth or similar to constrain whats shown to open access.

drtillberg 8y ago

It seems to me that ICANN came up with a plausible interpretation and the pushback from the regulator should be a wake-up call to those who naively claimed GDPR was reasonable and no big deal. I think it makes a lot of sense for a domain registrar to keep basic information in the long-term, about who registered what. I find it odd that this has become a point of contention.

detaro 8y ago
Then require registrars to do so legally. They probably already are in many cases, due to long-running storage requirements for business documents (e.g. they probably keep "we billed Mr. X for example.com on $date, and he paid using the credit card on file" for many years). Less clear why ICANN needs to store that data too, I think it's right that they should have to properly justify that. ICANN has made up rules however they liked forever and ignored warnings about privacy for over a decade, and about GDPR specifically for years, so I have to admit I have little compassion for their self-created problem here.
Tijdreiziger 8y ago
Sure, but why should that information be public?
galadran 8y ago
Did you read the letter [1] that was linked in the article? It is much less hyperbolic than the article makes out. Paraphrased: Yes, of course you can keep registration data for your own legitimate usage. Contact information for the lifetime of the domain is fine. Storing it for 2 years after expiry is not necessarily problematic, but you need to document why you legitimately need it. You can't make private contact information public without consent. However, you can disclose it to 3rd parties who make a legitimate request, but you should record the request. [1] https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf https://regmedia.co.uk/2018/07/05/edpb-icann-whois.pdf
- drtillberg 8y ago
  It also sets up peculiar legal fictions, i.e., it is ok to keep contact info for 'legal' persons, but not 'natural' persons and if the 'legal' contact info hints indirectly about a 'natural' person, that's a violation, unless, I'm sure a series of other conditions and legal fictions are satisfied. The 8 pages are dense with impenetrable legalese, and the message essentially is that ICANN is not allowed under GDPR to fulfill its mission of publishing the identities of website owners to the public. That is not a reasonable position, from a US perspective. Why is only a government inquirer allowed to know such things automatically, why must my request as a member of the public be logged for ICANN to fulfill it? Is that actually beneficial to 'privacy' or a derivative GDPR minefield? GDPR is a negative development for openness, tranparancy and interconnectivity.

lucb1e 8y ago

The article speaks about "the critical Whois service". Can anyone tell me what it's critical for? I can think of two reasons: - abuse contact info - registration date (The latter is used in spam score calculations, I've heard.) Neither of those are the registrant's private information. I don't understand why we're pushing to have private data in a public directory in the first place. (I never understood this, but being young, I first registered a domain around 2008, long after it was common to ring Joe from USAF up because their FTP was down.) The registrar has to store it for billing anyway, so if a domain is used for something illegal, the police can get at the info anyway...

realusername 8y ago
Exactly my thoughts, if Whois can die in the process, it won't be missed by anybody. It's been useless at its purpose since the early 2000's at least. There's no point in keeping it, GDPR or not... I can't even think of a non-spam application these days.
- andy_ppp 8y ago
  Sometimes I want to email the domain owner to see if they are interested in selling their domain. I don’t see this as spam personally because the emails are always bespoke and “hand written” making a specific case. What would you advise be done in this situation instead?
  - fwn 8y ago
    If the domain owner doesn't provide an email on the website reached through the respective domain itself it's probably a signal that they don't want to be approached. So ideally, in case they don't provide an email, one would not do that.
    - hahla 8y ago
      I have purchased a number of websites from individuals who have had a private Whois or no means of contact listed on their website. It requires a significant amount of sleuthing but the point is these people all sold their sites anyway. You may not ever be actively looking to sell but it’s short sighted to not provide a means of contact for an asset that has value and can be sold.

j16sdiz 8y ago

My inner self is kind of in the 'watch the world burn' mode. Given ICANN is a US based company, I believe they can terminate the contract with all European registries for unable to fullfill the terms in contract.