Home / Blogs

WHOIS Review and Beyond 3.7.8

We have posted our support of the WHOIS Policy Review Team Report with two important comments. First, on page 79 of the report it is confirmed that the RAA is unenforceable on WHOIS inaccuracy (we wrote about this while at the last ICANN meeting) because the language of RAA 3.7.8 has no enforcement provision. It is now time for ICANN to confirm this problem officially. ICANN, governments, and private researchers have poured resources into addressing the inaccuracy problem but the issue is ultimately unfixable under the existing contract. This issue cannot be understated; 3.7.8 is the crossroads of public participation. At the moment enforceability is completely at the discretion of the sponsoring Registrar, outside of ICANN even. The failure of 3.7.8 precludes the goal of ensuring accountability, transparency and the interests of global Internet users so cherished in the Affirmation of Commitments as it robs the community of meaningful grievance process.

However, the real problem with the contract is even more insidious. One only needs to view the ICANN Compliance “workflow” to see a kind of Sisyphean pattern. There is no “enforcement” end to the loop; the only terminating points in the “ICANN Compliance Program for Registries and Registrars” are dismissal or closure of the complaint. Issuing of breach notices is not part of the process and contracted parties are only mentioned in passing. The process, as it is, only provides a potentially endless cycle of a complainant submitting “additional information.” If this flowchart is a true representation of the duties of Compliance, it exists only to shuffle paper.

We end with two major problems. First the contract is unenforceable on WHOIS accuracy which is the foundation of trust between ICANN and the Internet user. Second, there is apparently no capacity within the organization to enforce the other portions of the contract: contractual and organizational failure. We will be publishing nine case studies which demonstrate the systemic breakdown of Internet enforcement next week. RAA 378 is the crossroads of public participation: the ability of actual Internet consumers to bring grievances to the operators of the Domain Name System. Is this an Internet we all participate in or an Internet which is imposed on us? As long as 378 is a phantom we are living with an imposed Internet.

By Garth Bruen, Internet Fraud Analyst and Policy Developer

Filed Under

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet


So long as registrars can implement "Privacy Charles Christopher  –  Jun 19, 2012 3:30 PM

So long as registrars can implement “Privacy Whois” everything else is moot.

There first must be a requirement that the whois actually be “correct”, versus hidden, before an enforcement policy becomes a meaningful tool.

I think you missed something... Garth Bruen  –  Jun 19, 2012 3:45 PM

There IS no enforcement, privacy or otherwise. The case studies will show it, and this is by design. See the Compliance workflow. Our case studies were not geared at proxy/privacy.

And if there were enforcement a registrar Charles Christopher  –  Jun 19, 2012 4:10 PM

And if there were enforcement a registrar could have their TOS include a privacy whois requirement. Thus the enforcement policy would have no meaning. I'm not trying to argue against you Garth, I'm just trying to point out that allowing privacy whois makes the entire issue worse that presented. In fact even the REQUIRED ICANN Whois Escrow allows Privacy Whois to be escrowed, thus making the entire process meaningless. In my view the start is to require whois to be correct in the first place, privacy whois not being allowed.

I hear you! Garth Bruen  –  Jun 19, 2012 4:18 PM

Just want to make sure the point of this particular work is about what happens after inaccuracies are reported. There is an internal failure of procedure and function. The case studies are even less about WHOIS and more on ICANN not working.

>after inaccuracies are reported.Sure. But it's worth Charles Christopher  –  Jun 19, 2012 4:48 PM

>after inaccuracies are reported.

Sure. But it’s worth noting such a report can’t even be made for privacy (meaningless, but procedurally acceptable) whois.

So, and this is a thought experiment here, if you succeed in your approach and you raise my (a registrar) overhead / cost of operations, then I start returning privacy whois for EVERY DOMAIN. You solve nothing. And as we both know, my thought experiment will play out for some “bad” registrars.

>The case studies are even less about WHOIS and more on ICANN not working.

Which is my point as well, regarding whois.

There will never be a perfect solution, but there is enormous room for improvement.

I recall a very long time ago when accurate whois was believed to be LAW .... And the idea of returning privacy whois was believed to be something that would get your creds terminated .... Then someone tried it, there was no ICANN response, and the entire “false whois” problem just got worse. I think history has some value here.

Of course... Garth Bruen  –  Jun 19, 2012 5:21 PM

That's why the WIRT is moving to a clear definition of privacy/proxy as well as certification/accreditation for these services with requirements for responsiveness and conditions for reveals. Registrars make money from PP and mandating such a service drives customers to competition. This also increases responsibility, liability and work for the sponsor. It's too much of an assumption that they in fact would want to do that.

Update! Garth Bruen  –  Jun 19, 2012 6:50 PM

Apparently in response to the discussion ICANN has removed the Compliance flowchart. It just says “coming soon”

I have preserved a copy here: http://www.knujon.com/compliance-flowchart.gif

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.



IPv4 Markets

Sponsored byIPXO

Domain Management

Sponsored byMarkMonitor

Domain Names

Sponsored byVerisign


Sponsored byVerisign

Threat Intelligence

Sponsored byWhoisXML API