ICANN has consistently said its intention in complying with the European Union’s General Data Protection Regulation (GDPR) is to comply while at the same time maintaining access to the WHOIS domain name registration database “to greatest extent possible.” On February 28, ICANN published its proposed model. Strangely, while ICANN acknowledges that some of the critical purposes for WHOIS include consumer protection, investigation of cybercrimes, mitigation of DNS abuse, and intellectual property protection, the model ICANN proposes provides no meaningful pathway to use WHOIS in those ways. Under ICANN’s model, use of WHOIS “to the greatest extent possible,” really means use will become practically impossible. They are, in effect, proposing to end the internet’s operational transparency.

Today, while users can easily access a full set of publicly available WHOIS data for purposes like fighting fraud or enforcing IP rights, the published ICANN model removes most information from public view and turns WHOIS into a tiered or “gated” access system, where the vast majority of key data will only be available for users who are accredited—at some undefined point in the future—to pass through the gate. Although a gated access model could be crafted to provide full access to approved users, ICANN did not appear to incorporate any of the approaches found in the community proposed models relating to gated access. Although ICANN originally said that it was not set on picking one of its own models and would be open to taking elements from the community models, it appears not to have done so and to have instead charted its own course.

Denial of appropriate WHOIS access will force law enforcement, cybersecurity professionals, and intellectual property rights holders to pursue John Doe lawsuits, simply to identify registrants through subpoenas and court orders. That will not only greatly amplify overall online enforcement costs for all concerned, but also waste judicial resources, and increase overhead costs and liability for contracted parties. Contracted parties who are presented clear-cut evidence of illegality yet deny demands to reveal registrants can quickly lead to potential contributory liability. Worse yet, denial of bulk WHOIS access would immediately grind to a halt vitally important cybersecurity efforts, upon which all major social media platforms, online marketplaces, and other websites depend to identify and remove malicious content, false narratives which threaten democracy, and the sale of counterfeit or pirated goods, among other harmful activity. Overbroad removal of WHOIS service could also potentially fuel further political or even legal challenges to the IANA transition and even embolden possible new legislation aimed at intermediary accountability and liability for contracted parties and ICANN itself.

It is not too late for ICANN to make the necessary changes to its proposed interim model to address these concerns. Work on an accreditation system work must start right away, and in the absence of such a system by May 25, some form of self-certification must be recognized as an acceptable interim approach. Ultimately, ICANN’s model needs to ensure that accredited users, like fully licensed drivers, get to drive easily and quickly across all WHOIS roads instead of being presented with unexpected roadblocks. There is also the risk that registries and registrars might ignore ICANN, go their own route on compliance and decide that the easiest solution is to make WHOIS “go dark.” We are already starting to witness this with bulk access, where certain registrars are already unilaterally masking data and throttling the service, disrupting critical tools that promote the public interest in a safe, stable, and secure Internet. This could just be the beginning as contracted parties systematically choke off access to this vital database.

Thus, we urge all WHOIS users to immediately:

• Contact ICANN (you can send comments by email to [email protected]) and participate in ongoing community discussions to reiterate these serious concerns, identify these and other critical uses of WHOIS, and explain the dire consequences from shutting off or significantly limiting access (there will be many opportunities to weigh in during the upcoming ICANN 61 meeting in Puerto Rico—the meeting schedule with participation details is available here);
• Contact European DPAs to voice these concerns and ask for guidance regarding the appropriate balance between the privacy interests of domain name registrants and the critical needs of WHOIS users (a list of individual European DPAs and how to contact them is available here); and
• Speak to GAC representatives and other governmental officials outside the ICANN community to raise awareness of these issues and make a call to action for political leaders, policymakers, and regulators to weigh in.

Detailed Concerns about ICANN’s Proposed Model

Under ICANN’s proposed model, those who query the public WHOIS would now only see a very limited subset of data, including the domain name registered, its creation and expiration data, the registrar, and name server. While these data elements are useful, critically important public WHOIS elements such as the registrant’s email address, city, or postal code would no longer be visible to users. Current bulk access also would no longer be supported. Many WHOIS users, including IP owners, anti-abuse teams and others, rely on bulk access and critical data to combat malware, phishing, consumer frauds, infringements and other online abuses. The data serves as a viable means for contactability, for service of process, and, perhaps most importantly, as unique identifiers through which domain name portfolios and other vital evidence of systematic abuse or bad faith can be ascertained.

ICANN proposes that the registrant’s email address would be replaced with either a public anonymized email address or a web form for contacting the registrant. The model also proposes possible publication of the Registry Registrant ID—a globally unique identifier assigned to all registrations made by a single registrant—but details on this are too minimal to fully understand its utility. These replacements for email address would just make it more difficult for WHOIS users to research, enforce and protect the public. Someone trying to contact the registrant using an anonymized email would not know if their email went through and would have no way of using the email address field to correlate infringements, frauds or crimes across different domain names. ICANN’s model also proposes stripping away the registrant’s city and postal code from the publicly accessible WHOIS data elements. City and postal code are vital pieces of information to identify the geographic location of the registrant and are need to identify an appropriate venue when filing a lawsuit.

Moreover, although ICANN says it will continue to require that registrars and registries ensure WHOIS data remains accurate, this requirement is essentially meaningless because the current WHOIS database is filled with large amounts of inaccurate data. In addition, publication of WHOIS data facilitates data accuracy by enabling third parties (parties other than the registrar and registrant) to identify inaccurate data and alert the registrar and/or ICANN, which in turn enables corrective measures to be taken. The more data that is non-public (i.e. behind ICANN’s proposed gate) the harder it will be to ensure data accuracy, as a greater burden falls to registrars to validate and verify data up front. The GDPR does not generally apply to data that is false, inaccurate or fictitious, and such data should be thoroughly screened out. Nonetheless, contracted parties appear to have no plans to change their practices with respect to improving the accuracy of registration data. Participants at a recent GDPR discussion hosted by the IPC and BC, however, heard that data controllers will be held responsible under the GDRP for the accuracy of their data. If registrars do not change their practices, we can expect to see a flood of complaints and challenges relating to inaccurate WHOIS data.

We are also concerned about the scope and timing of ICANN’s plan to figure out an accreditation model. ICANN has not taken ownership of figuring out accreditation but instead has punted the vast majority of the development process onto the Governmental Advisory Committee (GAC). It is not clear whether the GAC will agree to accept this significant responsibility, especially since its role at ICANN is largely advisory in nature. If the GAC refuses this responsibility, what will the backup plan be to develop an accreditation model? This obviously needs to be done quickly and developing any workable accreditation program will not be easy. As a starting point, ICANN proposes that individual GAC members provide a list of law enforcement authorities in their respective jurisdictions, and that such authorities would be given global access to all WHOIS data. It’s hard to imagine that this list could be developed quickly.

ICANN would also need to work with the GAC to identify which other third-party user groups would be eligible to access to the full WHOIS data (such as licensed attorneys representing intellectual property rights holders or cybersecurity professionals). The GAC would also need to assist or advise on developing codes of conduct for these user groups, and we would argue that codes of conduct should also apply to registries and registrars, as well as ICANN itself. Because it is unlikely that such a program would be ready by May 25 (the day GDPR enforcement kicks in), some have suggested the notion of “self-certification” as a temporary solution. Although businesses, IP owners and many other users of WHOIS strongly believe self-certification is a reasonable approach, other ICANN stakeholders have pushed back. European DPAs and global policymakers will need to clarify to ICANN that that self-certification is legal under the GDPR. Certain of the community proposed compliance models noted above also suggested self-certification approaches that should be examined more carefully. In addition, contracted party and IP and business stakeholders have previously discussed a possible hybrid that combines self-certification with some lightweight third-party credentialing as another possible interim approach until the community can devise a full accreditation scheme. Ultimately, any interim solution must ensure that everyone who needs robust WHOIS data has continued access without interruption.

We are also very concerned that bulk WHOIS access, currently provided through the port 43 protocol, may be going away entirely under the proposed compliance model. Bulk access is an essential tool that allows users to access and aggregate data in an automated fashion, then search across large data sets to enforce IP rights, fight against online fraud and abuses and perform important research, among other important purposes. Inexplicably, ICANN does not seem to recognize the vital importance of bulk access or require that its contracted parties continue to provide this service as part of the proposed compliance model. It is quite alarming that some registrars are already inappropriately masking port 43 data elements and throttling or shutting off access to these critical bulk access search services. With respect to the ICANN-proposed model to comply with the GDPR, this means that even for those who overcome every hurdle to become accredited, the WHOIS data they receive after passing through the gate will neither be quick, easy or effectively searchable as it is today. At a minimum, ICANN must clarify that registrars will still be required to provide bulk access to accredited third parties for all WHOIS data, and that third party service providers will be able to provide searchable and historical WHOIS data even if registries and registrars do not provide such services directly.

The proposed territorial and material scope of ICANN’s model raises additional red flags. Although the GDPR comes out of the EU and arguably only applies to registries and registrars with a data processing nexus to the European Economic Area (EEA) (and only to data of natural vs. legal persons), ICANN leaves the door open to every registrar and registry adopting its model and applying it across the board to all domain name registrations. ICANN’s approach invites over-compliance with the GDPR. As a result, each registrar and registry could well be in a race to the bottom to shut off access to WHOIS in order to avoid putting itself at a perceived competitive disadvantage.