Thanks Alan - This is a heated debate in the ICANN community - most either state that they are concerned about liability (largely registrars) or are aghast at the escalating levels of abuse (IP & Security interests). I appreciate your balanced view that considers operational and security issues as well as the good intent of GDPR. - Fred

Can you back up that statement with data? Our abuse desk has actually seen a reduction in abuse complaints. Let's face it, there is a balance to be reached here. The rights to privacy of domain name registrants and the rights of internet users to a more secure infrastructure. For years, one was sacrificed to the other even though many have been vocal about the unsustainability of providing private data to the world. Suggestions or requests for change were rebuffed by those who were served best by the status quo and made (usually) legitimate use of it. On the EPDP the ICANN community is currently working to bringing an ordered process for disclosure to those who have legitimate interests or legally enforceable rights. But as there are many interests to balance that process is taking longer than any of us would like. In the meantime, it may be time to lobby your local governments to implement the best solution for the loss of whois data: mandating the provision of essential data on the website and in the emails served by those domain names. in the EU, the loss of whois data has been much less of an issue due to the requirement to provide this information right on the website in an easy to find place. The domain is only used for email? Good, since the same applies to business emails. Whois was rendered near superfluous years ago. Time for other countries to follow that example.

Volker – Let me address your remarks to M. Malland: Your registrar may have seen a decrease in complaints, because it may not be the specific target of complaints. Based on research by Interisle Consulting Group as cited in their blog and here on CircleID, it appears that specific registrars and TLDs are subject to more abuse than others. However, fewer abuse complaints don't mean that there's less abuse, it may mean that those that suffer abuse and are trying to abate it don't see registrars as part of the solution and are taking other action. Many registrars aren't terribly responsive or helpful taking down abusive domains, nor is registrant contact data returned in an expedient manner in response to legitimate requests for registrant contact data as a result of abusive domains. See for example the results published by MarkMonitor and which we have also confirmed. In fact, statistically, based upon requests on behalf of our clients through June 1, 2019 the majority of registrars did not respond to requests for registrant data (196 responded, 217 did not). And of the total requests, only just over 4% were satisfied with a reveal of underlying contact data for abusive and malicious domain names. Knowing that registrars often aren't part of the solution, organizations that suffer domain name abuse and want to protect Internet users are seeking resolution elsewhere. They've gotten practical, they ask ISPs to remove to offending content as fast as they possibly can to reduce harm and ISPs respond. Responsible actors are taking action in the face of potential danger -- they mitigate the risks posed by fraud, phishing, fake product sites selling dangerous knock-off goods including toxic pharmaceuticals, malware distribution sites as well as child and human exploitation sites, not to mention hundreds of other scams that are often enabled by malicious registrations. However the underlying problem, unmitigated by registrars, the infringing or malicious domain remains registered awaiting a new host and a new scam. How about some more data? Security professionals predicted issues as a result of GDPR implementation by ICANN and the Registrars, were proved right while the FBI has discussed the growth of scams that rely on domain names and the Wall Street Journal found that consumers were easily fooled by websites that also, often rely on domain names to fool consumers:

1. Early in the process the APWG polled security professionals in a survey that predicted less blocking due to ICANN's reaction and registrars action on GDPR.
2. Later IBM X-Force research demonstrated that there was in fact less blocking of malicious domains validating that earlier research by the APWG.
3. The FBI has recently announced that scams targeting businesses and individuals that often rely on malicious domains, Business Email Compromise, are on the rise, showing that there are actual victims -- though most, too embarrassed to come forward, don't report their victimization.
4. The Wall Street Journal and Stanford research and writings show that people are more likely to fall victim to fraud on fake social and fake sites -- almost three times more likely than email or phone scams - fake sites often rely on malicious and abusive domain names to defraud internet users with support scams, fake goods, user-self-compromise schemes.