[nc-whois] Summary: Comments on Accuracy.

[Thomas Roessler <roessler-mobile@does-not-exist.net>]

Here's a - not really - brief summary (in chronological order, with
some exceptions) of comments sent to comments-whois which concern
reasoned remarks on the accuracy topic. I hope this is useful both
as a tool for our future discussions, and possibly as direct input
into our report.  Note that, since we have received many and
sometimes quite extensive comments, I may easily have misunderstood
or missed some points.  So, please correct me where I'm wrong.

Regards,
-- 
Thomas Roessler	(mobile)	<roessler-mobile@does-not-exist.net>







http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00003.html

John Berryhill points out that the TF's interim report does not
define a standard for inaccurate contact data.  As an example, he
points to a UDRP case in which the complainant claims that a
telephone number provided in the WHOIS is "inaccurate" because it is
not listed for the respondent.  He also points out that the
requirement for an "accurate" telephone number implies the
requirement for the domain name holder to have a telephone number.

Also, Dr. Berryhill raises the concern that "bad contact data"
complaints can be raised systematically and in an abusive manner, in
order to harass domain name holders.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00005.html

John Berryhill points out that the current practice (and the task
force's interim report) does not address the - common! - use of role
accounts (like "Hostmaster Role Account") for WHOIS contact data.

In fact, the current RAA language requires that WHOIS contact data
(as opposed to registrant data) contains the contact's "name."


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00008.html

This comment, received from Jefferson Nunn (CIO, Internet Solutions
Group) elaborates on a number of privacy objections against any
requirement that /valid/ telephone numbers of individuals be
published in the WHOIS service.

(It is questionable whether this concern is indeed in the scope of
considerations on data accuracy.)


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00012.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/doc00000.doc

This document contains personal comments from Michael D. Palage on a
number of topics raised by the task force's interim report.  In this
message, only those concerning the WHOIS data accuracy portions of
the report are summarized or quoted.

(1) Graduated sanctions and the possible application of automated
filters when domain name registrations are placed.  The comments
hold that "imposing graduated fines and mandating business practices
(filters) contradicts ICANN's role as a technical coordination
body".  Further, the comments point out that these "recommendations
are not supported by any data to demonstrate the technical nor
commercial viability of these automated mechanisms on small, medium
and large-scale registrars. In fact these recommendations would
appear to contradict established case law that has held filters
place an unreasonable burden on registrars. See Worldsport Networks
Limited v. Artinternet S.A. and Cedric Loison. "

(2) Possible problems to honest domain name holders caused by a
rigid enforcement of the present challenge-and-cancellation
procedure for correcting inaccurate WHOIS data.  It is suggested
that, instead of completely deleting the domain name from the
registration system, the domain name is only removed from the zone
file.

(3) The inclusion of thick registries with the accuracy
recommendations made in the task force's interim report.  These
comments are too extensive to be summarized in this document.

(4) Mr. Palage describes a possible abuse scenario of a policy
which would mandate the deletion of all domain names associated with
a specific set of bad contact data (I.A.4.d of the interim report).
The problem occurs when registrant or contact information for a
domain name has been wrongly replaced by contact information about
an existing entity which is not related to this specific domain
name, but may occur in the context of other registrations.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00014.html

This comment from Srikanth Narra was forwarded to the comments site
indirectly.  The comment specifically provides a third world
perspective on WHOIS accuracy, and points out that with registrants
from developing countries, the only contact information which can be
given in an accurate manner is often the postal address.  However,
postal service to the relevant regions may be extremely slow and
unreliable, which makes verification of a postal address within 15
days impossible.  


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00016.html

These comments from the International Trademark Association support
the interim report's suggestions on WHOIS data accuracy.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00018.html

This comment was submitted by Jeff Williams.  He writes: "Further
our [INEGroup] members decidedly believe that only an admin. E-Mail
and phone number contact that is of that Admin.'s. choice that are
working phone Number and E-Mail address."


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00020.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/doc00001.doc

This comment includes, as "recommendation 2", proposed language for
a Names Council resolution on WHOIS accuracy issues.  The resolution
suggests the creation of a standardized "Whois Accuracy Inquiry
Notice" which would be translated in as many languages as possible.
After receiving a notification of potentially false or inaccurate
whois data, registrars would be required to send this notice to
registrants, "in the language(s) of the registration agreement,
along with links to translations of the WAIN in other languages". As
a change to current policy, a domain name would be put on hold
indefinitely after a period of 30 days.  (Current policy: Deletion
after 15 days.) The registrar would not be allowed to either renew
the domain name or remove it from hold status until the registrant
has provided documented proof (supposedly on the accuracy of present
or corrected WHOIS information; this is not clear).  Additionally,
third parties submitting WHOIS accuracy complaints would be required
(1) to provide contact information so the registrant can possibly
initiate legal action in cases of bad faith complaints, and to (2)
state that the submission "is not intended to interfere with the
lawful operations of the domain name registrant or registrar".

The proposed resolution then goes on to recommend a number of
possible ways for implementing this suggestion.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00025.html

This comment was submitted by Bhavin Turakhia on behalf of Directi,
an accredited registrar.  Several possible difficulties which may
make it hard to reach a registrant within a 15 day time line in case
of an accuracy complaint are listed.  A 45 day time line is suggested
as being far more appropriate.  Also, it is suggested to place
problematic domain names on registrar-hold instead of deleting them.
Mr. Turakhia also points to the comments submitted by Mr. Palage
(see the summary of msg000012.html above).


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00027.html

This comment, submitted by Tim Ruiz on behalf of GoDaddy Software,
mostly focuses on the accuracy issue.  Mr. Ruiz objects against the
recommendation that registrars should use automated mechanisms to
screen out incorrect contact data, on the basis that the task force
report does not consider "the cost of these tools, and the problems
associated with the accuracy of these tools themselves." Also,
according to this comment, "pinging email domains, automating the
dialing of phone numbers, etc. have another set of technical
obstacles and costs that make them impractical to implement and
unreliable." Mr. Ruiz objects against the current 15 day time frame,
and suggests that a 45 day period may be more reasonable.  He also
requests that the terms "willful" and "blatant" (which are
currently used in the task force's language on inaccurate whois
data) be clearly defined, in order to avoid subjective judgments
from entering into these considerations.  "Such a vaguely defined
policy will be difficult, if not impossible, to enforce," Mr. Ruiz
writes.  Finally, Mr. Ruiz articulates his belief that the "3
strikes policy" suggested by the task force is unnecessary: "The
current RAA simply needs to be enforced, and ICANN has recently been
working toward that goal."

In addition to these comments, Mr. Ruiz states his support for the
comments submitted by Mr. Palage (see the summary of msg000012.html
above).


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00029.html

This comment, submitted by Laurence Djolakian on behalf of the
Intellectual Property Constituency, expresses that constituency's
support for the interim report's recommendations on the accuracy of
WHOIS data.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00030.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/doc00003.doc

This extremely comprehensive 12-page comment was submitted by Ross
Wm. Rader on behalf of Tucows.  This summary attempts to identify
the most important key points; I strongly recommend reading the full
comments.

As far as the accuracy section of the interim report is concerned,
Tucows suggests these questions for the task force's consideration: 

>What has the [task force] done to measure ICANN's recent
>enforcement activities as it relates to Whois and how much does
>this effect the problems that you are trying to deal with in the
>area of accuracy? Would it be safer to say that mandatory periodic
>re-validation of Whois data has been identified as one potential
>technique for improving data quality? Or, has the Task Force
>investigate the other options fully and discounted them? If so,
>what options were investigated and why were they discounted?

Additionally, the submission includes comments on the individual
recommendations contained in the interim report.  As far as the
enforcement of current policies (I.A) is concerned, most of these
comments concern specific questions around the impact of a possible
implementation of the interim report's requirements.  Concerning
A4b, a distinction between "willful submission" and "blatant
disregard" is highlighted. Concerning A4c, the submission asks for
specific standards concerning documentary proof of accuracy of data
provided.

There are also concerns on the graduated sanctions system suggested
in the task force's report: It is asked whether the interim report's
recommendations intent to shift the primary responsibility for WHOIS
data accuracy from the registrant to the registrar. Concerning
B4C1b (collecting the fine from funds deposited by registrars with
registries), the feasibility and desirability of this particular
approach is questioned.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00038.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/doc00006.doc

As a follow-up to the previous submission by Tucows, this comment
contains specific comments on the questions asked in the interim
report.  Tucows argues that (1) it is not clear that the mechanisms
proposed in the interim report actually lead to the desired
results, and that (2) it is not demonstrated that "failures in the
enforcement mechanism require a more structured approach complete
with fines and sanctions".  On the basis of these observations, it
is concluded that an implementation of the structure described in
the interim report would be "unreasonable." The task force is urged
"to recommend that the community determine first if enforcement of
the current contractual provisions will lead to an improvement of
Whois data accuracy. "

In response to the task force's specific questions, the comment
takes issue with a number of the recommendations: With respect to
the inclusion of thick registry operators with the proposed
recommendations, Tucows points out that thick registries are
custodians of data provided by registrars, and do not have
contractual relationships with the registrants themselves. An
argument is made that recommendations 1-3 (improvements to the
complaint mechanism) will not help to increase data quality "in the
majority of records", based on the large number of registrations,
and an estimate that the number of complaints actually received will
be several orders of magnitude smaller.  Tucows is not aware of any
"technically competent means" to implement recommendation 4a
(screening for obviously bad data), and doubts that - even if such a
technology exists - it would actually achieve the requirements
behind the recommendation.  Additionally, Tucows notes that such
screening may drive bad-faith registrants further underground,
making enforcement even more difficult; further discussion of this
is recommended.  The comment also cautions that recommendations 4b-d
should not be pursued unless "appropriate and affordable technology
has been demonstrated to solve the problems described."  A policy
that registries, registrars and/or resellers periodically remind
registrants of their accuracy obligations is considered an
appropriate recommendation; however, specific implementations
should not be recommended.  Tucows recommends that the task forces
explores the idea "that Registrants should be required to verify the
accuracy of the data that they have provided prior to allowing the
Registrant to undertake significant modifications or actions with
their domain name."  "Further, ICANN should support the development
of cross-registry/registrar contact object management standard."

The comments objects against the proposed sanctions program, and
argues that only "a proactive program geared toward ensuring that
Registrants uphold their obligations can ultimately achieve the
goals of the Task Force."

The comments further express support for recommendation C1 of the
accuracy chapter.  Tucows has not evaluated the cost of implementing
this, but expects it to be moderate.

C2 and C3 are rejected as being technically and economically
unpractical, and would "require the implementation of manual and
automated systems that have not yet been developed. ... We strongly
believe that implementation of these recommendations would have a
significant impact on the capability of our organization to compete
and prosper."


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00032.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/doc00004.doc
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/doc00005.doc

This extensive comment was posted by Karen Elizaga on behalf of the
gTLD registries constituency.  doc00004.doc contains a useful
summary of these comments, followed by a number of individual
contributions.  Within the scope of the present document, I can only
try to identify a number of key points; reading the full comments is
highly recommended.

Concerning the accuracy complaint process, it is suggested that
complainants should themselves provide accurate contact information,
i.e., there should be no possibility for anonymous complaints.  It
is suggested that a quick loss of names should be limited to the
"worst" cases, and that small mistakes (like a one-digit mistake in
a zip code) should correspond to longer response periods. Registries
should not be subject to the proposed 3-strike policy since they
don't have a direct contractual relationship with the registrant.
A4a is characterized as being virtually impossible due to the cost
and complications (including a slow-down of SRS transactions) which
would be caused by an implementation of the automated filtering
suggestions.  A comment contributed by Chuck Gomes generally
questions whether accuracy of WHOIS information can be enforced on a
global basis.

Concerning A4e, the abuse scenario introduced by Mr. Palage is
mentioned. The practical applicability of the proposed sanctions
program to intermediaries is questioned, due to the lack of a direct
contractual relationship with ICANN.  More details are provided in
mark-up of the text, contained in doc00005.doc.  In this mark-up,
the gTLD registry constituency in particular takes up a couple of
points mentioned in other comments: The risk of bad faith complaints
(see Berryhill, above); possibly replacing cancellation of
registrations in case of inaccurate data by registry hold.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00033.html

This comment, submitted by Rebecca J. Richards on behalf of TRUSTe,
emphasizes the importance of accurate and available WHOIS
information for TRUSTe, and expresses support for the accuracy
recommendations in the task force's interim report.  This comment
literally copies some parts of the IPC comment.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00031.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00034.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00035.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00037.html

These comments, submitted Rick D. McMurtry on behalf of Turner
Broadcasting System, by Bob Scherer on behalf of Time Inc., by Erin
Hennessy on behalf of Warner Music Group, and by Lee Paul on behalf
of Time4 Media, Inc., emphasize the importance of access to WHOIS
data and their accuracy for various parts of the AOL Time Warner
group (occasionally using precisely same wording throughout several
of the submissions, occasionally providing specific anecdotal
evidence of problems encountered in the past), and generally support
the accuracy recommendations contained in the interim report.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00036.html

This comment was submitted by Troy Dow on behalf of the Motion
Picture Association of America.  The statement expresses the MPAA's
support for the accuracy recommendations contained in the interim
report.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00039.html

This comment was submitted by Mark Bohannon on behalf of the
Software & Information Industry Association.  The comment emphasizes
the importance of legitimate uses of WHOIS data in language which
closely follows (or even copies) the IPC and TRUSTe comments, and
expresses support for the task force's accuracy recommendations.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00040.html

This comment was submitted by Rick Wesson (Alice's Registry). Mr.
Wesson hopes to publish statistically significant research in the
future in order to prove the hypothesis that the vast majority of
domain registrations don't have accuracy issues.  Concerning the
graduated sanctions program, it is noted that "at the time the
document was authored, there existed no methodology to test the
assertion that graduated sanctions could improve the accuracy of the
data published in the whois."


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00041.html

This comment from Marc Schneiders specifically addresses the interim
report's accuracy recommendations, which are called consumer and
registrar unfriendly.  Issues pointed out include: The potential for
abuse of the complaint process in order to harass registrars or
registrants; the possible use of "role account" type names (like xyz
domain manager) for the registrant information, coupled with
accurate addressing information; challenges with actually
implementing accuracy requirements on a worldwide basis.  The 15 day
correction period is identified as too short, on the basis that
registrants may, for instance, be on vacation for such a time
period.


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00042.html
http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/doc00007.doc

This comment was submitted by Michael Erdle on behalf of the
Internet Committee of the Intellectual Property Institute of Canada.
The comment is not an official position of the IPIC.

The five-page attachment to the message contains elaborate comments
on the accuracy recommendations in the interim report, and answers
to the specific questions asked by the task force.  Within the scope
of this document, I'll try to identify a number of key points;
reading the full comments is strongly recommended.

Conceptually, the comment splits data accuracy into two distinct
sets of concerns: A need to improve overall data quality, and a need
for corrective measures in specific cases of inaccurate data.  

Concerning the measures suggested to improve overall data quality
(like using existing technical measures for screening registrant
information), the comment calls for a careful evaluation of the
"limitations, efficacy and appropriate scope of use" of these tools,
before any implementation of the recommendations.  It is warned
that, due to the danger that automated tools may inevitably contain
errors themselves, and that errors may happen outside the scope of
responsibility of the registrant, no domain name should
automatically be canceled exclusively based on automatic screening.
The comment observes that the terms "obviously incorrect" and
"blatantly false" are not defined in the report, "and arguably
cannot be defined with any precision." Similarly, the question is
raised who should make the judgment whether incorrect information
has been "deliberately" submitted by the registrant.  

Periodic e-mail reminders are identified as a good idea "to attempt
to prevent inaccuracies, however, if a registrar is notified of
false information, it will have to take active steps to contact the
registrant by whatever means possible to verify the information."

The comment warns that, given a significant number of domain name
registrations with outdated WHOIS data, the measures suggested in
the interim report may create a potential for abuse against bona
fide registrations.

Concerning the graduated sanctions program, the comment asks who
would be responsible for actually identifying patterns of
non-compliance.  Provided that ICANN would document complaints,
identify patterns, and take action, the recommendations "appear to
be of use," if combined with appropriate safeguards.

Concerning the steps suggested in C (items for possible
re-negotiation of the RAA), only step 1 is found to be beneficial
(re-validation of WHOIS data upon renewal).


http://www.dnso.org/dnso/dnsocomments/comments-whois/Arc01/msg00043.html

This comment contains an additional note from Bhavin Turakhia,
pointing out that changes to telephone numbering schemes (like one
currently taking place in Bombay) may lead to inaccurate data on a
large scale without bad faith on the registrants' side, leaving
postal mail as the most reliable mechanism for contacting
registrants.  In the Bombay example, however, Mr. Turakhia notes
that no back and forth communication through postal mail would be
possible within 15 days.