Subject: GA-DIGEST V1 #1409
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST         Thursday, September 5 2002         Volume 01 : Number 1409

----------------------------------------------------------------------

Date: Wed, 4 Sep 2002 13:58:24 -0400
From: "John Berryhill Ph.D. J.D." <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

From: "Michael D. Palage" <[email-masked]>

> data. I believe that after not responding to a 15 day whois inquiry, the
> domain name should be put on hold (removed from the zone files) but not
> automatically deleted. 

Nail. Head. Bang. 

There is, in fact, at least one registrar that already does this.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 4 Sep 2002 14:46:43 -0400 (EDT)
From: Joe Baptista <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

On Wed, 4 Sep 2002, L. Gallegos wrote:

> On Wednesday 04 September 2002 12:52 pm, Michael D. Palage wrote:
> >
> > I think you raise some interesting points that are important to closely
> > monitor. As originally designed, I believe that this mechanism was to
> > identify records in which the domain name applicants knowingly provided
> > false or inaccurate information. However, I believe ICANN will find out
> > that this mechanism is going to be used by numerous domain name registrants
> > that have not been unable to timely update their records due to poor
> > customer service by some registrars. I myself have been a victim of
> > inordinate delays in trying to update contact information associated with a
> > non-functioning email address, which directly impacted the ability of me to
> > transfer my domain name.

we've had the exact same problem.  we attempt to alter our contact
information and it won't work.  it's very annoying.  i guess i should send
a nasty letter to network solutions.  or maybe chuck the netsol saint can
help us out.

regards
joe baptista

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 4 Sep 2002 15:47:32 -0400
From: "John Berryhill Ph.D. J.D." <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

From: "L. Gallegos" <[email-masked]>

> Verification of
> incorrect data is difficult in any case, but for a registrant to lose a
> domain because of an unduly short time frame and WLS is completely
> unacceptable.  The domain should NOT be removed from the zones in just 15
> days.

Leah,

Mike is talking about taking the domain name out of the relevant zone.  He is
not talking about deleting the domain name registration.  Mike's idea makes
infinitely more sense than deleting the name in 15 days.

Concerning the domain names identified by ICANN, the real hoot here is that
ICANN can't find the telephone number of namezero.com - a registrar which
ICANN itself accredited.

This is ICANN staff's idea of "contact information":
http://www.icann.org/registrars/accreditation-qualified-list.html

Oops, hey, maybe they never did get a telephone number for some of the
registrars they have accredited.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 4 Sep 2002 18:07:42 -0400
From: "L. Gallegos" <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

On Wednesday 04 September 2002 03:47 pm, John Berryhill Ph.D. J.D. wrote:
> Mike is talking about taking the domain name out of the relevant zone.  He
> is not talking about deleting the domain name registration.  Mike's idea
> makes infinitely more sense than deleting the name in 15 days.

Yes, I realize that.  I guess I got over verbose, but my point was that given 
the time frame, even doing that and rendering the domain unrsolvable before 
the registrant can even respond is not good either.  I would say that 
extending the time frame to at least thirty days would provide enough time 
for the registrant to place a phone call or fax after notification.  

I would hate to have my domains not resolve simply because my mail carrier is 
misdelivering mail and taking weeks to get it to me.  FYI, it happens every 
week.  I've also had to change ISPs and have had connectivity issues for the 
past year.  I do use my primary domain for the email contact on my domains 
because of the ISP problems, but if there were a notification problem due to 
glitches in the systems and the domain went dark, I'd have a real problem. 
The whole idea of having the domain is that I can use it for email no matter 
what ISP I am subscribed to. I am willing to bet I'm not alone by a long 
shot.  

I try to keep on top of domain renewals and do pretty well.  However, with WLS 
on the horizon, I would suggest that registrants be VERY concerned.  I 
suspect that you attorneys might just do well with lawsuits coming up over 
it.  In the meantime, we registrants have a lot to lose.

Leah
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 02:13:15 +0200 (CEST)
From: Marc Schneiders <[email-masked]>
Subject: RE: [ga] Legitimate Hi-Jacking

On Wed, 4 Sep 2002, at 12:52 [=GMT-0400], Michael D. Palage wrote:

> I believe the easiest way to prevent the scenario you discussed is to
> provide a longer runway prior to deleting the domain name for inaccurate
> data. I believe that after not responding to a 15 day whois inquiry, the
> domain name should be put on hold (removed from the zone files)

That might be an interesting tool to get your competitor's web and mail
down for a day or so. I can well imagine that companies who have paid the
registration for 5 or 10 years in advance might not deal fast enough (esp.
when they are big and bureaucratic) with emails send to email addresses
like: hostmaster@, dns-admin@. Two weeks is not much. Also addresses in
whois get a lot of spam. I delete most of that on the basis of the
subject. Things like "Warning about your domain name", "Urgent: Your reply
needed within 24 hours" are likely candidates here. Maybe there should be
a secret (i.e. not available in whois)  address on which we receive
messages from our registrar about expiration, whois problems and the like?
That I would find helpfull.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 02:24:39 +0200 (CEST)
From: Marc Schneiders <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

On Wed, 4 Sep 2002, at 11:35 [=GMT-0400], John Berryhill Ph.D. J.D. wrote:

> If you are concerned about the security of any of your domain names,
> keep in mind that every domain name has a 15 day fuse to deletion (and
> you will not likely be informed at day 1, so it is less than that), and
> act accordingly. Email server down this week?  Kiss your domain names
> goodbye.

johnberryhill.com.      7m17s IN MX     10 mail-incoming2.hostsave.com.
johnberryhill.com.      7m17s IN MX     1 mail-incoming.hostsave.com.

You need more mailservers, John. These two are on the same network even.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 4 Sep 2002 21:52:12 -0400
From: "L. Gallegos" <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

On Wednesday 04 September 2002 08:13 pm, Marc Schneiders wrote:

>
> That might be an interesting tool to get your competitor's web and mail
> down for a day or so. I can well imagine that companies who have paid the
> registration for 5 or 10 years in advance might not deal fast enough (esp.
> when they are big and bureaucratic) with emails send to email addresses
> like: hostmaster@, dns-admin@. Two weeks is not much. Also addresses in
> whois get a lot of spam. I delete most of that on the basis of the
> subject. Things like "Warning about your domain name", "Urgent: Your reply
> needed within 24 hours" are likely candidates here. Maybe there should be
> a secret (i.e. not available in whois)  address on which we receive
> messages from our registrar about expiration, whois problems and the like?
> That I would find helpfull.

That would be helpful.  My spam filters would kill the mail with subject lines 
you describe.  I'd never see it.  For mail from my registrar I do look at the 
"from" since all administrative mail is easily detected that - at least from 
my registrar.  However, I have found some spoofed "from" entries showing that 
registrar as well, so am becoming more jaded by the day.  Having a "private" 
or "secret" address for administrative business with the registrar is a good 
idea, IMO.

Leah

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 05 Sep 2002 01:22:56 -0700
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

John and all assembly members,

John Berryhill Ph.D. J.D. wrote:

> Since ICANN now seems to be moving seriously to enforce the 15-day
> confirmation period for suspect whois data, it might be a good idea to let
> the cat out of the bag, so that every one will have a fair chance.

  Good point here John, and one that I tried to make in part
yesterday regarding one of ICANN's own staff members,
Kent Crispit with the At-large.org registration. See:
 http://www.fitug.de/atlarge-discuss/0209/msg00086.html
Seems that Even and ICANN staff member cannot or will not
keep the Domain name he has in his name Accurate.

>
>
> Consider - the Wait-List Service has been approved, and you will soon be able
> to obtain a deleted name with certainty.  The trick, of course, is knowing
> which domain names are going to be deleted, since you have to pay your money
> up front.  The Redemption Grace Period adds further uncertainty to the
> process.  However....
>
> Now, we have the way to shake the tree and make the domain names fall out.
> Look for domain names which have contact email address of defunct ISP, such
> as home.com, and others which caused mass-strandings of domain name
> registrants with no way to fix their whois data if email confirmation is
> required.  Alternatively, try to find out or guess when the domain name
> registrant of the name you want is away from their phone, email, or address
> for two weeks.   Don't worry, if you guess wrong, you can try again.
>
> The whois confirmation policy provides a 15 day "bed check" for the registrar
> to confirm these details are correct, and this is MUCH shorter than the
> proposed redemption grace period.  So...
>
> STEP 1 - Take out a WLS or Snapback on the name you want.
> STEP 2- Complain loud and hard that the whois data for the domain name is
> bad.
> STEP 3 - Wait 15 days.
> STEP 4 - Enjoy your new domain name.
>
> What's nice about this method, as opposed to other hi-jacking methods, is
> that if you score the name and your target wakes up and figures out what
> happened, then he/she has virtually no recourse.
>
> If you are concerned about the security of any of your domain names, keep in
> mind that every domain name has a 15 day fuse to deletion (and you will not
> likely be informed at day 1, so it is less than that), and act accordingly.
> Email server down this week?  Kiss your domain names goodbye.

  Exactly right!  ANd this is in part what several complained and
discussed on the two TR TF Phone Conferences..

  Therefore as a result of this horrible WLS consideration, I am
finding it very difficult if not impossible how the ICANN BOD and
staff can state with a straight face and expect any participant,
informed registrant, or any other Stakeholder how they are
improving or even providing at all for "Stability" as is in their
Mandate of the White Paper and MoU... ????

  It also therefore seems to me with your nice brief outline
above John that if even one of ICANN's staff people,
one Kent Crispin, can do so with his own domain, how
now they can than make a policy decision and expect
equitable enforcement or even oversight of Whois data
accuracy and WLS...

>
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,

- --
Jeffrey A. Williams
Spokesman for INEGroup - (Over 127k members/stakeholders strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 972-244-3801
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 12:24:10 +0200
From: Patrick <[email-masked]>
Subject: Re: [ga] Legitimate Hi-Jacking

On Wed, Sep 04, 2002 at 12:52:30PM -0400, Michael D. Palage took time to write:
> I believe the easiest way to prevent the scenario you discussed is to
> provide a longer runway prior to deleting the domain name for inaccurate
> data. I believe that after not responding to a 15 day whois inquiry, the

Easier: provide the WLS only for domain names deleted after
*expiration*, not domain names deleted for other reasons.
(even easier: no WLS)

2 lines of code at Registry.

> domain name should be put on hold (removed from the zone files) but not
> automatically deleted. I believe that this distinction is important during

There is already a REGISTRY-HOLD window of 5 days (IIRC) in certain
cases. This is still not enough, whatever delay there is.

Patrick Mevzek.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 12:28:42 +0200
From: Thomas Roessler <[email-masked]>
Subject: [ga] WHOIS: Bulk access users?

A quick and maybe stupid question: Does anyone know what use is  
actually being made of the bulk access provisions?  What are the 
services offered on the basis of these data?

Any pointers would be welcome.

Regards,
- -- 
Thomas Roessler                        http://log.does-not-exist.org/
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 12:53:41 +0200
From: Thomas Roessler <[email-masked]>
Subject: [ga] FYI: ERC's report on GA

It looks like the Evolution and Reform Committee is moving into the 
right direction as far as the GA is concerned.  See
  
 http://www.icann.org/committees/evol-reform/second-implementation-report-02sep02.htm#2C1b

for details.

- -- 
Thomas Roessler                        http://log.does-not-exist.org/
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 12:24:22 +0100
From: "Jon Lawrence" <[email-masked]>
Subject: RE: [ga] WHOIS: Bulk access users?

Thomas

In my experience the customers for bulk access come in three groups:

(1) Law firms or firms providing IP related services to law firms - using
the data to provide search services to their clients for brand protection
purposes and so forth.
(2) competing registrars - for market analysis as well as to build mailing
lists (to be fair some don't use it for mailing lists - the ones who do
are well known).
(3) major resellers - ditto.

rgds
jon

>-- Original Message --
>Date: Thu, 5 Sep 2002 12:28:42 +0200
>From: Thomas Roessler <[email-masked]>
>To: [email-masked]
>Subject: [ga] WHOIS: Bulk access users?
>
>
>A quick and maybe stupid question: Does anyone know what use is  
>actually being made of the bulk access provisions?  What are the 
>services offered on the basis of these data?
>
>Any pointers would be welcome.
>
>Regards,
>-- 
>Thomas Roessler                        http://log.does-not-exist.org/
>--
>This message was passed to you via the [email-masked] list.
>Send mail to [email-masked] to unsubscribe
>("unsubscribe ga" in the body of the message).
>Archives at http://www.dnso.org/archives.html
>

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 08:49:49 -0400
From: "Cade,Marilyn S - LGA" <[email-masked]>
Subject: RE: [ga] WHOIS: Bulk access users?

I believe there is probably one additional service not mentioned: cross-registry WHOIS services. 

- -----Original Message-----
From: Jon Lawrence [mailto:[email-masked]]
Sent: Thursday, September 05, 2002 7:24 AM
To: Thomas Roessler; [email-masked]
Subject: RE: [ga] WHOIS: Bulk access users?

Thomas

In my experience the customers for bulk access come in three groups:

(1) Law firms or firms providing IP related services to law firms - using
the data to provide search services to their clients for brand protection
purposes and so forth.
(2) competing registrars - for market analysis as well as to build mailing
lists (to be fair some don't use it for mailing lists - the ones who do
are well known).
(3) major resellers - ditto.

rgds
jon

>-- Original Message --
>Date: Thu, 5 Sep 2002 12:28:42 +0200
>From: Thomas Roessler <[email-masked]>
>To: [email-masked]
>Subject: [ga] WHOIS: Bulk access users?
>
>
>A quick and maybe stupid question: Does anyone know what use is  
>actually being made of the bulk access provisions?  What are the 
>services offered on the basis of these data?
>
>Any pointers would be welcome.
>
>Regards,
>-- 
>Thomas Roessler                        http://log.does-not-exist.org/
>--
>This message was passed to you via the [email-masked] list.
>Send mail to [email-masked] to unsubscribe
>("unsubscribe ga" in the body of the message).
>Archives at http://www.dnso.org/archives.html
>

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 11:57:36 -0400
From: "Ross Wm. Rader" <[email-masked]>
Subject: RE: [ga] WHOIS: Bulk access users?

Cross-registry whois is more of a theoretical application at this point.
The data is not fresh enough, nor cheap enough to facilitate this in a
meaningful manner. Referral whois between live systems has been the more
appropriate solution in practice.

                       -rwr

"There's a fine line between fishing and standing on the shore like an
idiot."
- - Steven Wright

Got Blog? http://www.byte.org/blog

Please review our ICANN Reform Proposal:
http://www.byte.org/heathrow

 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf 
> Of Cade,Marilyn S - LGA
> Sent: Thursday, September 05, 2002 8:50 AM
> To: [email-masked]; Thomas Roessler; [email-masked]
> Subject: RE: [ga] WHOIS: Bulk access users?
> 
> 
> I believe there is probably one additional service not 
> mentioned: cross-registry WHOIS services. 
> 
> 
> -----Original Message-----
> From: Jon Lawrence [mailto:[email-masked]]
> Sent: Thursday, September 05, 2002 7:24 AM
> To: Thomas Roessler; [email-masked]
> Subject: RE: [ga] WHOIS: Bulk access users?
> 
> 
> Thomas
> 
> In my experience the customers for bulk access come in three groups:
> 
> (1) Law firms or firms providing IP related services to law 
> firms - using the data to provide search services to their 
> clients for brand protection purposes and so forth.
> (2) competing registrars - for market analysis as well as to 
> build mailing lists (to be fair some don't use it for mailing 
> lists - the ones who do are well known).
> (3) major resellers - ditto.
> 
> rgds
> jon
> 
> 
> >-- Original Message --
> >Date: Thu, 5 Sep 2002 12:28:42 +0200
> >From: Thomas Roessler <[email-masked]>
> >To: [email-masked]
> >Subject: [ga] WHOIS: Bulk access users?
> >
> >
> >A quick and maybe stupid question: Does anyone know what use is
> >actually being made of the bulk access provisions?  What are the 
> >services offered on the basis of these data?
> >
> >Any pointers would be welcome.
> >
> >Regards,
> >-- 
> >Thomas Roessler                        http://log.does-not-exist.org/
> >--
> >This message was passed to you via the [email-masked] list.
> >Send mail to [email-masked] to unsubscribe
> >("unsubscribe ga" in the body of the message).
> >Archives at http://www.dnso.org/archives.html
> >
> 
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 18:01:10 +0200
From: Thomas Roessler <[email-masked]>
Subject: [ga] Bulk acces...

Here are some thoughts on what bulk access provisions should look like. 
  Note that this is not necessarily where the WHOIS task force is 
heading, it's rather my own thinking.

First, what is bulk access all about?  It's ICANN mandating that 
everyone should be able to obtain, for a certain fee, a significant 
portion of registrars' customer information. The provisions then contain 
a number of limitations concerning some marketing uses and abusing 
registrars' and registries' systems. Finally, there's an opt-out 
provision concerning marketing use of bulk data. However, you can't opt 
out of other kinds of bulk access.

This kind of access is used by various groups for various purposes - it 
seems like some of SnapNames' research is based on this kind of 
research; we have overt marketing uses, and we have search services and 
whatever else for intellectual property holders and "real" law 
enforcement.  Looking at these uses, one question should immediately pop 
up: Why the hell is it ICANN's business to protect marketers' access to 
registrars' data, and to even impose an upper limit on the price the 
registrar may take? Once you are at that question, you have to 
generalize: Why does ICANN mandate public for-a-fee access to 
registrars' data? How does this deserve coordination?

Thinking along these lines, one quickly arrives with a very different 
model for bulk access, which is much more close to what's in the thick 
registries' agreements with ICANN: Mandate _full_ bulk access for a very 
limited list of applications, and even impose limitations on the price 
registrars may charge for their data, as far as these services are 
concerned. Do not include _any_ opt-out provisions or anything similar 
for these specific purposes. Leave everything else to the registrars 
themselves, to applicable privacy regulations, and to the market.

Of course, the applications for which bulk access should continue to be 
available would have to fulfill some very strict conditions: Any results 
derived from registrars' bulk data would have to be available to 
registrars on a non-discriminatory basis.  In particular, bulk data 
would not be available to competing registrars. Even more importantly, 
there would have to be a clear public interest in the application in 
question. Finally, registrants privacy would have to be respected by the 
applications to the degree possible.

Right now, I see at most two applications which would actually warrant 
ICANN-mandated bulk access provisions.  1. Research. Key criteria should 
be that results are published, and that no identifiable information 
about individual registrants is contained in the results, unless the 
information came from public sources or (and?) the registrants gave 
their explicit consent to the publication.  2. Query-based services. It 
seems that there is some law enforcement and intellectual property owner 
interest in this kind of service.  The interesting question is of course 
to what extend such products are equivalent to full database access, and 
how they can best be tuned to respect registrants' privacy.  (No, I 
don't like that part, but I don't see a way around it.)

Everything else should in my view be considered outside ICANN's scope.

Comments? Objections? Flames?

Regards,
- -- 
Thomas Roessler (mobile) <[email-masked]>
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 13:20:18 -0400
From: "Cade,Marilyn S - LGA" <[email-masked]>
Subject: RE: [ga] WHOIS: Bulk access users?

ah, ha. of course. makes sense... "aged" data... etc. etc.

- -----Original Message-----
From: Ross Wm. Rader [mailto:[email-masked]]
Sent: Thursday, September 05, 2002 11:58 AM
To: Cade,Marilyn S - LGA; [email-masked]; 'Thomas Roessler';
[email-masked]
Subject: RE: [ga] WHOIS: Bulk access users?

Cross-registry whois is more of a theoretical application at this point.
The data is not fresh enough, nor cheap enough to facilitate this in a
meaningful manner. Referral whois between live systems has been the more
appropriate solution in practice.

                       -rwr

"There's a fine line between fishing and standing on the shore like an
idiot."
- - Steven Wright

Got Blog? http://www.byte.org/blog

Please review our ICANN Reform Proposal:
http://www.byte.org/heathrow

 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf 
> Of Cade,Marilyn S - LGA
> Sent: Thursday, September 05, 2002 8:50 AM
> To: [email-masked]; Thomas Roessler; [email-masked]
> Subject: RE: [ga] WHOIS: Bulk access users?
> 
> 
> I believe there is probably one additional service not 
> mentioned: cross-registry WHOIS services. 
> 
> 
> -----Original Message-----
> From: Jon Lawrence [mailto:[email-masked]]
> Sent: Thursday, September 05, 2002 7:24 AM
> To: Thomas Roessler; [email-masked]
> Subject: RE: [ga] WHOIS: Bulk access users?
> 
> 
> Thomas
> 
> In my experience the customers for bulk access come in three groups:
> 
> (1) Law firms or firms providing IP related services to law 
> firms - using the data to provide search services to their 
> clients for brand protection purposes and so forth.
> (2) competing registrars - for market analysis as well as to 
> build mailing lists (to be fair some don't use it for mailing 
> lists - the ones who do are well known).
> (3) major resellers - ditto.
> 
> rgds
> jon
> 
> 
> >-- Original Message --
> >Date: Thu, 5 Sep 2002 12:28:42 +0200
> >From: Thomas Roessler <[email-masked]>
> >To: [email-masked]
> >Subject: [ga] WHOIS: Bulk access users?
> >
> >
> >A quick and maybe stupid question: Does anyone know what use is
> >actually being made of the bulk access provisions?  What are the 
> >services offered on the basis of these data?
> >
> >Any pointers would be welcome.
> >
> >Regards,
> >-- 
> >Thomas Roessler                        http://log.does-not-exist.org/
> >--
> >This message was passed to you via the [email-masked] list.
> >Send mail to [email-masked] to unsubscribe
> >("unsubscribe ga" in the body of the message).
> >Archives at http://www.dnso.org/archives.html
> >
> 
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 10:25:13 -0700 (PDT)
From: Karl Auerbach <[email-masked]>
Subject: Re: [ga] Bulk acces...

On Thu, 5 Sep 2002, Thomas Roessler wrote:

> Here are some thoughts on what bulk access provisions should look like. 

My answer to what it ought to look like is this:

	{ }  (empty set)

The reason is that there should be NO access to whois data whatsoever 
without a demonstrated, and supportable, reason to look at the personally 
identifiable information.

This does not mean that the casual person might not be able to take a 
veiled look now and then at a veiled version of the information.  But 
today's wide open access is at varience with what are becoming widely 
accepted principles of privacy.

Bulk access ought to be eliminated. To my way of thinking, "bulk access"
(except to those doing research) is something that is simply inconsistent
with the reasons that "whois" is claimed to be needed, i.e.  the checking
for identity of those who are accused of transgressing on the rights of
the person making the inquiry.  Whois is not a toy that is justified
because it is "fun".

(Trolling for unused names is *not* a valid reason to violate privacy.  
If one must be a troll then it is a more efficient use of net resources to
do a DNS query itself to see whether a name is in use or not.)

It's not necessary for us to engage in discussions of the needs of law
enforcement or other public safety needs.  As a general principle, privacy
limitations give way to public health and safety in those situations where
time is of the essence or when the data subject is under observation.  
The terms and condititions of this kind of access are generally beyond
ICANN's scope and are, instead, established by law.

Anonymous access ought to be eliminated.  Except as provided by law, no
access should be anonymous.  If anyone looks at your record you should be
able to know who and when they looked.

Anyone making access must identify themselves and make a reasonable
demonstrating that that identity is correct.  E-mail addresses are an
interesting kind of lesser identity that might be of use when allowing
access, more on that below.

When there is *no* demonstration of identity of the person making the
query, such as in classical "whois", then the data returned should be
veiled - for example, full telephone numbers should be replaced by area
codes/country codes (and perhaps exchange codes), and full addresses
should be replaced by postal codes.

So here's my suggestion:

A multi-tier form of access to the registration meta-data (i.e. "whois"):

1. People (e.g. intellectual property attorneys, ISP NOC staff, etc.) may
"pre-qualify" for access by demonstrating and proving their identity and
showing a general need for access and that they are generally responsible.  
These people would receive a "credential" (a password or digitial
certificate or something of that ilk) that they can use to obtain fast,
unhindered access to full records.

2. One who has not pre-qualified can still obtain access to full contents
of records by going through some sort of identification/authentication
sequence. There might be a limitation on the number of queries that may be
made without requalifiying, and the qualification may be limited to some
class of records expressed in the form of some kind of regular expression.

3. E-mail addresses could serve as even a lower form of identification
that permits access, but in this case the response would be via e-mail to
that e-mail address.  Rate limitations would clamp the number of replies
per day to any e-mail address to some reasonable number.

4. In direct query/response mechanisms in which the querier is not
required to provide any identification, i.e. today's whois, then the
returned information ought to be veiled as described previously.

In all of these cases every data subject (i.e. the people named in the 
whois data) would have access to the list of identities of who looked, and 
when.

(The list of names and what those people are looking at is itself a
database of personally identifiable information and is, itself deserving
of some protection.  What those protections are is left to another day.)

Yes, this will be slower than today's system.

Yes, what I suggest will be more expensive than today's non-system.
And if there is a cost to be borne it ought to be borne by those who are 
making the inquiries, not by the data subjects.

		--karl--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 5 Sep 2002 11:31:30 -0700 (PDT)
From: Eric Dierker <[email-masked]>
Subject: Re: [ga] Bulk acces/just oppose it period

I still do not get why an IP lawyer gets a "bulk" access.
That is like a Judge issuing a search warrant to search everyone that lives 
in a community, because a purse was stolen, somewhere near there.

No, bulk access makes no sense at all.

Private or University research should not be given carte blanche into 
medical records or whois data, without an opt in by the patient or 
registrant.

My 19 year old college daughter has a site, and some pervert can find out 
all her personal information, MANO that is sick.
So now I will not let her have a site - Well there the hell went your 
"access, reliability and Security".  

Bulk access is total bullshit, to use an Arizona phrase.  We do not even 
have bulk access to criminal or Department of Motor Vehicle records.

Can you say "Stalker"? Can you say "privacy"?  Even the debate here pisses 
me off, to use a Southern Califronia phrase.

Sincerely,
Eric

> On Thu, 5 Sep 2002, Thomas Roessler wrote:
> 
>> Here are some thoughts on what bulk access provisions should look
>> like. 
> 
> My answer to what it ought to look like is this:
> 
> 	{ }  (empty set)
> 
> The reason is that there should be NO access to whois data whatsoever 
> without a demonstrated, and supportable, reason to look at the
> personally  identifiable information.
> 
> This does not mean that the casual person might not be able to take a 
> veiled look now and then at a veiled version of the information.  But 
> today's wide open access is at varience with what are becoming widely 
> accepted principles of privacy.
> 
> Bulk access ought to be eliminated. To my way of thinking, "bulk
> access" (except to those doing research) is something that is simply
> inconsistent with the reasons that "whois" is claimed to be needed,
> i.e.  the checking for identity of those who are accused of
> transgressing on the rights of the person making the inquiry.  Whois is
> not a toy that is justified because it is "fun".
> 
> (Trolling for unused names is *not* a valid reason to violate privacy. 
>  If one must be a troll then it is a more efficient use of net
> resources to do a DNS query itself to see whether a name is in use or
> not.)
> 
> It's not necessary for us to engage in discussions of the needs of law
> enforcement or other public safety needs.  As a general principle,
> privacy limitations give way to public health and safety in those
> situations where time is of the essence or when the data subject is
> under observation.   The terms and condititions of this kind of access
> are generally beyond ICANN's scope and are, instead, established by
> law.
> 
> Anonymous access ought to be eliminated.  Except as provided by law, no
> access should be anonymous.  If anyone looks at your record you should
> be able to know who and when they looked.
> 
> Anyone making access must identify themselves and make a reasonable
> demonstrating that that identity is correct.  E-mail addresses are an
> interesting kind of lesser identity that might be of use when allowing
> access, more on that below.
> 
> When there is *no* demonstration of identity of the person making the
> query, such as in classical "whois", then the data returned should be
> veiled - for example, full telephone numbers should be replaced by area
> codes/country codes (and perhaps exchange codes), and full addresses
> should be replaced by postal codes.
> 
> So here's my suggestion:
> 
> A multi-tier form of access to the registration meta-data (i.e.
> "whois"):
> 
> 1. People (e.g. intellectual property attorneys, ISP NOC staff, etc.)
> may "pre-qualify" for access by demonstrating and proving their
> identity and showing a general need for access and that they are
> generally responsible.   These people would receive a "credential" (a
> password or digitial
> certificate or something of that ilk) that they can use to obtain fast,
> unhindered access to full records.
> 
> 2. One who has not pre-qualified can still obtain access to full
> contents of records by going through some sort of
> identification/authentication sequence. There might be a limitation on
> the number of queries that may be made without requalifiying, and the
> qualification may be limited to some class of records expressed in the
> form of some kind of regular expression.
> 
> 3. E-mail addresses could serve as even a lower form of identification
> that permits access, but in this case the response would be via e-mail
> to that e-mail address.  Rate limitations would clamp the number of
> replies per day to any e-mail address to some reasonable number.
> 
> 4. In direct query/response mechanisms in which the querier is not
> required to provide any identification, i.e. today's whois, then the
> returned information ought to be veiled as described previously.
> 
> In all of these cases every data subject (i.e. the people named in the 
> whois data) would have access to the list of identities of who looked,
> and  when.
> 
> (The list of names and what those people are looking at is itself a
> database of personally identifiable information and is, itself
> deserving of some protection.  What those protections are is left to
> another day.)
> 
> Yes, this will be slower than today's system.
> 
> Yes, what I suggest will be more expensive than today's non-system. And
> if there is a cost to be borne it ought to be borne by those who are 
> making the inquiries, not by the data subjects.
> 
> 		--karl--
> 
> 
> 
> 
> 
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #1409
*************************