Subject: GA-DIGEST V1 #1579
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST          Friday, February 7 2003          Volume 01 : Number 1579

----------------------------------------------------------------------

Date: Thu, 06 Feb 2003 20:06:45 -0800
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

Michael and all former DNSO GA members or other interested parties,

  Godaddy's solution is one approach to be sure.  However why should
any registrant or potential registrant have to pay $9.00US more for
what is guaranteed them under US law anyway?   I think folks
sometimes forget the Privacy Act far too often...

Michael D. Palage wrote:

> Richard
>
> As someone that has accurate whois information in connection with my domain
> name. I share your concerns. I was in Berlin earlier this week primarily to
> observer a number of panelists on the issue of data privacy. On Monday I was
> provided the following link regarding the EC viewpoints on the Whois Task
> Force Report. http://www.dnso.org/dnso/notes/ec-comments-whois-22jan03.pdf
>
> I am actually working on a paper on a potential solution to the Whois
> quagmire. I think you might even approve of some points :-)
>
> If you really value privacy GoDaddy's Domain By Proxy offers an excellent
> solution for around $9 dollars, http://www.domainsbyproxy.com/.
>
> Cheers
>
> Mike
>
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of Richard
> > Henderson
> > Sent: Thursday, February 06, 2003 6:12 PM
> > To: [email-masked]; 'George Kirikos'; [email-masked]
> > Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?
> >
> >
> > Excellent points made here by Ross
> >
> > There is no good reason why all whois data should not be *protected* and
> > only made available in extreme circumstances through a request process, if
> > need be backed up by normal legal processes.
> >
> > The WHOIS is yet another "quasi-law" which abuses consumers'
> > privacy rights.
> >
> > I've known what it's like to be stalked. It's an insane
> > situation. You start
> > to dread the phone. You start to dread the doorbell. You have to
> > start doing
> > crazy things like having pre-prepared safe houses.
> >
> > I have felt intimidated, registering domain names, knowing full
> > well that my
> > private life, my address, my phone number, my e-mail is a few clicks from
> > being accessible to people you really want privacy from. Agreed,
> > you can try
> > yahoo/hotmail e-mail details. But fake your name, and you risk losing your
> > domain.
> >
> > I would be happy for my WHOIS details to be *protected* by a registrar or
> > some kind of WHOIS 'escrow', providing the data was guarded by clearly
> > defined procedures.
> >
> > But I believe that the public exposure of personal details is unwarranted,
> > could be extremely dangerous to a minority of people, and is unnecessary
> > because other processes could be implemented instead.
> >
> > Take a person struggling for political freedom and justice in a corrupt
> > regime. Think of some of the dangers that good people could be exposed to.
> >
> > As far as I'm concerned, people do *not* have the right to know
> > my personal
> > details if I buy a domain name. Instead, they need to know that there are
> > legitimate processes and mechanisms through which they can pursue me, if I
> > abuse the use of that domain.
> >
> > Human beings have a right to privacy and a private family life.
> >
> > Richard Henderson
> >
> > ----- Original Message -----
> > From: Ross Wm. Rader <[email-masked]>
> > To: 'George Kirikos' <[email-masked]>; <[email-masked]>
> > Sent: Thursday, February 06, 2003 6:47 PM
> > Subject: RE: [ga] whois.txt, ala robots.txt, as a standard ?
> >
> >
> > > These are interesting thoughts George, but I really believe that we need
> > > to completely disengage from the current system and its implications and
> > > start again from scratch. This proposal and those in development
> > > elsewhere seem to place an emphasis on fixing the mistakes of whois
> > > rather than creating a system that works.
> > >
> > > Let's start the re-engineering with a very basic question.
> > >
> > > Marketers do not need more rights when it comes to my personal data. The
> > > trademark, copyright and patent lobby do not need further rights when it
> > > comes to the protection of their interests. Individuals need a very
> > > basic mechanism that provides marketers and anyone else who wishes to
> > > use this very personal data with a means to ask the individual for
> > > permission to use the data. Once permission has been granted, then the
> > > individual can provide that information to the marketer.
> > >
> > > Full stop.
> > >
> > > Thefore, the basic question is, how do we do this? We can't even begin
> > > to start fixing the problem until we acknowledge that customers have
> > > lsot control of their data. The first step towards a solution lies in
> > > giving that control back.
> > >
> > >
> > >
> > >                        -rwr
> > >
> > >
> > >
> > >
> > > "There's a fine line between fishing and standing on the shore like an
> > > idiot."
> > > - Steven Wright
> > >
> > > Get Blog... http://www.byte.org/
> > >
> > >
> > >
> > >
> > > > -----Original Message-----
> > > > From: [email-masked] [mailto:[email-masked]] On Behalf
> > > > Of George Kirikos
> > > > Sent: Tuesday, February 04, 2003 1:39 PM
> > > > To: [email-masked]
> > > > Subject: [ga] whois.txt, ala robots.txt, as a standard ?
> > > >
> > > >
> > > > Hello,
> > > >
> > > > I was reading through the latest WHOIS task force updates, at:
> > > >
> > > http://does-not-exist.net/final-report/final-report-feb03-030201v0.html
> > >
> > > and a thought came to mind. Just as there is a "robots.txt" standard for
> > > webcrawlers like Google, how about having a whois.txt standard that
> > > folks can optionally use on their websites?
> > >
> > > For those who don't want to put in anything beyond the standard WHOIS
> > > output (i.e. for privacy, or to avoid spam), they can leave a blank
> > > whois.txt on their website or omit it entirely. For those who want
> > > "enhanced" contact details, and want to be easily found, they can
> > > supplement what's already in the standard WHOIS.
> > >
> > > For instance, they can provide additional contacts, WHOIS in different
> > > languages, contact info for various countries, etc. This can also assist
> > > in the goal of WHOIS accuracy -- in case the registrant is unable to be
> > > reached from their existing WHOIS info, the registrar can try the info
> > > in their (by default) http://www.example.com/whois.txt
> > >
> > > Perhaps someone clever can even think of an XML format or something for
> > > this enhanced WHOIS, to allow standard tools (like other WHOIS servers,
> > > such as www.betterwhois.com or www.uwhois.com, etc.) to parse it. Folks
> > > like Alexa, for example, who already supply contact details at:
> > >
> > > http://www.alexa.com/data/details?url=icann.org
> > >
> > > (type a different URL, to see if that domain's contact info is correct)
> > > can crawl the web to get the contacts automatically, instead of mining
> > > the WHOIS, optionally for those who want to be found easily.
> > >
> > > Sincerely,
> > >
> > > George Kirikos
> > > http://www.kirikos.com/
> > > --
> > > This message was passed to you via the [email-masked] list.
> > > Send mail to [email-masked] to unsubscribe
> > > ("unsubscribe ga" in the body of the message).
> > > Archives at http://www.dnso.org/archives.html
> > >
> > >
> > > --
> > > This message was passed to you via the [email-masked] list.
> > > Send mail to [email-masked] to unsubscribe
> > > ("unsubscribe ga" in the body of the message).
> > > Archives at http://www.dnso.org/archives.html
> > >
> > >
> >
> > --
> > This message was passed to you via the [email-masked] list.
> > Send mail to [email-masked] to unsubscribe
> > ("unsubscribe ga" in the body of the message).
> > Archives at http://www.dnso.org/archives.html
> >
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,

- --
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 129k members/stakeholders strong!)
================================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 214-244-3801

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 06 Feb 2003 21:23:58 -0800
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] BULK whois (or: ICANN's Agreements)

Kent and all former DNSO members or other interested parties,

[email-masked] wrote:

> On Thu, Feb 06, 2003 at 11:30:02PM -0000, Richard Henderson wrote:
> >
> >    Does  the  Registrar Accreditation Agreement include sanctions against
> >    Registrars  who  break  other  ICANN  Agreements.  For  example, those
> >    Registrars  who broke Registry-Registrar Agreements in the .info names
> >    release...  they  are  still  accredited...  if  the  industry  simply
> >    operates   on  a  basis  of  Registrars  regulating  themselves,  what
> >    protection  is  there  for consumers from bad registrars who put their
> >    own   self-interest  and  profit  before  ICANN's  Agreements  or  the
> >    interests of consumers?
>
> What protection is there for consumers against bad shoe store operators,
> or bad restaurant operators, or almost any other kind of commercial
> entity? The legal system provides basic legal protection, and the rest
> comes from competition -- competition provides the incentive for
> commercial entities to provide good service.  This is the whole premise
> of having registrars -- most regulation comes through market forces,
> like for most other businesses.

  These types of businesses that you mention here Kent are not
even close to being good comparisons.  Shoe store operators
do not request or require or even suggest that they need you personal
and private information to buy a pair of shoes from them.  Shoe
stores do not sell Domain Name registrations.  Registrars do.
Restaurant's do not sell Domain Names and do not require,
request or propose a standard for listing personal and private
information to buy their product/service, namely food or a
prepared meal.  Hence Kent, it should be obvious to even
a a near idiot that such businesses have dynamic and intrinsic
differences such that legal precepts are different, so much
different in fact that drawing such comparisons in this particular
example of yours, is not reasonable and a non-answer...

>
>
> And there is absolutely no question that market forces have been very
> powerful in this market -- some registrars have lost lots of market
> share, and others have gained a great deal.

  Indeed Market forces in this space have been very powerful, and
to a great extent also very damaging sense the RRA has been in effect.
So much so that may Judicial jurisdictions in the US and elsewhere are
complaining vigorously and increasingly due to the additional case load
that poor regulation or "Quasi-Standards" that ICANN has imposed
upon the stakeholders/registrants..

>
>
> >    I  don't see the point of ICANN Accreditation if that accreditation is
> >    based on  technical  capability,  rather  than  rules  of  conduct and
> >    recognition  of  ICANN  Agreements.  Technical  capability  to rip off
> >    customers? In some cases, sadly, yes.
>
> Interesting.  Most people argue that ICANN has too much regulatory
> power, not too little.

  In fact neither is true.  ICANN has to little enforcement of it's own
regulatory practices and regulations, making them both a joke to some
and a hindrance to others, thereby creating more confusion than we
had before ICANN was in the position they are in now...  That's just
poor policy and practice..

>
>
> >    Of  course, most registrars I encounter are decent people... but their
> >    reputation is badly damaged by the cowboys in your midst.
> >
> >    The rules of the game for registrars should run simply like this:
> >
> >    You  want the privilege and profit of operating in this business? Then
> >    you have to accept these rules.
> >
> >    You break those rules? You're out.
>
> Nice, simple, and unworkable, because of a multitude of practical
> difficulties.  eg: by what process do you establish the rules?

  By vote of the stakeholders/users of course Kent!

>  who
> interprets the rules?

  Good rules need little of not interpretation.  Cryptic or complex rules often

do.  Use the "KISS" method, and most, if not all supposed interpretations will
be unnecessary.  Those that are not will need to be interpreted by the
regulators
themselves first, than the courts...  Just like in any other industry with
regulatory
restrictions...

>  what form of due process do you put in place to
> deal with people who maliciously accuse registrars?

  If it can be established that the actions of any registrant/user
is malicious in nature that should be and usually is obvious.  Hence
the regulator can recommend a number of remedies if said remedies
are so established.  In ICANN's case almost no remedies are in
in place or documented for such a situation.  Again a poor application
of policy making on the part of ICANN...

>
>
> >    Contract. Sign.
>
> Lawsuit.
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,
- --
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 129k members/stakeholders strong!)
================================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 214-244-3801

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 6 Feb 2003 23:05:53 -0500
From: "Ross Wm. Rader" <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

Ram.

> Interesting thoughts and an interesting premise.  The problem is, that the
> groups you mention here (marketers, IP folks, etc) are not the only people
> who utilize Whois information.

I hear what you're saying, but you forget that the pendulum is mine. The
data is mine. There is no legitimate use beyond what I approve.

If it holds true for the marketers, why does it prove false for me?

> System operators (including technicians, systems administrators responding
> to abuse, etc) often depend solely on information found in Whois to
> determine next courses of action for serious network and other related
> issues.  This is not just a marketing/bulk messages problem ... there is
> real and legitimate use of this information (which was one of the original
> goals of having such a service).

Legitimate uses find their way through legitimate channels. We don't need to
create additional safeguards for any party to the system.

> Having said that, I was one of the team who worked with PIR to suggest the
> "OrgCloak" service -- which would allow individuals to cloak personal
> information from the general public for reasons of privacy.  I advocate
the
> protection of individual's private information from general purpose
> data-mining and public abuse.  However, your suggested solution provides a
> wonderful shelter for every spammer, DDoS violator and domain-slammer to
> hide behind.

Orgcloak and other proxy-like systems simply miss the boat. It is not your
information and I don't want your protection. As a matter of fact, let the
record show that the domain name byte.org is mine. The internet record will
support this. I have cloaked my record and have no intention of correcting
the information included in the record - period. If someone is interested in
contacting me for "legal reasons", they can do a google search, track down
my particulars - or - more appropriately - subpoena my registrar and get the
information the same way we did in the good old days. If you wish to use my
data for other purposes, please contact me through the aforementioned means
for an appropriate license.

> The Whois Task Force is working on providing meaningful recommendations
> that, among other things, addresses the issue of Bulk Whois.  The IETF
> Provreg group is debating adding a <privacy> element as a standard part of
> the de-facto standard domain protocol (EPP).  Let's be careful not to
throw
> the baby out with the bath water.

Neither the whois task force nor the IETF are remotely dealing with what I
am proposing. Until they are, customers need to look after themselves. If we
were talking about IP addresses, you'd probably get a lot more agreement out
of me. Corporate interests sold customers down the river a long time ago. We
don't need to perpetuate this forever.

Regards,

                      -rwr

"There's a fine line between fishing and just standing on the shore like an
idiot."
                - Steven Wright

Got Blog? http://www.byte.org

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 6 Feb 2003 22:01:54 -0800 (PST)
From: Karl Auerbach <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

On Thu, 6 Feb 2003, Ram Mohan wrote:

> Interesting thoughts and an interesting premise.  The problem is, that the
> groups you mention here (marketers, IP folks, etc) are not the only people
> who utilize Whois information.
> 
> System operators (including technicians, systems administrators responding
> to abuse, etc) often depend solely on information found in Whois to
> determine next courses of action for serious network and other related
> issues.

I disagree - Folks in NOCs *do* use something called "whois", but it most
often it is a distinct set of databases pertaining to IP address
allocations.

Why do NOC folks use the IP "whois"?  Simply because the key that one has
for the lookup is less easily forged.  Domain names on purported spam
e-mail are only ocassionally accurate.  But the IP address on a TCP
connection has intrinsic value because a TCP connection can not be formed
unless both the source and destination address are actually reachable.

Assuming for the moment that ISP's and such obtained value out of DNS
whois information - That still doesn't justify them mucking around unless 
certain conditions are met:

  1. That a person who acquires a domain name is informed from the outset
that such access will be performed by ISP people.  (I.e. actual or implied
consent by the data subject.)

  2. The person who is doing the looking is actually a real ISP person
following up on a specific legitimate problem.

It would not be all that hard for anyone claiming to be an "ISP" to jump 
through some qualification hoops in order to gain a whois access 
credential.  For instance, once a year.

The burden of proving that access to personally identifiable information
is a valid access ought to fall on the person requesting access, not on
the data subject.

> Your premise is also that all individuals provide accurate information.  We
> know (you definitely do, as a registrar) that some of the most egregious
> violators make sure that they provide _false_ information.

Why are people who feel they need to protect their privacy "egregious
violators".  Suppose you had young children, would you feel comfortable
publishing your (and thus their) addresses and phone numbers onto an open
directory?

> Giving individuals the sole right to provide information about them
> seems to swing the pendulum too far one way.

It's their information; they have the right to control it.
 
> ....  However, your suggested solution provides a
> wonderful shelter for every spammer, DDoS violator and domain-slammer to
> hide behind.

Nonesense.  If there are reasonable grounds to believe that someone has
violated a civil or criminal law, there are well established legal
procedures (many of which involve going before a neutral magistrate and
making a showing of those reasonable grounds) to obtain access to things 
like domain name registration databases.

Absent such a showing, there is no reason to violate privacy.  That is,
unless one accepts as a working premise that those who are accused are
considered guilty until they prove otherwise.

> The Whois Task Force is working on providing meaningful recommendations
> that, among other things, addresses the issue of Bulk Whois.

Until they establish that there is a reason for public publication of DNS 
registration information in the first place, such recommendations are 
fundamentally useless.

> The IETF Provreg group is debating adding a <privacy> element as a
> standard part of the de-facto standard domain protocol (EPP).

If you follow what is going on there, they are debating whether even to 
include some very weak, and potentially useless, mechanisms, and only 
because the IESG is holding the working group's feet to the fire.

> Let's be careful not to throw the baby out with the bath water.

And let's be careful not to turn whois into Megan's law in reverse: in
which internet users are forced to publish their (and their children's)
names, addresses, and phone numbers for the benefit of any and all
predators.

		--karl--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 01:24:50 -0500
From: "Ross Wm. Rader" <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

Its the right track Karl, but the right answer is:

> Assuming for the moment that ISP's and such obtained value out of DNS
> whois information - That still doesn't justify them mucking around unless
> certain conditions are met:

1. The registrant has given the accessor (ISP in your example) specific
permission to access and use their data.

                     -rwr

Got Blog? http://www.byte.org

"People demand freedom of speech as a compensation for the freedom of
thought which they seldom use."
 - Soren Kierkegaard

- ----- Original Message -----
From: "Karl Auerbach" <[email-masked]>
To: "Ram Mohan" <[email-masked]>
Cc: <[email-masked]>; "'George Kirikos'" <[email-masked]>;
<[email-masked]>
Sent: Friday, February 07, 2003 1:01 AM
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

>
> On Thu, 6 Feb 2003, Ram Mohan wrote:
>
> > Interesting thoughts and an interesting premise.  The problem is, that
the
> > groups you mention here (marketers, IP folks, etc) are not the only
people
> > who utilize Whois information.
> >
> > System operators (including technicians, systems administrators
responding
> > to abuse, etc) often depend solely on information found in Whois to
> > determine next courses of action for serious network and other related
> > issues.
>
> I disagree - Folks in NOCs *do* use something called "whois", but it most
> often it is a distinct set of databases pertaining to IP address
> allocations.
>
> Why do NOC folks use the IP "whois"?  Simply because the key that one has
> for the lookup is less easily forged.  Domain names on purported spam
> e-mail are only ocassionally accurate.  But the IP address on a TCP
> connection has intrinsic value because a TCP connection can not be formed
> unless both the source and destination address are actually reachable.
>
> Assuming for the moment that ISP's and such obtained value out of DNS
> whois information - That still doesn't justify them mucking around unless
> certain conditions are met:
>
>   1. That a person who acquires a domain name is informed from the outset
> that such access will be performed by ISP people.  (I.e. actual or implied
> consent by the data subject.)
>
>   2. The person who is doing the looking is actually a real ISP person
> following up on a specific legitimate problem.
>
> It would not be all that hard for anyone claiming to be an "ISP" to jump
> through some qualification hoops in order to gain a whois access
> credential.  For instance, once a year.
>
> The burden of proving that access to personally identifiable information
> is a valid access ought to fall on the person requesting access, not on
> the data subject.
>
> > Your premise is also that all individuals provide accurate information.
We
> > know (you definitely do, as a registrar) that some of the most egregious
> > violators make sure that they provide _false_ information.
>
> Why are people who feel they need to protect their privacy "egregious
> violators".  Suppose you had young children, would you feel comfortable
> publishing your (and thus their) addresses and phone numbers onto an open
> directory?
>
> > Giving individuals the sole right to provide information about them
> > seems to swing the pendulum too far one way.
>
> It's their information; they have the right to control it.
>
> > ....  However, your suggested solution provides a
> > wonderful shelter for every spammer, DDoS violator and domain-slammer to
> > hide behind.
>
> Nonesense.  If there are reasonable grounds to believe that someone has
> violated a civil or criminal law, there are well established legal
> procedures (many of which involve going before a neutral magistrate and
> making a showing of those reasonable grounds) to obtain access to things
> like domain name registration databases.
>
> Absent such a showing, there is no reason to violate privacy.  That is,
> unless one accepts as a working premise that those who are accused are
> considered guilty until they prove otherwise.
>
> > The Whois Task Force is working on providing meaningful recommendations
> > that, among other things, addresses the issue of Bulk Whois.
>
> Until they establish that there is a reason for public publication of DNS
> registration information in the first place, such recommendations are
> fundamentally useless.
>
> > The IETF Provreg group is debating adding a <privacy> element as a
> > standard part of the de-facto standard domain protocol (EPP).
>
> If you follow what is going on there, they are debating whether even to
> include some very weak, and potentially useless, mechanisms, and only
> because the IESG is holding the working group's feet to the fire.
>
> > Let's be careful not to throw the baby out with the bath water.
>
> And let's be careful not to turn whois into Megan's law in reverse: in
> which internet users are forced to publish their (and their children's)
> names, addresses, and phone numbers for the benefit of any and all
> predators.
>
> --karl--
>
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
>
>

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 02:07:08 -0500 (EST)
From: Joe Baptista <[email-masked]>
Subject: [ga] Ester Dyson - the great fall from heaven

There's one thing about Ester Dyson I've always admired - her tits.  But
she's also a mystery.  How people ever took her seriously - I have no
idea.  Her understanding of the net is at best juvenile.  Which leads me
to believe that those who ever took her seriously must also be juvenile.

Ester played a key role in ICANN and ICANN played a key role in destroying
the U.S. root system.  Of course I predicted this some 5 years ago (?) or
so.  And now I predict Ester's eclipse.  But shes always welcomed in my
home - provided shes topless.

Bye bye Ester - you can press the delete button now .....

   Dyson cleans out her closet
   By Bill Thompson
   Posted: 06/02/2003 at 21:24 GMT

   Esther Dyson, one of the key figures in the development of the
   commercial Internet, advisor to Al Gore, promoter of the Net in
   Eastern Europe and poster woman for the dotcom millionaires, went to
   massive lengths today to distance herself from the failures of ICANN,
   the Internet Corporation for Assigned Names and Numbers. Despite
   having been a Founding Director, Dyson now says that her involvement
   in ICANN's development was actually very limited.

   "I was peripherally involved", she claimed. "I went to a few meetings
   and we discussed a bunch of topics. but for my sins of negligence I
   ended up being invited to join the board of ICANN when it was
   created."

   Dyson also attempted to downplay the importance of the first board of
   directors, of which she was a key member, saying "we were not supposed
   to be the final board. we were supposed to figure out the transition
   to the final board". She also acknowledged that many of the criticisms
   made were justified: ICANN was unaccountable, secretive and
   inefficient in its early days.

   "ICANN is not perfect", she admitted, "and I'm not really here to
   defend it." However she did attempt to justify its continued
   existence, saying: "I'm a critic who thinks these things are hard to
   do and I can't see any other way."

   The unexpected confessional may have been prompted by her current need
   to re-establish credibility with the net community as she works to
   develop proposals for getting ordinary users involved in the
   formulation of ICANN policy through the At Large advisory committee
   which she chairs.

   "We want public input into ICANN", she said. "We've got a mechanism
   where it can have a seat on the task forces, liaisons to working
   groups, be part of the policy making process - I see that in many ways
   as more important than having a seat on the board." Others, of course,
   may disagree.

   Dyson was speaking in the Oxford Union at a conference called 'The
   Politics of Code', jointly organised by the Oxford Internet Institute
   and the Programme in Comparative Media Law and Politics at Oxford
   University.

   The one day conference brought together many net luminaries, including
   Professor Lawrence Lessig from Stanford University, Alan Davidson of
   the Center for Democracy and Technology and Harvard Alvestrand, chair
   of the IETF.

   The goal was to debate two complementary issues: how program code
   controls our online behaviour, and how the net can be regulated by
   governments rather than companies.

   Lessig, jet-lagged and miserable after losing Eldred vs Ashcroft, was
   entertaining but didn't say anything new. Fortunately the last session
   was enlivened by a witty contribution from CDT's Alan Davidson, who
   gave a talk which poked fun at the different cultures of the standards
   bodies ("In the Web Consortium you pay to play, everybody votes, then
   Tim decides. At the IETF you hum") while giving several good reasons
   why you should believe it when a lawyer turns up at a technical
   meeting saying 'I'm here to help.'

   Then it was off to drinks in Oxford's delightful Ashmolean Museum,
   where the real work of the day got done as contacts were established,
   names put to email addresses and new alliances forged. Let's just hope
   the policy makers and lawyers get their act together before the
   pigopolist revolution is complete. ®

Joe Baptista - only at www.baptista.god

  .ufo domain registration http://www.register.ufo

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 7 Feb 2003 02:29:48 -0500
From: "Ram Mohan" <[email-masked]>
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

Karl:
I am mystified after reading your post.  I share similar beliefs to yours
reg. data privacy.  Some of your statements seem to be derived from a
different reading of my post than what I intended -- let me clarify.

> The burden of proving that access to personally identifiable information
> is a valid access ought to fall on the person requesting access, not on
> the data subject.

+ Agreed.  I merely point out that Whois information has value beyond just
marketers and ip/trademark folks.  Although network operators use
address-registry whois information more than domain-registry, they do (also)
use domain whois information.  Individuals should have the ability to
protect information about themselves from being indiscriminately
displayed/mined/sold.

> Why are people who feel they need to protect their privacy "egregious
> violators".  Suppose you had young children, would you feel comfortable
> publishing your (and thus their) addresses and phone numbers onto an open
> directory?

+ You misread what I said.  I said that providing *only* individuals the
right to provide access to data works as long as the premise is that the
individual supplies accurate/valid data.  However, some of the most
egregious violators (such as domain slammers) wantonly provide false
information - and those trying to get "their" domain name restored to them
have a problem.

> If there are reasonable grounds to believe that someone has
> violated a civil or criminal law, there are well established legal
> procedures (many of which involve going before a neutral magistrate and
> making a showing of those reasonable grounds) to obtain access to things
> like domain name registration databases.

+ Indeed.  As long as you can find someone/someplace to serve.  Or if the
domain name database has accurate information to go after that
individual/group.  The OECD case showed some interesting practical
challenges to this approach.

> And let's be careful not to turn whois into Megan's law in reverse: in
> which internet users are forced to publish their (and their children's)
> names, addresses, and phone numbers for the benefit of any and all
> predators.

+ I don't disagree with you on this.  I certainly get my share of spam,
unsolicited calls, etc thanks to having accurate information available via
Whois.

In reality, domain name Whois information represents a shrinking percentage
of the total Internet (and world) population -- its relevance reduces every
passing year.  You can pick up far more detailed, segmented demographic
information about me (or you) through product registration databases that
get updated when people send in registration cards for everything they buy -
and which they don't realize is often distributed without their permission.

There needs to be a place where accurate domain contact information resides.
Access to this information ought to be restricted and differentiated.
Permission needs to be sought.  Current practice is often a mess, and
abused.  Does this mean we should "completely disengage from the current
system", as Ross suggests ?  Maybe Ross' suggestion is just about marketer
use/abuse of Whois data, in which case I have nothing more to say on the
topic.

Back to my day job now.

- -ram
- ----- Original Message -----
From: "Karl Auerbach" <[email-masked]>
To: "Ram Mohan" <[email-masked]>
Cc: <[email-masked]>; "'George Kirikos'" <[email-masked]>;
<[email-masked]>
Sent: Friday, February 07, 2003 1:01 AM
Subject: Re: [ga] whois.txt, ala robots.txt, as a standard ?

>
> On Thu, 6 Feb 2003, Ram Mohan wrote:
>
> > Interesting thoughts and an interesting premise.  The problem is, that
the
> > groups you mention here (marketers, IP folks, etc) are not the only
people
> > who utilize Whois information.
> >
> > System operators (including technicians, systems administrators
responding
> > to abuse, etc) often depend solely on information found in Whois to
> > determine next courses of action for serious network and other related
> > issues.
>
> I disagree - Folks in NOCs *do* use something called "whois", but it most
> often it is a distinct set of databases pertaining to IP address
> allocations.
>
> Why do NOC folks use the IP "whois"?  Simply because the key that one has
> for the lookup is less easily forged.  Domain names on purported spam
> e-mail are only ocassionally accurate.  But the IP address on a TCP
> connection has intrinsic value because a TCP connection can not be formed
> unless both the source and destination address are actually reachable.
>
> Assuming for the moment that ISP's and such obtained value out of DNS
> whois information - That still doesn't justify them mucking around unless
> certain conditions are met:
>
>   1. That a person who acquires a domain name is informed from the outset
> that such access will be performed by ISP people.  (I.e. actual or implied
> consent by the data subject.)
>
>   2. The person who is doing the looking is actually a real ISP person
> following up on a specific legitimate problem.
>
> It would not be all that hard for anyone claiming to be an "ISP" to jump
> through some qualification hoops in order to gain a whois access
> credential.  For instance, once a year.
>
> The burden of proving that access to personally identifiable information
> is a valid access ought to fall on the person requesting access, not on
> the data subject.
>
> > Your premise is also that all individuals provide accurate information.
We
> > know (you definitely do, as a registrar) that some of the most egregious
> > violators make sure that they provide _false_ information.
>
> Why are people who feel they need to protect their privacy "egregious
> violators".  Suppose you had young children, would you feel comfortable
> publishing your (and thus their) addresses and phone numbers onto an open
> directory?
>
> > Giving individuals the sole right to provide information about them
> > seems to swing the pendulum too far one way.
>
> It's their information; they have the right to control it.
>
> > ....  However, your suggested solution provides a
> > wonderful shelter for every spammer, DDoS violator and domain-slammer to
> > hide behind.
>
> Nonesense.  If there are reasonable grounds to believe that someone has
> violated a civil or criminal law, there are well established legal
> procedures (many of which involve going before a neutral magistrate and
> making a showing of those reasonable grounds) to obtain access to things
> like domain name registration databases.
>
> Absent such a showing, there is no reason to violate privacy.  That is,
> unless one accepts as a working premise that those who are accused are
> considered guilty until they prove otherwise.
>
> > The Whois Task Force is working on providing meaningful recommendations
> > that, among other things, addresses the issue of Bulk Whois.
>
> Until they establish that there is a reason for public publication of DNS
> registration information in the first place, such recommendations are
> fundamentally useless.
>
> > The IETF Provreg group is debating adding a <privacy> element as a
> > standard part of the de-facto standard domain protocol (EPP).
>
> If you follow what is going on there, they are debating whether even to
> include some very weak, and potentially useless, mechanisms, and only
> because the IESG is holding the working group's feet to the fire.
>
> > Let's be careful not to throw the baby out with the bath water.
>
> And let's be careful not to turn whois into Megan's law in reverse: in
> which internet users are forced to publish their (and their children's)
> names, addresses, and phone numbers for the benefit of any and all
> predators.
>
> --karl--
>
>

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #1579
*************************