<HTML><FONT FACE=arial,helvetica><HTML><FONT SIZE=2 PTSIZE=10 FAMILY="SANSSERIF" FACE="Arial" LANG="0">Hi All, I have reviewed Milton's draft comments for WHOIS Task Force 2 and I have the following concerns and recommendations.<BR>
<BR>
1) I don't see Task Force 1 (TF1) waiting for Task Force 2 (TF2). All the task forces are under tons of pressure to report back and issue their final reports on/before ICANN's July meeting. I don't believe there will be support for "slowing down the train."<BR>
<BR>
2) Task Force 2 is *unlikely to examine primary purpose* of the WHOIS database. Unfortunately, it was not until George Papapavlou's speech in Rome to NCUC and Registrars that we heard this call so loud and so immediate. The questionnaires of TF2 (4 in all) are not designed to solicit input on primary purpose. They are designed to look at 1) uses (all forms of secondary uses), 2) concerns (for the first time, we get to write our concerns for the misuse and abuse of the data), and 3) privacy laws (are their national/regional laws that protect WHOIS-type data). <BR>
<BR>
If TF2, with its current information, moves forward to decide primary purpose, we will get it wrong. <BR>
<BR>
===> Therefore, my recommendation for a NCUC WHOIS strategy (for the present round of Constituency statements is):<BR>
<BR>
A) Assume Primary Purpose is Original Purpose. EPIC has collected information regarding the original technical purpose of WHOIS. If any NCUC member has additional information about "the old days," please let us know. But let's put forward loudly and clearly in all our Statements that the Original Purpose of this collection is technical.<BR>
<BR>
B) Let's throw out the startling idea that the only way to limit marketing uses to WHOIS in Port 43 may be to shut down Port 43 and create access to a similar type of online utility that is available only to the technical community (pursuant to contractual terms/limits/etc) so that registrars can use this data for transfers, etc.<BR>
<BR>
C) Let's nicely urge TF1 to honor the commitment its chair made at the Rome meeting: that TF1 will take seriously its role of limiting marketing uses, and will absolutely not differentiate among different types of non-marketing uses (and specifically will not issue language elevating the use of intellectual property and law enforcement -- let's spell it out -- above other forms of non-marketing uses (e.g. research, personal access, etc).<BR>
<BR>
D) Let's wake up governments and urge them to assist in this discussion as it rises to the level of the ICANN Board. <BR>
<BR>
Kathy<BR>
(NCUC Rep on TF2)<BR>
<BR>
<<<BR>
<BLOCKQUOTE TYPE=CITE style="BORDER-LEFT: #0000ff 2px solid; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px; PADDING-LEFT: 5px">Hello, this is just a first draft. The key element of my approach to all the Whois Task Forces is that we insist on getting ICANN to define the<BR>
purpose of the Whois database. This means that TF2 is primary,<BR>
and must be completed first, and the others are secondary. <BR>
<BR>
=========<BR>
<BR>
<BR>
Proposed NCUC statement on Whois Task force 1<BR>
<BR>
Whois Task Force 1 (TF1) deals with the relatively narrow <BR>
issue of restricting marketing users' access to Whois data through means other than bulk access under license. <BR>
<BR>
This Task Force is mainly of interest to registrars and registries, <BR>
whose facilities and customer lists are exploited <BR>
by automated processes. Users of course have some interest <BR>
in protecting access to their contact data, but this interest extends well beyond the narrow remit of TF1. <BR>
<BR>
NCUC notes, however, that the results of Whois TF1 may <BR>
have implications for the other task forces. Our approach <BR>
to TF1 takes this into account, and will be guided by the <BR>
following principles:<BR>
<BR>
First, NCUC thinks it imperative that ICANN recognize the well-<BR>
established data protection principle that the purpose of data <BR>
and data collection processes must be well-defined before <BR>
policies regarding its use and access can be established. Therefore <BR>
we believe that TF1 should await the outcome of Whois Task <BR>
Force 2 (TF2), which will determine what data elements belong <BR>
in Whois. That determination of TF2 must be based on a definition of the purpose of the Whois database. In other <BR>
words, we cannot know whether or not to restrict port 43 and port 80 access until TF2 has completed its work. <BR>
<BR>
Second, NCUC does not believe it is possible to develop <BR>
technical or policy mechanisms that can restrict port 43 or port 80 access only to a specific type of user; e.g., <BR>
marketers. Access restrictions imposed by TF1 will inevitably <BR>
apply to all users and uses. The policies developed by TF1 <BR>
must keep this in mind. <BR>
<BR>
Third, given the limited scope of TF1, we think it important <BR>
for the task force to refrain from making judgments about the legitimacy of, justifications for, or "need" for any <BR>
non-marketing uses. It is outside the scope of TF1 to make any such determinations. Accordingly, we will oppose <BR>
any access restriction policy based on classification of users. <BR>
<BR>
Fourth, we note as a principle that the best way to stop abuse <BR>
of port 43 is to get data that is valuable to spammers out of <BR>
the public Whois database. Data that is in Whois will be accessible <BR>
to lots of people; therefore, privacy concerns require getting data <BR>
out of Whois or reducing access to it for all. This is, of course, a <BR>
matter for Whois Task force 2, dealing with data elements. <BR>
<BR>
Fifth, our participation in TF1 will try to make sure that minor <BR>
modifications in port 43 (or other) access do not become an excuse for doing nothing else to protect Internet <BR>
users' privacy. </BLOCKQUOTE><BR>
<BR>
</FONT></HTML>