WHOIS: ICANN Sacrifices Privacy for Shot at Independence

[Robin Gross]

Professor Geist has reviewed the recent agreement between the US 
government and ICANN and found a clause requiring ICANN to make no 
change on WHOIS policy.

Robin

http://www.michaelgeist.ca/content/view/1474/159/


      ICANN Sacrifices Privacy for Shot at Independence

	| Print | 
<http://www.michaelgeist.ca/index2.php?option=com_content&task=view&id=1474&Itemid=159&pop=1&page=0#> 


Tuesday October 10, 2006

Appeared in the Toronto Star on October 9, 2006 as Web's Naming Body 
Barters Away Privacy <http://geisticannagreement.notlong.com>

Appeared in the BBC on October 10, 2006 as Internet Privacy 'Sacrificed" 
By ICANN <http://news.bbc.co.uk/2/hi/technology/6036481.stm>

Internet governance has attracted increasing attention in recent years 
as governments, business communities, and Internet users struggle to 
develop a model that adequately takes into account the concerns of all 
stakeholders. At the center of this debate is the Internet Corporation 
for Assigned Names and Numbers (ICANN), a California-based non-profit 
corporation charged with the principal responsibility for maintaining 
the Internet's domain name system.

ICANN has been dogged by criticism since it was established under 
contract to the U.S. government in 1998. Those concerns have focused 
primarily on poor accountability practices. The power retained by the 
U.S. - the 1998 agreement gave it significant oversight powers - has 
left many governments uncomfortable with their limited input into 
Internet governance decisions, while the business community, 
particularly companies involved in the multi-billion dollar domain name 
registration sector, have become increasingly vocal about ICANN's lack 
of transparency and due process mechanisms.

Meanwhile Internet users, who were initially promised a "bottoms-up" 
policy making process with half of the seats on the ICANN board reserved 
for their interests, have become steadily marginalized within the ICANN 
community with no guaranteed board representation and with limited 
support for policy initiatives.

Late last month, ICANN took a major step toward addressing some of these 
concerns by signing a new agreement with the U.S. government entitled 
the Joint Project Agreement. ICANN immediately heralded the JPA as a 
"dramatic step forward" for full management of the Internet's domain 
name system through a "multi-stakeholder model of consultation."

ICANN stated that the agreement grants it unprecedented independence by 
removing many of the U.S. government’s oversight controls. These include 
the elimination of a twice-annual reporting requirement to the U.S. 
Department of Commerce (ICANN will instead release a single annual 
report targeted to the full Internet community) and a shift away from 
the highly prescriptive policy responsibilities featured in the original 
ICANN contract.

Moreover, with the JPA scheduled to expire in September 2009, ICANN 
supporters believe that the stage is now set for formal privatization of 
Internet governance responsibilities with the U.S. government ultimately 
relinquishing any further oversight authority.

While the JPA may indeed represent an important change, a closer 
examination of its terms suggest that there may be a hidden price tag 
behind ICANN newfound path toward independence - the privacy of domain 
name registrants.

For the past five years, privacy has lingered as one of ICANN's most 
contentious policy issues. Information on tens of millions of domain 
name registrants are contained in the "WHOIS database", which is readily 
available to anyone with Internet access. Pre-dating ICANN, the database 
identifies the name, address, and other personal information of domain 
name registrants.

Privacy groups, including European data protection commissioners, have 
expressed misgivings about the mandatory collection and the disclosure 
of registrant personal information. They note that domain name 
registrants are required to provide accurate registration information 
(failure to do so may result in a loss of the domain name) and that the 
open disclosure of this personal data may create a chilling effect on 
the registration of controversial websites where the registrant desires 
to remain anonymous. For example, registrants in oppressive political 
regimes may need to hide their identity to avoid criminal prosecution, 
while corporate whistleblowers in North America could lose their jobs if 
their identities were discovered.

After years of debate, the ICANN community recently took baby steps 
toward eliminating the mandatory disclosure of personal information 
within the WHOIS database. The U.S. government strenuously objected to 
the WHOIS reforms, arguing that law enforcement and intellectual 
property interests rely on easy availability of such data. Yet with the 
reforms, the data would be readily available to law enforcement, with 
the appropriate due process measures (such as court orders). The issue 
is whether the data should be available without any oversight.

Given that a newly independent ICANN might continue to pursue WHOIS 
reform, the U.S. government included a specific provision on the issue 
within the JPA. It mandates ICANN to "continue to enforce existing 
policy relating to WHOIS, such existing policy requires that ICANN 
implement measures to maintain timely, unrestricted and public access to 
accurate and complete WHOIS information, including registrant, 
technical, billing and administrative contact information."

The implications of this clause seem clear - the U.S. government has 
undone five years of policy work that the Internet community has 
undertaken by requiring ICANN to enforce current WHOIS policies. As 
discontent over the WHOIS issue mounted late last week, ICANN CEO Paul 
Twomey offered a strained interpretation of the clause, suggesting that 
he did not believe that it restricted future WHOIS reforms.

A more realistic take is that ICANN and the U.S. government have once 
again undermined the confidence of the Internet community and have 
provided a clear signal that the U.S. government is still reluctant to 
transfer its oversight authority. In its zeal to obtain independence, it 
would appear that ICANN has bartered the privacy of millions of domain 
name registrants around the world.

/Michael Geist holds the Canada Research Chair in Internet and 
E-commerce Law at the University of Ottawa, Faculty of Law. He can 
reached at mgeist at uottawa.ca or online at www.michaelgeist.ca./



<http://www.michaelgeist.ca/index2.php?option=com_content&task=view&id=1474&Itemid=159&pop=1&page=0#>