EPIC Comments on WHOIS

[Marc Rotenberg]

Dear NCUCers,

Here is the letter on WHOIS that went to the ICANN board.

Thank you all for your help with this, and especially Kathy K.
who has been fighting the good fight on WHOIS for many
years. We also gathered the support of several of the prominent
members of the EPIC Advisory Board. That may help.

Good luck to those in LA!

Best

Marc and Allison.

--------------


October 30, 2007

Mr. Vinton Cerf, Chairman
Mr. Paul Twomey, President & CEO
Internet Corporation for Assigned Names and Numbers
4676 Admiralty Way, Suite 330
Marina del Rey, CA 90292-6601
USA

Dear Mr. Cerf, Mr Twomey, and Members of the ICANN Board,

The purpose of this letter is to express our support for changes to  
WHOIS services
that would protect the privacy of individuals, specifically the  
removal of registrants'
contact information from the publicly accessible WHOIS database.[1]   
It is also to propose
a  sensible resolution to the long-running discussion over WHOIS that  
would establish a bit
of "policy stability" and allow the various constituencies to move on  
to other work

EPIC has had long-standing involvement in the WHOIS issue. As a  
member of
the WHOIS Privacy Steering Committee, EPIC assisted in the  
development of the
WHOIS work program, and has been a member of the Non-Commercial Users
Constituency for several years. EPIC has submitted extensive comments  
to ICANN on
WHOIS, and has testified before the US Congress in support of new  
privacy safeguards
for WHOIS as well as filing a brief in the US courts on the privacy  
implications of the
WHOIS registry.[2]  The Public Voice coalition also organized an  
important letter in 2003
to ICANN regarding WHOIS policy that was signed by 57 organizations  
from more than
20 countries which recommended simply that ICANN consider the views  
of consumer
organizations and civil liberties groups.[3]

Both the WHOIS Task Force and the WHOIS Working Group agree that new
mechanisms must be adopted to address an individual's right to  
privacy and the protection
of his/her data.[4]  Current ICANN WHOIS policy conflicts with  
national privacy laws,
including the EU Data Protection Directive, which requires the  
establishment of a legal
framework to ensure that when personal information is collected, it  
is used only for its
intended purpose. As personal information in the directory is used  
for other purposes and
ICANN's policy keeps the information public and anonymously  
accessible, the database
could be found illegal according to many national privacy and data  
protection laws
including the European Data Protection Directive, European data  
protection laws and
legislation in Canada and Australia.[5]

The Article 29 Working Party, an independent European advisory body  
on data
protection and privacy, states that "in its current form the [WHOIS]  
database does not
take account of the data protection and privacy rights of those  
identifiable persons who
are named as the contacts for domain names and organizations."[6]   
The conflict with
national privacy law is real and cannot be dismissed. A sensible  
resolution of the WHOIS
matter must take this into account.

In addition, country code Top Level Domains are moving to provide  
more privacy
protection in accordance with national law. For example, regarding  
Australia's TLD, .au,
the WHOIS policy of the .au Domain Administration Ltd (AUDA) states  
in section 4.2,
"In order to comply with Australian privacy legislation, registrant  
telephone and
facsimile numbers will not be disclosed. In the case of id.au domain  
names (for
individual registrants, rather than corporate registrants), the  
registrant contact name and
address details also will not be disclosed."[7]

The Final Outcomes Report recently published by the WHOIS Working Group
contains several key compromises and useful statements and represents  
significant
progress on substantive WHOIS issues. The WHOIS Working Group found  
agreement in
critical areas that advance the WHOIS discussion within ICANN and  
provide clear
guidance to the ICANN Board.

In its report, the WHOIS Working Group accepted the Operational Point of
Contact (OPoC) proposal as a starting point, and the best option to  
date. The OPoC
proposal would replace publicly available registrant contact  
information with an
intermediate contact responsible for relaying messages to the  
registrant. The Working
Group agreed that there may be up to two OPoCs, and that an OPoC can  
be the
Registrant, the Registrar, or any third party appointed by the  
Registrant. The Registrant is
responsible for having a functional OPOC. The Working Party also  
agreed that the OPOC
should have a consensual relationship to the Registrant with defined  
responsibilities. This
would necessitate the creation of a new process, and changes to the  
Registrar
Accreditation Agreement and Registrar-Registrant agreements to  
reflect this relationship.

The Board should support the agreed standard for disclosure of  
unpublished
Whois personal data – reasonable evidence of actionable harm.  But  
the Board should
leave this term undefined, as it is now in the RAA for proxy  
services.  This standard will
allow the OPoC contact, registrars and registries to work within the  
framework of their
national and local laws to provide access to this personal data.

OPoCs must be allowed to employ strategies and standards similar to  
those of the
registrars and registries to ensure that the person receiving the  
protected personal WHOIS
data is in fact a law enforcement official.

The OPoC proposal does not impede reasonable law or intellectual  
property
enforcement efforts. In fact, effective implementation of the OPoC  
proposal would
benefit all stakeholders by improving the accuracy of the information  
in the database.
Because personal data will be kept private, individuals will provide  
more accurate data.
As a result, the Whois database will be more useful and more reliable.

The OPoC proposal is not the ideal privacy solution. EPIC, as well as  
groups such
as the Non-Commercial Users Constituency, recommended a distinction  
between
commercial and non-commercial domains in order to protect the privacy  
of registrants of
domain names used for religious purposes, political speech,  
organizational speech, and
other forms of non-commercial speech. EPIC has previously stated that  
the WHOIS
database should not publicize any registrant information, including  
name and jurisdiction.

The WHOIS Working Group has proposed a workable framework. It is not a
perfect framework. But it will help ensure that the WHOIS policy  
conforms with law and
allow ICANN to move forward. If it is not possible to adopt this  
solution, then the only
sensible approach would be to allow the current WHOIS terms to simply  
sunset.
Resolution 3 would be the only real option.

The signatories to this letter are willing to assist in finishing off  
the
implementation details of the OPoC proposal.

Sincerely,

Marc Rotenberg
EPIC Executive Director

Allison Knight
Coordinator
Public Voice Project

Valerie Gordon,
Jamaica Sustainable Development
Network

Robin Gross
IP Justice

Robert Guerra, CPSR

Kim Heitman,
Board Member EFA
Deputy Chair AUDA

Norbert Klein
ICANN GNSO Council member
ICANN NCUC
Open Institute of Cambodia

Kathy Kleiman
Co-Founder, NCUC

Dan Krimm
TJ McIntyre (Chairman)
Digital Rights Ireland

Ville Oksanen
Vice Chairman, EFFI

Ross Rader,
Domain Direct



Members of the EPIC Advisory Board

Steven Aftergood, Project Director
Federation of American Scientists

Anita L. Allen
Professor of Law and Philosphy
University of Pennsylvania

David Banisar, Director
Freedom of Information Project, Privacy
International;
Visiting Research Fellow,
School of Law, University of Leeds

Christine L. Borgman
Professor & Presidential Chair
Dept of Information Studies, UCLA

James Boyle
Professor of Law
Duke Law School

David Chaum
Founder
Punchscan

Julie E. Cohen
Professor Law
Georgetown University Law Center

Simon Davies
Director General
Privacy International

David Farber
Distinguished Career Professor of
Computer Science and Public Policy,
Carnegie Mellon University

David H. Flaherty
Professor Emeritus
University of Western Ontario.

Austin Hill
Brudder Ventures

Jerry Kang
Professor of Law
UCLA Law School

Chris Larsen
CEO
Prosper Marketplace, Inc.

Mary Minow
Founder
LibraryLaw.com

Pablo Molina
Chief Information Officer
Georgetown University Law Center

Deborah C. Peel, MD,
Founder and Chair
Patient Privacy Rights

Anita Ramasastry
Associate Professor of Law
Director, Shidler Center for Law
Commerce & Technology
University of Washington School of
Law

Ronald L. Rivest
Professor of Electrical Engineering and
Computer Science
Massachusetts Institute of Technology

Pamela Samuelson
Distinguished Professor of Law;
Professor of Information Management;
Chancellor's Professor
School of Law – Boalt Hall
University of California at Berkeley

Bruce Schneier
CTO
BT Counterpaine

Edward G. Viltz
President and Founder
Internet Collaboration Coalition

NOTES

[1]  EPIC's comments on the ICANN WHOIS Task Force's "Preliminary  
Task Force Report on WHOIS
Services," January 12, 2007, available at <http://www.epic.org/ 
privacy/whois/comments.html>.
[2]  See, e.g., EPIC, "Privacy Issues Report: The Creation of A New  
Task Force is Necessary For an
Adequate Resolution of the Privacy Issues Associated With  
WHOIS," .before the GNSO Council (Mar. 10,
2003), See EPIC Testimony Before House Subcommittee, Financial  
Institutions and Consumer Credit,
Committee on Financial Services "ICANN and the WHOIS Database:  
Providing Access to Protect
Consumers from Phishing," (July 18, 2006), available
athttp://financialservices.house.gov/media/pdf/071806mr.pdf; Brief  
Amicus Curiae of EPIC, Peterson v.
Nat. Telecomm. & Info. Admin., No. 06-1216 (4th Cir. Apr. 24, 2006),  
available at.
http://www.epic.org/privacy/peterson/epic_peterson_amicus.pdf; See  
generally EPIC WHOIS page,
http://www.epic.org/privacy/whois/.
[3]   The Public Voice, "WHOIS Letter to ICANN," (Oct. 28, 2003),
http://thepublicvoice.org/news/whoisletter.html.
[4]  Final Report of the WHOIS Task Force, March 12, 2007, available  
at <http://gnso.icann.org/issues/whois-
privacy/whois-services-final-tf-report-12mar07.htm>; and Final Report  
of the WHOIS Working Group,
August 20, 2007, available at <http://gnso.icann.org/drafts/icann- 
whois-wg-report-final-1-9.pdf>.
[5]  EPIC and Privacy International, PRIVACY AND HUMAN RIGHTS: AN  
INTERNATIONAL SURVEY OF PRIVACY
LAWS AND DEVELOPMENTS 154-57 ("WHOIS"), available at <http:// 
www.epic.org/phr06>.
[6]  Letter from Article 29 Working Party to ICANN Chair Vinton Cerf,  
March 12, 2007, available at
<http://www.icann.org/correspondence/schaar-to-cerf-12mar07.pdf>.
[7]  For additional country code Top Level Domain policy examples,  
see EPIC Testimony Before House
Subcommittee, Financial Institutions and Consumer Credit, Committee  
on Financial Services "ICANN and
the WHOIS Database: Providing Access to Protect Consumers from  
Phishing," available at
<http://financialservices.house.gov/media/pdf/071806mr.pdf>.



Begin forwarded message:

> From: Marc Rotenberg <rotenberg at epic.org>
> Date: October 30, 2007 7:28:16 PM EDT
> To: whois-comments-2007 at icann.org
> Cc: Marc Rotenberg <rotenberg at epic.org>, Allison Knight  
> <knight at epic.org>
> Subject: Comments on WHOIS - NGOs and EPIC Advisory Board
>





/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ 
\/\/\/\/\/\/\/\/\/\/\/\
Marc Rotenberg, Executive Director
Electronic Privacy Information Center (EPIC)
1718 Connecticut Ave., NW, Suite 200
Washington, DC 20009
+1 202 483 1140 x106 [tel]
+1 202 483 1248 [fax]
  EPICMarc [voip-skype]
htttp://www.epic.org/


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncuc.org/pipermail/ncuc-discuss/attachments/20071031/8863cce5/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: EPIC Whois Letter to ICANN.pdf
Type: application/pdf
Size: 97419 bytes
Desc: not available
URL: <http://lists.ncuc.org/pipermail/ncuc-discuss/attachments/20071031/8863cce5/attachment.pdf>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncuc.org/pipermail/ncuc-discuss/attachments/20071031/8863cce5/attachment-0001.html>