All, I support what Robin, Avri and Wendy have written. It adhers to the purpose of Whois approved by the GNSO Council and it moves things in the right direction. The fact is that neither phone numbers nor email addresses have any mandatory publication -- not for companies or individuals or the range of noncommercial and hobby interests in between. If we did have mandatory publication requirements for phone numbers and email addresses, then I am certain you would find business and IP creating a range of uses and arguing that they are all crucial to their profit -- as they do today with Whois. The fact is that with unlisted and partially listed phone numbers, email and chatroom identifies, business and IP must make due with supoenas and due process (and they seem to survive and still have a profit). Danny, I don't have a problem with supoenas and due process. Years ago, the US government wanted AT&T, then the monopoly telephone provider in the US to provide unlimited access to wiretap calls in the US. The General Counsel (a former trial attorney at Nuremberg) said No. He said that the telephone system would only thrive if people and businesses believed their privacy would be protected and he negotiated the US wiretap laws that set a standard and model for privacy in the communication system. We don't have that balance of privacy and process in the Whois system and we badly need I see no reason for Whois to be different. Law enforcement needs to get thousands of subpoenas for unlisted numbers, to wiretap calls and to direct ISPs to hand over the identities behind email and chat room names. It is the way we protect human rights organizations, individuals, political and community organizations (even unpopular ones) and even businesses (who often suffer from unfair competition practices). That's the balance and the protection of privacy. I think this proposal gets it right, and I think it is consistent with the decision made by the entire convened NCUC meeting in Marrakech -- a group with even more policy authority than the policy committee. We spent a lot of time on this issue and we agreed that due process and subpoenas should be the position of the NCUC. This proposal should, of course, be presented for discussion, as it is here. But to me it adheres to the principles this constituency has supported with huge amount of blood, sweat and tears for close to half a decade. Best, Kathy , Today, Avri Doria of NomCom, Wendy Seltzer of ALAC, and myself have made a proposal to no longer publish whois data on the net. The "Stability and Security proposal" is attached and below. Ross Rader of the Registrars also supports this proposal. It should cause a stir..... Since Biz & IPR continue to make proposals to frustrate privacy and the security of Internet users, we thought we'd make a proposal of our own. Robin ==================== RETHINKING THE ROLE OF ICANN AND THE GTLD WHOIS TO ENHANCE THE SECURITY AND STABILITY OF THE DNS A PROPOSAL FOR THE GNSO TASK FORCE ON WHOIS SERVICES PREPARED DECEMBER, 2006 BACKGROUND I) The purpose of Whois It is widely accepted that the primary original uses of the gTLD Whois service is to use it for the purpose of coordinating technical actors as they seek to resolve operational issues related to the security and stability of the DNS and a well-functioning internet. Present day examples of this are many; ● Network operators and service providers use Whois data to prevent or detect sources of security attacks of their networks and servers; ● Emergency response and network abuse teams use Whois data to identify sources of spam and denial of service attacks and incidents; ● Commercial internet providers use Whois data to support technical operations of ISPs and network administrators; ● ISPs and Web hosting companies use Whois data to identify when a domain name has been deleted, and remove redundant DNS information from ISP name servers The importance of this original purpose was reaffirmed in the GNSO council's recommended definition on the purpose of Whois: "The purpose of the gTLD Whois service is to provide information sufficient to contact a responsible party for a particular gTLD domain name who can resolve, or reliably pass on data to a party who can resolve, issues related to the configuration of the records associated with the domain name within a DNS name server." The scope of use has increased considerably beyond this over time, a subject that has already been substantially considered by the GNSO Whois Task Force and Council. The scope of use of the internet has also changed over time, as have the management tools used to administer these uses. In each of these examples, the truly useful information is not the contact information for the domain name registrant in question, it is the name server information for the name in question. Unfortunately, neither is reliable or truly useful in any real way because authoritative information about DNS resources doesn’t live in a gTLD database, it lives inside the DNS itself. The validity of the data in a gTLD Whois database has no impact on the operational integrity of the DNS. Due to this disconnect between these two systems, network systems managers rarely rely on gTLD Whois service when they seek to investigate or resolve serious network operations and technical coordination issues. An entirely different set of tools and resources that relies on authoritative data have evolved that support the requirements of these types of users. For example, a network administrator might use “dig” or “nslookup” to determine the source of a DNS problem or the network location of a mail server being abused to send spam email. All of these tools are publicly available at no charge, internet standards based, and in widespread use. Furthermore, from a network management perspective, not only is the data in the DNS more authoritative (and therefore useful), it is also more comprehensive. A typical DNS record can include information about the network location of any and all web servers, email servers and other resources associated with a specific domain name – at all sub-levels associated with the specific DNS entry (i.e., the second, third and fourth levels of the domain hostname). The gTLD whois service contains none of this important information. When DNS data is used in conjunction with the IP Address Whois data sourced from providers like ARIN or RIPE, a network administrator is able to form a fully authoritative view of not only the services associated with a specific domain name, but also the identity of the entity that physically hosts those resources and how to contact that entity. All of this data exists outside the gTLD Whois system. II) ICANN’s Role The scope and authority of ICANN’s policy-making responsibilities is limited by its bylaws; The mission of The Internet Corporation for Assigned Names and Numbers ("ICANN") is to coordinate, at the overall level, the global Internet's systems of unique identifiers, and in particular to ensure the stable and secure operation of the Internet's unique identifier systems. In particular, ICANN: 1. Coordinates the allocation and assignment of the three sets of unique identifiers for the Internet, which are: a. Domain names (forming a system referred to as "DNS"); b. Internet protocol ("IP") addresses and autonomous system ("AS") numbers; and c. Protocol port and parameter numbers. 2. Coordinates the operation and evolution of the DNS root name server system. 3. Coordinates policy development reasonably and appropriately related to these technical functions. ICANN’s role is primarily that of a technical coordinator and developer of policy to support that coordination. III) ICANN’s Scope There are many other uses of gTLD Whois - most or all of which have been documented by the GNSO Whois Task Force . Creating policy to manage, influence, prevent or encourage most of this use is out of scope for ICANN. IV) Technical coordination in the real world Most technical coordination of DNS administration, abuse and network management issues occurs without ICANN’s involvement. Private sector coordination is more likely through CERT, NANOG, Reg-OPS and other forums, than those operated by ICANN. These initiatives are often ad hoc and key players do often not understand the importance and value of participation. This is an area where small improvements in the overall level of cooperation between the various initiatives would lead to substantial improvement in the overall security of the internet and DNS infrastructure. POLICY IMPLICATIONS Given that the original beneficiaries of the gTLD Whois service have developed superior alternate methods of coordinating their activities, and that the remaining uses of this service are out of scope relative to ICANN’s scope and mission, and that the abuse of this data has caused a significant barrier to the security of millions of Internet users, we propose the following; 1) that ICANN waive all Whois publication requirements for gTLD registries and registrars; a. If the Whois publication requirements cannot be waived for the registries and registrar, then registrars should be limited to only publishing contact information for the person or entity responsible for managing the authoritative DNS server; 2) that ICANN immediately undertake to create a study of where it might best contribute to coordinating the network management activities of registration interests, network operators and service providers and law enforcement agencies. This should be done with the goal of ensuring that emergency response and technical abuse prevention is well coordinated and the overall interests of internet users are appropriately protected by a secure and functional domain name system. 3) That ICANN undertake to develop a statement of best practices that registration interests should apply when working with law enforcement interests, network operators and other legitimate parties concerned with public safety, legislative enforcement, network management and abuse, and the protection of critical information technology infrastructure.