Examples and a note
Hello everyone, You have asked us for examples of the potential impact of Associated Domain Checks (ADC) on domain name registrants. We are providing two examples below.One is about investigation scope and another is about surveillance and data protection. . Before doing so, however, I want to make one point clear. Examples involving real people and real-world contexts will always be imperfect. They can be dismissed as unlikely, as “not how we work,” or as edge cases. But that is exactly why risk analysis and safeguards are necessary. Our society should not assess the legitimacy of a mechanism only by how it treats ordinary or low-risk cases. It should also consider how the mechanism affects vulnerable communities, politically sensitive users, minority groups, and others who are more likely to experience harm. You can read this incredible report by Afsaneh Rigot <https://www.belfercenter.org/sites/default/files/pantheon_files/files/publication/TAPP-Afsaneh_Design%20From%20the%20Margins_Final_220514.pdf>on how to design and govern from the margins across digital products and services. Another point is, the distinction between malicious and compromised domains is not, by itself, a sufficient safeguard. Nor is it enough to say that investigation is not mitigation, or that an ADC will not necessarily lead to suspension. It can lead to suspension and we need to have safeguards in place and remedy for when things go wrong. The safeguards we are proposing are simple: investigations should be proportionate, their scope should be narrow and tied to the context, and there should be a meaningful remedy when things go wrong. We cannot predict every potential harm to registrants or end users, but we can design processes that reduce foreseeable risks. *Example 1: 2019 Hong Kong Protests* In 2019, protesters in Hong Kong took to the streets in response to a controversial government bill, leading to the largest series of demonstrations in the city’s history. Hong Kong police arrested hundreds of people, including prominent activists. During this period, protesters relied on apps that helped them track police locations. Some of those apps were later removed from Apple’s App Store, cutting off a critical channel of access. This created demand for alternative distribution channels, including proxy registrations or mirror domains that could help users access tools no longer available through traditional app stores. In contexts of political unrest, messaging apps such as Telegram can become critical tools for coordination and access to information. At the same time, these moments can create opportunities for malicious actors to register domains impersonating services like Telegram, for example “ telegram-login.app,” in order to conduct targeted phishing or distribute malware. A well-evidenced report about an impersonating domain, timed to coincide with a period of protest or heightened repression, can be a valid contextual indicator for triggering an ADC. The timing, target, and surrounding circumstances may reveal something that the domain name alone cannot. However, a registrant or reseller may also have a history of registering domains on behalf of others in their community, including people who lack access to financial institutions, whose prepaid cards are not accepted by registrars, or who face legal or political risk if they register a domain directly. In the Hong Kong context, this might include mirror or access-support domains such as “protest-hongkong.app” or “ wherearethepolice-hongkong.app,” intended to help protesters access apps or information no longer available through official channels. If an ADC is triggered and the investigation sweeps across the registrant’s entire portfolio, those domains become visible to the registrar. That creates a serious problem. Once the registrar has knowledge of those domains, it may lose plausible deniability. Depending on the jurisdiction, that knowledge may create legal obligations to act or expose the registrar to political pressure from governments or other actors seeking to have those domains suspended. The investigation itself may therefore generate liability that would not otherwise have existed and could lead to suspension of those domains. The risk is not only to the registrant or reseller. It can also create risk for the registrar. *Example 2: Reproductive Health Provider * Consider a small web developer or community organization that helps several local groups register and maintain domain names. Some of these groups may not have the technical capacity to manage their own registrations. Others may lack access to accepted payment methods. Others may avoid registering directly because the nature of their work creates legal, social, or personal risk. Among the domains managed through this account is a website for a reproductive health provider operating in a legally contested jurisdiction. The provider is lawful, but its work is politically sensitive. The domain is not abusive and has not been reported for DNS abuse. Now assume that a different domain in the same account is reported for phishing. The report is credible. The registrar therefore has a legitimate reason to investigate the reported domain and closely related indicators, such as a distinctive naming pattern, shared malware infrastructure, or repeated registration behavior connected to the abusive activity. The problem arises if the ADC expands beyond those indicators and becomes a broader portfolio review. The registrar may rely only on data already available to it, such as account information, billing records, login history, payment details, registration history, support tickets, reseller identifiers, or nameserver data. But when those data points are combined, they can reveal more than the registrar needed to know for the original abuse investigation. For example, the ADC may show that the same account, payment method, or support contact is connected to the reproductive health provider’s domain. It may reveal that the provider relies on a particular community organization, web developer, or intermediary. It may also expose other domains connected to the same network, such as legal aid, counseling, travel support, medication information, or patient-resource websites. None of these domains were the subject of the abuse report. Yet the ADC has now linked them together in an investigative context. This creates a data protection problem even if the registrar takes no mitigation action. The harm is not limited to suspension. The harm may occur through excessive processing, linkage, inference, and retention. Data collected for registration, billing, account security, or customer support has been repurposed into an investigative graph. That graph can reveal relationships among unrelated domains, expose sensitive activity, and create new knowledge that did not need to be generated to address the original phishing report. The argument that the registrar is using only “available data” does not resolve the issue. Availability is not the same as necessity or proportionality. A registrar may possess data for operational reasons, but that does not automatically justify using it to examine unrelated domains or infer relationships among registrants. The relevant question is whether each category of data used in the ADC is necessary, relevant, and proportionate to the specific abuse indicators that triggered the investigation. *NCSG Position and Recommendations* The NCSG is not arguing that an ADC triggered by a single reported instance of DNS abuse is always disproportionate. A domain mimicking a popular communications platform like Telegram during a period of protest could signal a systematic effort to target a specific population, and that may be a valid contextual indicator. The context of reported abuse must always be carefully analyzed. What the NCSG emphasizes is that proportionality applies not only to the decision to trigger an ADC, but also to how the ADC is conducted. First, ADC investigations should be contextual. The triggering evidence should be assessed against the broader circumstances, including the nature of the abuse, the target, the timing, and the surrounding political or social context. Second, ADC investigations should be narrow. The scope should be limited to the specific patterns, keywords, registration characteristics, or other indicators associated with the malicious domain. It should not become a general audit of the registrant’s broader portfolio. I also want to address directly the argument that a broad sweep is acceptable as long as the registrar carefully distinguishes between malicious and compromised domains, or that harm only arises if the investigation leads to suspension. Harm can occur at the point of investigation, not only at the point of mitigation. A registrar that conducts a wide sweep and acquires knowledge of sensitive domains may already have created legal and political exposure for itself and potential harm for the registrant, regardless of whether any domains are ultimately suspended. Limiting mitigation does not undo the consequences of an overbroad investigation. This is why scope limitation must be built into the investigation itself, there should be remedy and there should be safeguards in place. Best regards, Farzaneh
Hi Farzi, Thank you very much for providing specific examples to work through! These are very helpful to understand what you’ve been concerned about beyond the potential suspension of domains. Here are my takeaways in trying to boil this down to a concise listing of potential harms. Can you please let me know if I’m getting these right from your perspective? I don’t want to comment on the merits of these concerns one way or another without first knowing that we’re talking about the same thing. Issue 1: Registrar becomes aware of an association between domains that they were ignorant of previously based on an ADC. Potential harms: Registrar may have to report such findings to a governmental authority that could take adverse action against a registrant. Registrar may have to report such findings to a governmental authority that could take adverse action against an infrastructure provider. Registrar may be subject to sanctions by a governmental authority. Registrar may decide to end its relationship with a registrant due to its own policies or viewpoints. Issue 2: Registrar retains a record of an association between domains based on an ADC. Potential harms: Information is legally discoverable which may lead to a governmental authority taking adverse action against a registrant. Information is legally discoverable which may lead to a governmental authority taking adverse action against an infrastructure provider. Information is legally discoverable which may lead to a registrar being subject to sanctions by a governmental authority. Thanks, Rod
On May 23, 2026, at 8:15 AM, farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> wrote:
Hello everyone,
You have asked us for examples of the potential impact of Associated Domain Checks (ADC) on domain name registrants. We are providing two examples below.One is about investigation scope and another is about surveillance and data protection.
. Before doing so, however, I want to make one point clear.
Examples involving real people and real-world contexts will always be imperfect. They can be dismissed as unlikely, as “not how we work,” or as edge cases. But that is exactly why risk analysis and safeguards are necessary. Our society should not assess the legitimacy of a mechanism only by how it treats ordinary or low-risk cases. It should also consider how the mechanism affects vulnerable communities, politically sensitive users, minority groups, and others who are more likely to experience harm. You can read this incredible report by Afsaneh Rigot <https://www.belfercenter.org/sites/default/files/pantheon_files/files/publication/TAPP-Afsaneh_Design%20From%20the%20Margins_Final_220514.pdf>on how to design and govern from the margins across digital products and services.
Another point is, the distinction between malicious and compromised domains is not, by itself, a sufficient safeguard. Nor is it enough to say that investigation is not mitigation, or that an ADC will not necessarily lead to suspension. It can lead to suspension and we need to have safeguards in place and remedy for when things go wrong. The safeguards we are proposing are simple: investigations should be proportionate, their scope should be narrow and tied to the context, and there should be a meaningful remedy when things go wrong. We cannot predict every potential harm to registrants or end users, but we can design processes that reduce foreseeable risks.
Example 1: 2019 Hong Kong Protests
In 2019, protesters in Hong Kong took to the streets in response to a controversial government bill, leading to the largest series of demonstrations in the city’s history. Hong Kong police arrested hundreds of people, including prominent activists. During this period, protesters relied on apps that helped them track police locations. Some of those apps were later removed from Apple’s App Store, cutting off a critical channel of access. This created demand for alternative distribution channels, including proxy registrations or mirror domains that could help users access tools no longer available through traditional app stores.
In contexts of political unrest, messaging apps such as Telegram can become critical tools for coordination and access to information. At the same time, these moments can create opportunities for malicious actors to register domains impersonating services like Telegram, for example “telegram-login.app <http://telegram-login.app/>,” in order to conduct targeted phishing or distribute malware. A well-evidenced report about an impersonating domain, timed to coincide with a period of protest or heightened repression, can be a valid contextual indicator for triggering an ADC. The timing, target, and surrounding circumstances may reveal something that the domain name alone cannot.
However, a registrant or reseller may also have a history of registering domains on behalf of others in their community, including people who lack access to financial institutions, whose prepaid cards are not accepted by registrars, or who face legal or political risk if they register a domain directly. In the Hong Kong context, this might include mirror or access-support domains such as “protest-hongkong.app <http://protest-hongkong.app/>” or “wherearethepolice-hongkong.app <http://wherearethepolice-hongkong.app/>,” intended to help protesters access apps or information no longer available through official channels.
If an ADC is triggered and the investigation sweeps across the registrant’s entire portfolio, those domains become visible to the registrar. That creates a serious problem. Once the registrar has knowledge of those domains, it may lose plausible deniability. Depending on the jurisdiction, that knowledge may create legal obligations to act or expose the registrar to political pressure from governments or other actors seeking to have those domains suspended. The investigation itself may therefore generate liability that would not otherwise have existed and could lead to suspension of those domains. The risk is not only to the registrant or reseller. It can also create risk for the registrar.
Example 2: Reproductive Health Provider
Consider a small web developer or community organization that helps several local groups register and maintain domain names. Some of these groups may not have the technical capacity to manage their own registrations. Others may lack access to accepted payment methods. Others may avoid registering directly because the nature of their work creates legal, social, or personal risk.
Among the domains managed through this account is a website for a reproductive health provider operating in a legally contested jurisdiction. The provider is lawful, but its work is politically sensitive. The domain is not abusive and has not been reported for DNS abuse.
Now assume that a different domain in the same account is reported for phishing. The report is credible. The registrar therefore has a legitimate reason to investigate the reported domain and closely related indicators, such as a distinctive naming pattern, shared malware infrastructure, or repeated registration behavior connected to the abusive activity.
The problem arises if the ADC expands beyond those indicators and becomes a broader portfolio review. The registrar may rely only on data already available to it, such as account information, billing records, login history, payment details, registration history, support tickets, reseller identifiers, or nameserver data. But when those data points are combined, they can reveal more than the registrar needed to know for the original abuse investigation.
For example, the ADC may show that the same account, payment method, or support contact is connected to the reproductive health provider’s domain. It may reveal that the provider relies on a particular community organization, web developer, or intermediary. It may also expose other domains connected to the same network, such as legal aid, counseling, travel support, medication information, or patient-resource websites. None of these domains were the subject of the abuse report. Yet the ADC has now linked them together in an investigative context.
This creates a data protection problem even if the registrar takes no mitigation action. The harm is not limited to suspension. The harm may occur through excessive processing, linkage, inference, and retention. Data collected for registration, billing, account security, or customer support has been repurposed into an investigative graph. That graph can reveal relationships among unrelated domains, expose sensitive activity, and create new knowledge that did not need to be generated to address the original phishing report.
The argument that the registrar is using only “available data” does not resolve the issue. Availability is not the same as necessity or proportionality. A registrar may possess data for operational reasons, but that does not automatically justify using it to examine unrelated domains or infer relationships among registrants. The relevant question is whether each category of data used in the ADC is necessary, relevant, and proportionate to the specific abuse indicators that triggered the investigation.
NCSG Position and Recommendations
The NCSG is not arguing that an ADC triggered by a single reported instance of DNS abuse is always disproportionate. A domain mimicking a popular communications platform like Telegram during a period of protest could signal a systematic effort to target a specific population, and that may be a valid contextual indicator. The context of reported abuse must always be carefully analyzed.
What the NCSG emphasizes is that proportionality applies not only to the decision to trigger an ADC, but also to how the ADC is conducted.
First, ADC investigations should be contextual. The triggering evidence should be assessed against the broader circumstances, including the nature of the abuse, the target, the timing, and the surrounding political or social context.
Second, ADC investigations should be narrow. The scope should be limited to the specific patterns, keywords, registration characteristics, or other indicators associated with the malicious domain. It should not become a general audit of the registrant’s broader portfolio.
I also want to address directly the argument that a broad sweep is acceptable as long as the registrar carefully distinguishes between malicious and compromised domains, or that harm only arises if the investigation leads to suspension. Harm can occur at the point of investigation, not only at the point of mitigation. A registrar that conducts a wide sweep and acquires knowledge of sensitive domains may already have created legal and political exposure for itself and potential harm for the registrant, regardless of whether any domains are ultimately suspended. Limiting mitigation does not undo the consequences of an overbroad investigation. This is why scope limitation must be built into the investigation itself, there should be remedy and there should be safeguards in place.
Best regards,
Farzaneh _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
Building on Rod’s comments… We need keep at top of mind the point that step 1 is a finding of evidence of DNS Abuse. And once there is credible evidence of DNS Abuse then an ADC should follow. And that is an ADC on domains registered to an entity that is already known to be involved in DNS Abuse based on credible evidence. Yes it is possible that a registrar on doing an ADC will discover no more DNS Abuse. Yes it is possible that a registrar on doing an ADC will discover more names involved in DNS Abuse. It's also possible that a registrar might discover abuse or criminality that is not DNS Abuse and if they do, then what they must do next is governed by the laws under which they operate. That's just a fact. It doesn't matter whether what they discover is legal in some jurisdictions if it is illegal in their jurisdiction. Cheers, CD Chris Disspain Senior Advisor on Policy and Internet Governance 
On 26 May 2026, at 15:12, Rod Rasmussen via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> wrote:
Hi Farzi,
Thank you very much for providing specific examples to work through! These are very helpful to understand what you’ve been concerned about beyond the potential suspension of domains.
Here are my takeaways in trying to boil this down to a concise listing of potential harms. Can you please let me know if I’m getting these right from your perspective? I don’t want to comment on the merits of these concerns one way or another without first knowing that we’re talking about the same thing.
Issue 1: Registrar becomes aware of an association between domains that they were ignorant of previously based on an ADC. Potential harms: Registrar may have to report such findings to a governmental authority that could take adverse action against a registrant. Registrar may have to report such findings to a governmental authority that could take adverse action against an infrastructure provider. Registrar may be subject to sanctions by a governmental authority. Registrar may decide to end its relationship with a registrant due to its own policies or viewpoints.
Issue 2: Registrar retains a record of an association between domains based on an ADC. Potential harms: Information is legally discoverable which may lead to a governmental authority taking adverse action against a registrant. Information is legally discoverable which may lead to a governmental authority taking adverse action against an infrastructure provider. Information is legally discoverable which may lead to a registrar being subject to sanctions by a governmental authority.
Thanks,
Rod
On May 23, 2026, at 8:15 AM, farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> wrote:
Hello everyone,
You have asked us for examples of the potential impact of Associated Domain Checks (ADC) on domain name registrants. We are providing two examples below.One is about investigation scope and another is about surveillance and data protection.
. Before doing so, however, I want to make one point clear.
Examples involving real people and real-world contexts will always be imperfect. They can be dismissed as unlikely, as “not how we work,” or as edge cases. But that is exactly why risk analysis and safeguards are necessary. Our society should not assess the legitimacy of a mechanism only by how it treats ordinary or low-risk cases. It should also consider how the mechanism affects vulnerable communities, politically sensitive users, minority groups, and others who are more likely to experience harm. You can read this incredible report by Afsaneh Rigot <https://www.belfercenter.org/sites/default/files/pantheon_files/files/publication/TAPP-Afsaneh_Design%20From%20the%20Margins_Final_220514.pdf>on how to design and govern from the margins across digital products and services.
Another point is, the distinction between malicious and compromised domains is not, by itself, a sufficient safeguard. Nor is it enough to say that investigation is not mitigation, or that an ADC will not necessarily lead to suspension. It can lead to suspension and we need to have safeguards in place and remedy for when things go wrong. The safeguards we are proposing are simple: investigations should be proportionate, their scope should be narrow and tied to the context, and there should be a meaningful remedy when things go wrong. We cannot predict every potential harm to registrants or end users, but we can design processes that reduce foreseeable risks.
Example 1: 2019 Hong Kong Protests
In 2019, protesters in Hong Kong took to the streets in response to a controversial government bill, leading to the largest series of demonstrations in the city’s history. Hong Kong police arrested hundreds of people, including prominent activists. During this period, protesters relied on apps that helped them track police locations. Some of those apps were later removed from Apple’s App Store, cutting off a critical channel of access. This created demand for alternative distribution channels, including proxy registrations or mirror domains that could help users access tools no longer available through traditional app stores.
In contexts of political unrest, messaging apps such as Telegram can become critical tools for coordination and access to information. At the same time, these moments can create opportunities for malicious actors to register domains impersonating services like Telegram, for example “telegram-login.app <http://telegram-login.app/>,” in order to conduct targeted phishing or distribute malware. A well-evidenced report about an impersonating domain, timed to coincide with a period of protest or heightened repression, can be a valid contextual indicator for triggering an ADC. The timing, target, and surrounding circumstances may reveal something that the domain name alone cannot.
However, a registrant or reseller may also have a history of registering domains on behalf of others in their community, including people who lack access to financial institutions, whose prepaid cards are not accepted by registrars, or who face legal or political risk if they register a domain directly. In the Hong Kong context, this might include mirror or access-support domains such as “protest-hongkong.app <http://protest-hongkong.app/>” or “wherearethepolice-hongkong.app <http://wherearethepolice-hongkong.app/>,” intended to help protesters access apps or information no longer available through official channels.
If an ADC is triggered and the investigation sweeps across the registrant’s entire portfolio, those domains become visible to the registrar. That creates a serious problem. Once the registrar has knowledge of those domains, it may lose plausible deniability. Depending on the jurisdiction, that knowledge may create legal obligations to act or expose the registrar to political pressure from governments or other actors seeking to have those domains suspended. The investigation itself may therefore generate liability that would not otherwise have existed and could lead to suspension of those domains. The risk is not only to the registrant or reseller. It can also create risk for the registrar.
Example 2: Reproductive Health Provider
Consider a small web developer or community organization that helps several local groups register and maintain domain names. Some of these groups may not have the technical capacity to manage their own registrations. Others may lack access to accepted payment methods. Others may avoid registering directly because the nature of their work creates legal, social, or personal risk.
Among the domains managed through this account is a website for a reproductive health provider operating in a legally contested jurisdiction. The provider is lawful, but its work is politically sensitive. The domain is not abusive and has not been reported for DNS abuse.
Now assume that a different domain in the same account is reported for phishing. The report is credible. The registrar therefore has a legitimate reason to investigate the reported domain and closely related indicators, such as a distinctive naming pattern, shared malware infrastructure, or repeated registration behavior connected to the abusive activity.
The problem arises if the ADC expands beyond those indicators and becomes a broader portfolio review. The registrar may rely only on data already available to it, such as account information, billing records, login history, payment details, registration history, support tickets, reseller identifiers, or nameserver data. But when those data points are combined, they can reveal more than the registrar needed to know for the original abuse investigation.
For example, the ADC may show that the same account, payment method, or support contact is connected to the reproductive health provider’s domain. It may reveal that the provider relies on a particular community organization, web developer, or intermediary. It may also expose other domains connected to the same network, such as legal aid, counseling, travel support, medication information, or patient-resource websites. None of these domains were the subject of the abuse report. Yet the ADC has now linked them together in an investigative context.
This creates a data protection problem even if the registrar takes no mitigation action. The harm is not limited to suspension. The harm may occur through excessive processing, linkage, inference, and retention. Data collected for registration, billing, account security, or customer support has been repurposed into an investigative graph. That graph can reveal relationships among unrelated domains, expose sensitive activity, and create new knowledge that did not need to be generated to address the original phishing report.
The argument that the registrar is using only “available data” does not resolve the issue. Availability is not the same as necessity or proportionality. A registrar may possess data for operational reasons, but that does not automatically justify using it to examine unrelated domains or infer relationships among registrants. The relevant question is whether each category of data used in the ADC is necessary, relevant, and proportionate to the specific abuse indicators that triggered the investigation.
NCSG Position and Recommendations
The NCSG is not arguing that an ADC triggered by a single reported instance of DNS abuse is always disproportionate. A domain mimicking a popular communications platform like Telegram during a period of protest could signal a systematic effort to target a specific population, and that may be a valid contextual indicator. The context of reported abuse must always be carefully analyzed.
What the NCSG emphasizes is that proportionality applies not only to the decision to trigger an ADC, but also to how the ADC is conducted.
First, ADC investigations should be contextual. The triggering evidence should be assessed against the broader circumstances, including the nature of the abuse, the target, the timing, and the surrounding political or social context.
Second, ADC investigations should be narrow. The scope should be limited to the specific patterns, keywords, registration characteristics, or other indicators associated with the malicious domain. It should not become a general audit of the registrant’s broader portfolio.
I also want to address directly the argument that a broad sweep is acceptable as long as the registrar carefully distinguishes between malicious and compromised domains, or that harm only arises if the investigation leads to suspension. Harm can occur at the point of investigation, not only at the point of mitigation. A registrar that conducts a wide sweep and acquires knowledge of sensitive domains may already have created legal and political exposure for itself and potential harm for the registrant, regardless of whether any domains are ultimately suspended. Limiting mitigation does not undo the consequences of an overbroad investigation. This is why scope limitation must be built into the investigation itself, there should be remedy and there should be safeguards in place.
Best regards,
Farzaneh _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
_______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
Chris: Appreciate and agree with this framing. Farzaneh: Appreciate your proposed path articulated at the end of today’s call, in which I heard you to suggest that ICANN Compliance’s advisory document might address NCSG concerns via providing guidance for registrants if/when inappropriate mitigative action is taken. We would be supportive of such messaging in the advisory. Additionally, as we’ve previously signaled, we would be interested in a more robust “remedy” conversation as its own topic. From: Chris Disspain via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org> Sent: Tuesday, May 26, 2026 9:43 AM To: Rod Rasmussen <rod@rodrasmussen.com> Cc: farzaneh badii <farzaneh.badii@gmail.com>; gnso-dnsabuse-pdp@icann.org Subject: [EXTERNAL EMAIL] - [Gnso-dnsabuse-pdp] Re: Examples and a note Building on Rod’s comments… We need keep at top of mind the point that step 1 is a finding of evidence of DNS Abuse. And once there is credible evidence of DNS Abuse then an ADC should follow. And that is an ADC on domains registered to an entity that is already known to be involved in DNS Abuse based on credible evidence. Yes it is possible that a registrar on doing an ADC will discover no more DNS Abuse. Yes it is possible that a registrar on doing an ADC will discover more names involved in DNS Abuse. It's also possible that a registrar might discover abuse or criminality that is not DNS Abuse and if they do, then what they must do next is governed by the laws under which they operate. That's just a fact. It doesn't matter whether what they discover is legal in some jurisdictions if it is illegal in their jurisdiction. Cheers, CD Chris Disspain Senior Advisor on Policy and Internet Governance [cid:image001.jpg@01DCED09.3376E230] On 26 May 2026, at 15:12, Rod Rasmussen via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org>> wrote: Hi Farzi, Thank you very much for providing specific examples to work through! These are very helpful to understand what you’ve been concerned about beyond the potential suspension of domains. Here are my takeaways in trying to boil this down to a concise listing of potential harms. Can you please let me know if I’m getting these right from your perspective? I don’t want to comment on the merits of these concerns one way or another without first knowing that we’re talking about the same thing. Issue 1: Registrar becomes aware of an association between domains that they were ignorant of previously based on an ADC. Potential harms: Registrar may have to report such findings to a governmental authority that could take adverse action against a registrant. Registrar may have to report such findings to a governmental authority that could take adverse action against an infrastructure provider. Registrar may be subject to sanctions by a governmental authority. Registrar may decide to end its relationship with a registrant due to its own policies or viewpoints. Issue 2: Registrar retains a record of an association between domains based on an ADC. Potential harms: Information is legally discoverable which may lead to a governmental authority taking adverse action against a registrant. Information is legally discoverable which may lead to a governmental authority taking adverse action against an infrastructure provider. Information is legally discoverable which may lead to a registrar being subject to sanctions by a governmental authority. Thanks, Rod On May 23, 2026, at 8:15 AM, farzaneh badii via Gnso-dnsabuse-pdp <gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org>> wrote: Hello everyone, You have asked us for examples of the potential impact of Associated Domain Checks (ADC) on domain name registrants. We are providing two examples below.One is about investigation scope and another is about surveillance and data protection. . Before doing so, however, I want to make one point clear. Examples involving real people and real-world contexts will always be imperfect. They can be dismissed as unlikely, as “not how we work,” or as edge cases. But that is exactly why risk analysis and safeguards are necessary. Our society should not assess the legitimacy of a mechanism only by how it treats ordinary or low-risk cases. It should also consider how the mechanism affects vulnerable communities, politically sensitive users, minority groups, and others who are more likely to experience harm. You can read this incredible report by Afsaneh Rigot <https://www.belfercenter.org/sites/default/files/pantheon_files/files/public...> on how to design and govern from the margins across digital products and services. Another point is, the distinction between malicious and compromised domains is not, by itself, a sufficient safeguard. Nor is it enough to say that investigation is not mitigation, or that an ADC will not necessarily lead to suspension. It can lead to suspension and we need to have safeguards in place and remedy for when things go wrong. The safeguards we are proposing are simple: investigations should be proportionate, their scope should be narrow and tied to the context, and there should be a meaningful remedy when things go wrong. We cannot predict every potential harm to registrants or end users, but we can design processes that reduce foreseeable risks. Example 1: 2019 Hong Kong Protests In 2019, protesters in Hong Kong took to the streets in response to a controversial government bill, leading to the largest series of demonstrations in the city’s history. Hong Kong police arrested hundreds of people, including prominent activists. During this period, protesters relied on apps that helped them track police locations. Some of those apps were later removed from Apple’s App Store, cutting off a critical channel of access. This created demand for alternative distribution channels, including proxy registrations or mirror domains that could help users access tools no longer available through traditional app stores. In contexts of political unrest, messaging apps such as Telegram can become critical tools for coordination and access to information. At the same time, these moments can create opportunities for malicious actors to register domains impersonating services like Telegram, for example “telegram-login.app<http://telegram-login.app/>,” in order to conduct targeted phishing or distribute malware. A well-evidenced report about an impersonating domain, timed to coincide with a period of protest or heightened repression, can be a valid contextual indicator for triggering an ADC. The timing, target, and surrounding circumstances may reveal something that the domain name alone cannot. However, a registrant or reseller may also have a history of registering domains on behalf of others in their community, including people who lack access to financial institutions, whose prepaid cards are not accepted by registrars, or who face legal or political risk if they register a domain directly. In the Hong Kong context, this might include mirror or access-support domains such as “protest-hongkong.app<http://protest-hongkong.app/>” or “wherearethepolice-hongkong.app<http://wherearethepolice-hongkong.app/>,” intended to help protesters access apps or information no longer available through official channels. If an ADC is triggered and the investigation sweeps across the registrant’s entire portfolio, those domains become visible to the registrar. That creates a serious problem. Once the registrar has knowledge of those domains, it may lose plausible deniability. Depending on the jurisdiction, that knowledge may create legal obligations to act or expose the registrar to political pressure from governments or other actors seeking to have those domains suspended. The investigation itself may therefore generate liability that would not otherwise have existed and could lead to suspension of those domains. The risk is not only to the registrant or reseller. It can also create risk for the registrar. Example 2: Reproductive Health Provider Consider a small web developer or community organization that helps several local groups register and maintain domain names. Some of these groups may not have the technical capacity to manage their own registrations. Others may lack access to accepted payment methods. Others may avoid registering directly because the nature of their work creates legal, social, or personal risk. Among the domains managed through this account is a website for a reproductive health provider operating in a legally contested jurisdiction. The provider is lawful, but its work is politically sensitive. The domain is not abusive and has not been reported for DNS abuse. Now assume that a different domain in the same account is reported for phishing. The report is credible. The registrar therefore has a legitimate reason to investigate the reported domain and closely related indicators, such as a distinctive naming pattern, shared malware infrastructure, or repeated registration behavior connected to the abusive activity. The problem arises if the ADC expands beyond those indicators and becomes a broader portfolio review. The registrar may rely only on data already available to it, such as account information, billing records, login history, payment details, registration history, support tickets, reseller identifiers, or nameserver data. But when those data points are combined, they can reveal more than the registrar needed to know for the original abuse investigation. For example, the ADC may show that the same account, payment method, or support contact is connected to the reproductive health provider’s domain. It may reveal that the provider relies on a particular community organization, web developer, or intermediary. It may also expose other domains connected to the same network, such as legal aid, counseling, travel support, medication information, or patient-resource websites. None of these domains were the subject of the abuse report. Yet the ADC has now linked them together in an investigative context. This creates a data protection problem even if the registrar takes no mitigation action. The harm is not limited to suspension. The harm may occur through excessive processing, linkage, inference, and retention. Data collected for registration, billing, account security, or customer support has been repurposed into an investigative graph. That graph can reveal relationships among unrelated domains, expose sensitive activity, and create new knowledge that did not need to be generated to address the original phishing report. The argument that the registrar is using only “available data” does not resolve the issue. Availability is not the same as necessity or proportionality. A registrar may possess data for operational reasons, but that does not automatically justify using it to examine unrelated domains or infer relationships among registrants. The relevant question is whether each category of data used in the ADC is necessary, relevant, and proportionate to the specific abuse indicators that triggered the investigation. NCSG Position and Recommendations The NCSG is not arguing that an ADC triggered by a single reported instance of DNS abuse is always disproportionate. A domain mimicking a popular communications platform like Telegram during a period of protest could signal a systematic effort to target a specific population, and that may be a valid contextual indicator. The context of reported abuse must always be carefully analyzed. What the NCSG emphasizes is that proportionality applies not only to the decision to trigger an ADC, but also to how the ADC is conducted. First, ADC investigations should be contextual. The triggering evidence should be assessed against the broader circumstances, including the nature of the abuse, the target, the timing, and the surrounding political or social context. Second, ADC investigations should be narrow. The scope should be limited to the specific patterns, keywords, registration characteristics, or other indicators associated with the malicious domain. It should not become a general audit of the registrant’s broader portfolio. I also want to address directly the argument that a broad sweep is acceptable as long as the registrar carefully distinguishes between malicious and compromised domains, or that harm only arises if the investigation leads to suspension. Harm can occur at the point of investigation, not only at the point of mitigation. A registrar that conducts a wide sweep and acquires knowledge of sensitive domains may already have created legal and political exposure for itself and potential harm for the registrant, regardless of whether any domains are ultimately suspended. Limiting mitigation does not undo the consequences of an overbroad investigation. This is why scope limitation must be built into the investigation itself, there should be remedy and there should be safeguards in place. Best regards, Farzaneh _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org> To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org<mailto:gnso-dnsabuse-pdp-leave@icann.org> _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org<mailto:gnso-dnsabuse-pdp@icann.org> To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org<mailto:gnso-dnsabuse-pdp-leave@icann.org>
Hi Rod, Gabriel, and Chris, Hi Rod, Thank you for your feedback. You have correctly captured several of the key implications and potential harms we are concerned about regarding Associated Domain Checks (ADC). But I also don't want to limit us to these risks. There could be potentially other risks involved that we don't know about. Hi Gabriel and Chris, While the current landscape may have allowed for a more hands-off approach, the fact that we are now developing a policy that obligates registrars to conduct ADCs changes the situation. We cannot simply overlook the political and legal risks this policy creates for both registrars and registrants. As our examples demonstrate, ADC could potentially directly place users in vulnerable positions. Since the policy itself creates these risks, in my opinion, it is our responsibility to ensure that adequate safeguards are considered. And the safeguards don't have to be too extraordinary just that the scope of investigation should be limited. We have mentioned the indicators a number of times. I think we should have a conversation about safeguards and remedies and see what is possible and how it is possible to implement. Best regards, Farzaneh Farzaneh On Tue, May 26, 2026 at 12:43 PM Chris Disspain <chris.disspain@identity.digital> wrote:
Building on Rod’s comments…
We need keep at top of mind the point that step 1 is a finding of evidence of DNS Abuse. And once there is credible evidence of DNS Abuse then an ADC should follow. And that is an ADC on domains registered to an entity that is already known to be involved in DNS Abuse based on credible evidence.
Yes it is possible that a registrar on doing an ADC will discover no more DNS Abuse.
Yes it is possible that a registrar on doing an ADC will discover more names involved in DNS Abuse.
It's also possible that a registrar might discover abuse or criminality that is not DNS Abuse and if they do, then what they must do next is governed by the laws under which they operate. That's just a fact. It doesn't matter whether what they discover is legal in some jurisdictions if it is illegal in their jurisdiction.
Cheers,
CD
Chris Disspain Senior Advisor on Policy and Internet Governance
[image: AIorK4xWevLg7DM8FNJKXERnsV06zXuazaQVoJFTyAE5wjxp9tzIfz3Z3HM-Zvrkyy72U8Iwybs6ZGY.jpeg]
On 26 May 2026, at 15:12, Rod Rasmussen via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> wrote:
Hi Farzi,
Thank you very much for providing specific examples to work through! These are very helpful to understand what you’ve been concerned about beyond the potential suspension of domains.
Here are my takeaways in trying to boil this down to a concise listing of potential harms. Can you please let me know if I’m getting these right from your perspective? I don’t want to comment on the merits of these concerns one way or another without first knowing that we’re talking about the same thing.
Issue 1: Registrar becomes aware of an association between domains that they were ignorant of previously based on an ADC. Potential harms: Registrar may have to report such findings to a governmental authority that could take adverse action against a registrant. Registrar may have to report such findings to a governmental authority that could take adverse action against an infrastructure provider. Registrar may be subject to sanctions by a governmental authority. Registrar may decide to end its relationship with a registrant due to its own policies or viewpoints.
Issue 2: Registrar retains a record of an association between domains based on an ADC. Potential harms: Information is legally discoverable which may lead to a governmental authority taking adverse action against a registrant. Information is legally discoverable which may lead to a governmental authority taking adverse action against an infrastructure provider. Information is legally discoverable which may lead to a registrar being subject to sanctions by a governmental authority.
Thanks,
Rod
On May 23, 2026, at 8:15 AM, farzaneh badii via Gnso-dnsabuse-pdp < gnso-dnsabuse-pdp@icann.org> wrote:
Hello everyone,
You have asked us for examples of the potential impact of Associated Domain Checks (ADC) on domain name registrants. We are providing two examples below.One is about investigation scope and another is about surveillance and data protection.
. Before doing so, however, I want to make one point clear.
Examples involving real people and real-world contexts will always be imperfect. They can be dismissed as unlikely, as “not how we work,” or as edge cases. But that is exactly why risk analysis and safeguards are necessary. Our society should not assess the legitimacy of a mechanism only by how it treats ordinary or low-risk cases. It should also consider how the mechanism affects vulnerable communities, politically sensitive users, minority groups, and others who are more likely to experience harm. You can read this incredible report by Afsaneh Rigot <https://www.belfercenter.org/sites/default/files/pantheon_files/files/publication/TAPP-Afsaneh_Design%20From%20the%20Margins_Final_220514.pdf>on how to design and govern from the margins across digital products and services.
Another point is, the distinction between malicious and compromised domains is not, by itself, a sufficient safeguard. Nor is it enough to say that investigation is not mitigation, or that an ADC will not necessarily lead to suspension. It can lead to suspension and we need to have safeguards in place and remedy for when things go wrong. The safeguards we are proposing are simple: investigations should be proportionate, their scope should be narrow and tied to the context, and there should be a meaningful remedy when things go wrong. We cannot predict every potential harm to registrants or end users, but we can design processes that reduce foreseeable risks.
*Example 1: 2019 Hong Kong Protests*
In 2019, protesters in Hong Kong took to the streets in response to a controversial government bill, leading to the largest series of demonstrations in the city’s history. Hong Kong police arrested hundreds of people, including prominent activists. During this period, protesters relied on apps that helped them track police locations. Some of those apps were later removed from Apple’s App Store, cutting off a critical channel of access. This created demand for alternative distribution channels, including proxy registrations or mirror domains that could help users access tools no longer available through traditional app stores.
In contexts of political unrest, messaging apps such as Telegram can become critical tools for coordination and access to information. At the same time, these moments can create opportunities for malicious actors to register domains impersonating services like Telegram, for example “ telegram-login.app,” in order to conduct targeted phishing or distribute malware. A well-evidenced report about an impersonating domain, timed to coincide with a period of protest or heightened repression, can be a valid contextual indicator for triggering an ADC. The timing, target, and surrounding circumstances may reveal something that the domain name alone cannot.
However, a registrant or reseller may also have a history of registering domains on behalf of others in their community, including people who lack access to financial institutions, whose prepaid cards are not accepted by registrars, or who face legal or political risk if they register a domain directly. In the Hong Kong context, this might include mirror or access-support domains such as “protest-hongkong.app” or “ wherearethepolice-hongkong.app,” intended to help protesters access apps or information no longer available through official channels.
If an ADC is triggered and the investigation sweeps across the registrant’s entire portfolio, those domains become visible to the registrar. That creates a serious problem. Once the registrar has knowledge of those domains, it may lose plausible deniability. Depending on the jurisdiction, that knowledge may create legal obligations to act or expose the registrar to political pressure from governments or other actors seeking to have those domains suspended. The investigation itself may therefore generate liability that would not otherwise have existed and could lead to suspension of those domains. The risk is not only to the registrant or reseller. It can also create risk for the registrar.
*Example 2: Reproductive Health Provider *
Consider a small web developer or community organization that helps several local groups register and maintain domain names. Some of these groups may not have the technical capacity to manage their own registrations. Others may lack access to accepted payment methods. Others may avoid registering directly because the nature of their work creates legal, social, or personal risk.
Among the domains managed through this account is a website for a reproductive health provider operating in a legally contested jurisdiction. The provider is lawful, but its work is politically sensitive. The domain is not abusive and has not been reported for DNS abuse.
Now assume that a different domain in the same account is reported for phishing. The report is credible. The registrar therefore has a legitimate reason to investigate the reported domain and closely related indicators, such as a distinctive naming pattern, shared malware infrastructure, or repeated registration behavior connected to the abusive activity.
The problem arises if the ADC expands beyond those indicators and becomes a broader portfolio review. The registrar may rely only on data already available to it, such as account information, billing records, login history, payment details, registration history, support tickets, reseller identifiers, or nameserver data. But when those data points are combined, they can reveal more than the registrar needed to know for the original abuse investigation.
For example, the ADC may show that the same account, payment method, or support contact is connected to the reproductive health provider’s domain. It may reveal that the provider relies on a particular community organization, web developer, or intermediary. It may also expose other domains connected to the same network, such as legal aid, counseling, travel support, medication information, or patient-resource websites. None of these domains were the subject of the abuse report. Yet the ADC has now linked them together in an investigative context.
This creates a data protection problem even if the registrar takes no mitigation action. The harm is not limited to suspension. The harm may occur through excessive processing, linkage, inference, and retention. Data collected for registration, billing, account security, or customer support has been repurposed into an investigative graph. That graph can reveal relationships among unrelated domains, expose sensitive activity, and create new knowledge that did not need to be generated to address the original phishing report.
The argument that the registrar is using only “available data” does not resolve the issue. Availability is not the same as necessity or proportionality. A registrar may possess data for operational reasons, but that does not automatically justify using it to examine unrelated domains or infer relationships among registrants. The relevant question is whether each category of data used in the ADC is necessary, relevant, and proportionate to the specific abuse indicators that triggered the investigation.
*NCSG Position and Recommendations*
The NCSG is not arguing that an ADC triggered by a single reported instance of DNS abuse is always disproportionate. A domain mimicking a popular communications platform like Telegram during a period of protest could signal a systematic effort to target a specific population, and that may be a valid contextual indicator. The context of reported abuse must always be carefully analyzed.
What the NCSG emphasizes is that proportionality applies not only to the decision to trigger an ADC, but also to how the ADC is conducted.
First, ADC investigations should be contextual. The triggering evidence should be assessed against the broader circumstances, including the nature of the abuse, the target, the timing, and the surrounding political or social context.
Second, ADC investigations should be narrow. The scope should be limited to the specific patterns, keywords, registration characteristics, or other indicators associated with the malicious domain. It should not become a general audit of the registrant’s broader portfolio.
I also want to address directly the argument that a broad sweep is acceptable as long as the registrar carefully distinguishes between malicious and compromised domains, or that harm only arises if the investigation leads to suspension. Harm can occur at the point of investigation, not only at the point of mitigation. A registrar that conducts a wide sweep and acquires knowledge of sensitive domains may already have created legal and political exposure for itself and potential harm for the registrant, regardless of whether any domains are ultimately suspended. Limiting mitigation does not undo the consequences of an overbroad investigation. This is why scope limitation must be built into the investigation itself, there should be remedy and there should be safeguards in place.
Best regards,
Farzaneh _______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
_______________________________________________ Gnso-dnsabuse-pdp mailing list -- gnso-dnsabuse-pdp@icann.org To unsubscribe send an email to gnso-dnsabuse-pdp-leave@icann.org
participants (4)
-
Chris Disspain -
farzaneh badii -
Gabriel Andrews -
Rod Rasmussen