Thank Steve. I would be interested in any data or studies that you have seen that support this proposition:
“It has taken several years to reach this point. In the meantime, those who had made use of the Whois system for legitimate purposes have evolved toward using other methods to meet their needs. An evaluation of the RDRS must include the broader picture in order to understand where the RDRS -- or any other replacement of the Whois system -- will fit in the overall ecosystem. In the extreme, ne could argue that the world has gotten along well enough without any systematic solution for access to non public registration data, so there's no need to do anything. Any attempt to define measures of success will need to address this situation.”
If you have no data or studies, can you just confirm that we are in the zone of your personal opinion? That still carries weight, of course, but this reads as fact claims and I would be very interested in any factual support you may have. I doubt those who have been phished, defrauded, or trafficked think “the world has gotten along well enough” but that is, of course, in the zone of my opinion.
Safe travels,
Paul
I will be in the air headed to Cancún tomorrow during this meeting. I remain very interested and will stay involved, but I cannot attend tomorrow. I will read the transcript as soon as it's available.
My understanding is the board has approved the implementation of the system, now renamed as the Registration Data Request System, but has asked that the criteria and measures of success be defined. My concerns about this system include the following.
- There has been no work toward developing a set of guidelines or agreements on what requests will be honored. The formal stance from ICANN Org is that each registrar will have to make its own determination for each and every request.
It's easy to understand ICANN Org's position: it avoids all liability in case someone objects to particular disclosures. On the other hand, this process doesn't scale well. Both the requesters and the registrars will benefit if there is at least some degree of order and certainty.
We can expect that as requesters and registrars gain experience with this system, they will begin to see patterns that have worked previously. Requesters will tend to tailor their requests to match prior successful queries, and they will likely tend to avoid making requests that are similar to previously failed attempts. Similarly, on the registrar side of this equation, registrars will likely streamline their internal processing to reduce the cost and time of handling requests that are comfortably similar to previously honored requests.
The above scenario can be improved quite a bit if the requesters share information with each other, if the registrars share information with each other, and if the requesters and registrars jointly share information.
Thus, the first improvement to make is to either create or ask the requesters and registrars to create processes for sharing information and developing guidelines or agreements that will streamline the processes on both sides. - The current design of the RDRS does not include APIs to allow the requesters and registrars to automate the interaction between their systems and the RDRS. This is a fundamental error in system design.
- Use of the RDRS is optional for requesters. They will continue to be permitted to make requests directly to registrars. Indeed, some requesters have private arrangements with some registrars. It will be somewhat challenging to assess the success of the RDRS without some understanding of the requests to registrars that are taking place without going through the RDRS.
- Participation in the RDRS is optional for registrars. A similar comment applies regarding determination of the success of the effort.
- It has taken several years to reach this point. In the meantime, those who had made use of the Whois system for legitimate purposes have evolved toward using other methods to meet their needs. An evaluation of the RDRS must include the broader picture in order to understand where the RDRS -- or any other replacement of the Whois system -- will fit in the overall ecosystem. In the extreme, ne could argue that the world has gotten along well enough without any systematic solution for access to non public registration data, so there's no need to do anything. Any attempt to define measures of success will need to address this situation.
I hope these points will be helpful as the small team resumes its interactions.