Re: [Gnso-ppsai-pdp-wg] For review - updated templates Cat B, questions 1 and 2 - Gnso-ppsai-pdp-wg

March 1, 2014

      Morning all, sorry for my lack of participation in the last weeks, been
a bit hectic with things.

Anyhow, I wholly agree with Volker, James, Tim and Holly, not
withstanding the fact that a registrar would provide the Privacy service
to the registrant in the first place (the majority of cases certainly)
doing or investigating further into the details provided won't provide
anything new.

Holly has made a VERY good point, it doesn't matter how many forms of
ID, whether they be "real" or "fake" we will never be able to tell
because we are not given the tools by the corresponding government to
check.  Let alone LEA or local government allowing us to check in the
first place.

John, I am sorry to say, validation and re-validation is totally useless
- let me give you an example, I know my neighbour, I know his age (he
turned 50 last year) and I know his birth date because my wife sorted
out the card (yes, I am totally useless at that) and therefore I know
his address and I know his postal/zip code.  So I know everything now I
need to be able to register a domain, add to that a yahoo.com email
address that simply forwards to another email plus a free SIM that I can
get from ANY mobile provider - and I am in business.

All fully verifiable, I can even check 192.com to make sure he is on the
electoral roll.  So we can continue to verify the same data - not
necessarily the actual person because there is no "significant" and
"personal" piece of information we are allowed to verify, for example,
Passport number / Driving License Number etc etc (you see my point). 
Now even verifying (or being able to verify) those pieces of info is not
cast iron in its own right, just take a rental car and all that
information has to be provided to the rental company for their insurance.

I also remember reading a point in an email today (sorry I forgot which
one and the writer) stating that the email address being valid would be
good as you should get a response (or along the lines of that), this is
incorrect, if someone doesn't want to reply to you, they are not
required too.  Similar as the rubbish the postman puts through the door
goes straight in the bin

Hopefully some of that makes sense :-) 

Kind regards,

Chris

On 01/03/14 04:30, Holly Raiche wrote:
...
Just to add a bit from the Oz perspective.
For a perspective registrant to get a .com.au name, s/he must produce
an ABN (Australian business number).  To get one of those  one has to
walk into one of the corporate regulator's offices, with 2 pieces of
photo ID plus a bit of money.  So when that person then applies for a
.com.au name, the registrar can easily check on the regulator' data
base to match the name, contact details and ABN number with the
applicant's details.  Does that mean the person will not use the ABN
number in committing corporate criminality/fraud - no.  Indeed, does
that mean the person is who they say they are (and have IDs for) - no.
 But it does make it more difficult to get a .com.au name.  It's not
perfect. But it puts a few roadblocks up.  Once those roadblocks have
been overcome, then I agree with Stephanie - once there are reasonable
tests for verification that have been met - in compliance with the
2013 RAA requirements - go after the miscreant.
Holly
On 01/03/2014, at 2:39 PM, Tim Ruiz wrote:
...
So to make your invsetigation of 150 cases easier (which I question
in any event) millions of users are needlessly  hassled. Makes
perfect sense in today's world I guess.
Tim
On Feb 28, 2014, at 5:32 PM, "John Horton"
<john.horton@legitscript.com <mailto:john.horton@legitscript.com>> wrote:
...
Hi all,
Verification and re-verification of registration data would be
enormously useful and important in identifying, mapping and
deterring malfeasance. Just to share our background to put our
comments in context, we've assisted in over 150 drug or supplement
investigations by conducting cybercrime research, and each project
typically involved research into dozens, hundreds or even thousands
of Whois records plus corresponding IP/NS/MX etc. information. There
are numerous instances in which either 1) the accurate Whois data
(including, accurate data behind a Whois privacy/proxy service)
"broke open" the case, or 2) submitting a WDRPS complaint in
instances where we could show that the Whois data was inaccurate
resulted in modified Whois information that then "broke open" the
case, either by virtue of the modified Whois information itself, or
from derivative information (e.g., additional reverse queries on
Whois, name server, IP address or other records). Keep in mind too
that sometimes showing that the Whois record is falsified results in
the suspension of the domain name, which also has the effect of
stopping the harmful use of that particular domain name.
Verification would result in some instances of inaccurate
registration data becoming accurate, or alternatively, of
discontinuing registration services.
In the interests of brevity, I hope that summary is enough
explanation, but if anyone still doesn't understand how (or agree
that) verified registration data -- or by extension, verification
and some sort of periodic re-verification -- is useful, I'm happy to
provide a couple of real life examples of investigations we've
worked on where either the a) accuracy of the Whois record or b)
response to the inaccuracy finding was extremely useful, although
I'll modify the domain names. Again, I'm happy to provide real-life
examples, with redacted information. It's not just occasionally or
mildly useful. It's enormously important.
One additional point: keep in mind that when researching criminal
networks, there are typically multiple (hundreds or even thousands)
of domain names at play, and even if -- as Tim pointed out -- the
verified email and phone number have nothing to do with the person's
real identity, good cybercrime research across the thousands of
Whois records can often result in derivative information pointing to
the real identity of the criminal entities.
As to the point that the domain name isn't harmful but the content
may be, I suspect that there are minds that won't be changed in this
group on both sides of that argument. :) But, I'd point out that
that train has left the station, so to speak: Section 3.18 of the
2013 RAA clearly contemplates harmful use of a domain name.
Thanks,
John Horton
President, LegitScript
*FollowLegitScript*: LinkedIn
<http://www.linkedin.com/company/legitscript-com>  |  Facebook
<https://www.facebook.com/LegitScript>  |  Twitter
<https://twitter.com/legitscript>  |  YouTube
<https://www.youtube.com/user/LegitScript>  |  _Blog
<http://blog.legitscript.com/>_  | Google+
<https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 28, 2014 at 12:36 PM, Tim Ruiz <tim@godaddy.com
<mailto:tim@godaddy.com>> wrote:
It doesn't. I can use perfectly good information, including a
    verifiable phone number and email address, that has nothing to
    do with who I really am. As we have tried to argue before,
    unsuccessfully, is that all verification does is push the
    "miscreants" to be better at obfiscating who they are (and it
    just isn't that hard). As you said, it only results in making it
    difficult for everyone for the acts of a few.
Tim
On Feb 28, 2014, at 2:07 PM, "Stephanie Perrin"
    <stephanie.perrin@mail.utoronto.ca
    <mailto:stephanie.perrin@mail.utoronto.ca>> wrote:
...
My apologies I totally mis-read that. So how does verification
    catch that then?
    On 2014-02-28, at 1:52 PM, John Horton wrote:
...
Well, because absent an accurate Whois record, it can be
    difficult to know who to hold accountable.
Stephanie, to clarify: I was saying that 95% of Whois data in
    a certain sub-category of criminal or miscreant behavior
    (spam, malware, phishing) is _inaccurate_ (not "accurate").
John Horton
    President, LegitScript
*FollowLegitScript*: LinkedIn
    <http://www.linkedin.com/company/legitscript-com>  |  Facebook
    <https://www.facebook.com/LegitScript>  |  Twitter
    <https://twitter.com/legitscript>  |  YouTube
    <https://www.youtube.com/user/LegitScript>  |  _Blog
    <http://blog.legitscript.com/>_  | Google+
    <https://plus.google.com/112436813474708014933/posts>
On Fri, Feb 28, 2014 at 9:44 AM, Stephanie Perrin
    <stephanie.perrin@mail.utoronto.ca
    <mailto:stephanie.perrin@mail.utoronto.ca>> wrote:
I agree, it is all about risk...but what risk are we
        really talking about?   I dont understand why a P/P
        provider should be forced to take on more risk than other
        registrars.  Further,why should the registrar be
        accountable for verified data, once the original data
        verification is done.  If John is correct and in 95% of
        cases the data from the P/P service provider was proven
        accurate, then how does any amount of data verification
        solve the problem?  The accountability for miscreant
        behaviour of all kinds rests with the domain name user.
         IF the data is inaccurate, ramp up the penalties if it
        can be shown that the data was rendered inaccurate for the
        purposes of fraudulent activity.  
        At the risk of sounding overly philosophical, It seems to
        me that the Internet ecosystem is somehow being held to
        account for the actions of individuals.  It is the
        individuals that should be held to account.  Not the
        domain name, or the company that issued it. Particularly,
        I think that if products sold are tainted, then there is
        plenty of other consumer protection law that applies...why
        are we trying to solve that problem?  
        Cheers Stephanie perrin
On 2014-02-28, at 12:29 PM, Carlton Samuels wrote:
...
..which seems to me all about risk management on part of
        the provider.  Its the results that matter.
So, for all the possible permutations, in line with those
        enumerated by Volker, might it not be more useful to
        refer 'verified credentials' as a requirement on the
        provider, allow them to accept the business risk and
        leave it to them to decide how to do it.......and,
        inherently, the risks acceptable to them for provisioning
        the service?
-Carlton
==============================
        Carlton A Samuels
        Mobile: 876-818-1799 <tel:876-818-1799>
        /Strategy, Planning, Governance, Assessment & Turnaround/
        =============================
On Fri, Feb 28, 2014 at 6:29 AM, Volker Greimann
        <vgreimann@key-systems.net
        <mailto:vgreimann@key-systems.net>> wrote:
Hi John,
I am having a bit of a hard time understanding your
            point here.
You are describing three different cases here, two of
            which will not benefit from verification in the least
            bit and one might, but only in some cases:
a) The data is accurate, but stolen: Here
            verification would not uncover any issues with the
            data as it is essentially correct and will most
            likely  be identified as accurate.
            b) The data is false: Here, depending on the methods
            used, the inaccuracy may be uncovered and would lead
            to an automated request to provide updated data or
            deactivation after a set time. Remember, in order to
            keep providing services in a sensible manner, this
            needs to be automated in some form, i.e. no
            individual record would likely see any manual review.
            c) The data is already accurate: If the data is
            already correct, what purpose does verification
            fulfill?  The data cannot become more accurate.
            Verification in this case seems like an exercise in
            self-gratification.
That said, even if there is a benefit to be derived
            from verification, such benefits are achieved once
            verification concludes. Re-verification of already
            verified data fulfills no purpose whatsoever. So if a
            set of data has already been verified by the
            registrar, there is no need for the p/p provider to
            again verify the same data. Only if no verification
            is or can be performed on the registrar level does
            verification by providers come into play.
Volker
Am 28.02.2014 00:32, schrieb John Horton:
>             Thanks, Marika. I also wanted to provide a comment
>             pertaining to Question 2 in the attachments
>             (relating to periodic checks).
>
>             In a few of the recent discussions, there's been
>             some reference to criminals always or nearly always
>             being untruthful in their Whois records (even if
>             privacy-protected), leading to the conclusion that
>             there is little purpose in having a registrar or any
>             third party have to verify or re-verify the
>             information (especially if it is difficult to prove
>             that the data is falsified). I wanted to share our
>             experience and observations on that point, in the
>             hope that it's relevant to future discussion
>             regarding Question 2.
>
>             Our consistent observation has been that when it
>             comes to a particular sub-category of criminal
>             activity, spam, phishing, malware, and so forth,
>             it's probably safe to say that that statement is
>             true -- the registrant's Whois information is nearly
>             always inaccurate. Even in cases, such as some where
>             we've worked with law enforcement, when the Whois
>             record for a domain name involved in spam, phishing
>             or malware is privacy-protected and is subsequently
>             unmasked, the Whois record is still not accurate
>             behind the privacy curtain. There are probably
>             exceptions, but that's what we've seen well over 95%
>             of the time. On occasion, it's a real address and
>             phone number, just not one genuinely connected to
>             the registrant. 
>
>             But there are other types of criminal activity where
>             the Whois record is not so regularly obfuscated. For
>             example, we investigate a lot of websites selling
>             tainted dietary supplements that end up containing
>             some toxin or adulterant that harms people. In those
>             cases, we've overwhelmingly seen that even if the
>             Whois record is privacy-protected, the trend is that
>             the underlying Whois record is accurate. The same
>             has been true for illegal or counterfeit medical
>             device websites that we've researched. On illegal
>             Internet pharmacies not engaged in spam, it's
>             probably 50-50. (It might be a shell corporation,
>             but that's still valuable information.)
>
>             One important point to consider is that the Whois
>             registration can be relevant information from a
>             banking perspective for commercial entities. That
>             is, some banks are going to look at an online
>             merchant's domain name registration record and if
>             it's either inaccurate or protected, they may
>             require disclosure, or ask about any discrepancy,
>             which can be an incentive for criminals selling
>             products online who nevertheless want to get paid
>             via credit card to have an accurate Whois. Hackers,
>             malware providers and spammers will find a way
>             around that, but they don't necessarily constitute
>             "most" criminal activity.
>
>             The point here is, I think verification can still be
>             a useful and necessary tool in either scenario, even
>             if it doesn't uncover useful information a portion
>             of the time. I realize that only pertains to a
>             portion of the issues related to Question 2, but I
>             hope that our observations on that are relevant. 
>
>             Thanks, 
>
>             John Horton
>             President, LegitScript
>              
>
>             *FollowLegitScript*: LinkedIn
>             <http://www.linkedin.com/company/legitscript-com>  |
>              Facebook <https://www.facebook.com/LegitScript>  |
>              Twitter <https://twitter.com/legitscript>  |
>              YouTube <https://www.youtube.com/user/LegitScript> 
>             |  _Blog <http://blog.legitscript.com/>_  | Google+
>             <https://plus.google.com/112436813474708014933/posts>
>
>
>             On Wed, Feb 26, 2014 at 2:39 AM, Marika Konings
>             <marika.konings@icann.org
>             <mailto:marika.konings@icann.org>> wrote:
>
>                 Dear All,
>
>                 Following our call yesterday, please find
>                 attached the updated templates for Category B --
>                 questions 1 & 2. Please review these templates
>                 to make sure the WG discussions have been
>                 accurately reflected and feel free to share any
>                 comments / edits you may have with the mailing
>                 list. We've created a page on the wiki where
>                 we'll post the templates that have been
>                 finalised for now (noting that for some of these
>                 the WG will need to come back to the template at
>                 a later date),
>                 see https://community.icann.org/x/ihLRAg. 
>
>                 The WG will continue its deliberations on
>                 Category B -- Question 2 next week. Some of the
>                 questions that came up during the conversation
>                 yesterday and which you are encouraged to share
>                 your views on (and/or add additional questions
>                 that need to be considered in this context) are:
>
>                   * What would be the arguments for not using
>                     the same standards / requirements for
>                     validation and verification as per the 2013
>                     RAA?
>                   * Should there be a requirement for
>                     re-verification, and if so, what instances
>                     would trigger such re-verification?
>                   * In case of affliction between the P/P
>                     service and the registrar, if the
>                     registration information has already been
>                     verified by the registrar, should this
>                     exempt the P/P provider from doing so?
>                   * Should the same requirements apply to
>                     privacy and proxy services or is there a
>                     reason to distinguish between the two?
>
>                 Best regards,
>
>                 Marika
>
>                 _______________________________________________
>                 Gnso-ppsai-pdp-wg mailing list
>                 Gnso-ppsai-pdp-wg@icann.org
>                 <mailto:Gnso-ppsai-pdp-wg@icann.org>
>                 https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
>
>
>
>
>             _______________________________________________
>             Gnso-ppsai-pdp-wg mailing list
>             Gnso-ppsai-pdp-wg@icann.org <mailto:Gnso-ppsai-pdp-wg@icann.org>
>             https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
-- 
            Bei weiteren Fragen stehen wir Ihnen gerne zur Verfügung.
Mit freundlichen Grüßen,
Volker A. Greimann
            - Rechtsabteilung -
Key-Systems GmbH
            Im Oberen Werk 1
            66386 St. Ingbert
            Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901>
            Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851>
            Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net/> / www.RRPproxy.net <http://www.RRPproxy.net/>
            www.domaindiscount24.com <http://www.domaindiscount24.com/> / www.BrandShelter.com <http://www.BrandShelter.com/>
Folgen Sie uns bei Twitter oder werden Sie unser Fan bei Facebook:
            www.facebook.com/KeySystems <http://www.facebook.com/KeySystems>
            www.twitter.com/key_systems <http://www.twitter.com/key_systems>
Geschäftsführer: Alexander Siffrin
            Handelsregister Nr.: HR B 18835 - Saarbruecken 
            Umsatzsteuer ID.: DE211006534
Member of the KEYDRIVE GROUP
            www.keydrive.lu <http://www.keydrive.lu/>
Der Inhalt dieser Nachricht ist vertraulich und nur für den angegebenen Empfänger bestimmt. Jede Form der Kenntnisgabe, Veröffentlichung oder Weitergabe an Dritte durch den Empfänger ist unzulässig. Sollte diese Nachricht nicht für Sie bestimmt sein, so bitten wir Sie, sich mit uns per E-Mail oder telefonisch in Verbindung zu setzen.
--------------------------------------------
Should you have any further questions, please do not hesitate to contact us.
Best regards,
Volker A. Greimann
            - legal department -
Key-Systems GmbH
            Im Oberen Werk 1
            66386 St. Ingbert
            Tel.: +49 (0) 6894 - 9396 901 <tel:%2B49%20%280%29%206894%20-%209396%20901>
            Fax.: +49 (0) 6894 - 9396 851 <tel:%2B49%20%280%29%206894%20-%209396%20851>
            Email: vgreimann@key-systems.net <mailto:vgreimann@key-systems.net>
Web: www.key-systems.net <http://www.key-systems.net/> / www.RRPproxy.net <http://www.RRPproxy.net/>
            www.domaindiscount24.com <http://www.domaindiscount24.com/> / www.BrandShelter.com <http://www.BrandShelter.com/>
Follow us on Twitter or join our fan community on Facebook and stay updated:
            www.facebook.com/KeySystems <http://www.facebook.com/KeySystems>
            www.twitter.com/key_systems <http://www.twitter.com/key_systems>
CEO: Alexander Siffrin
            Registration No.: HR B 18835 - Saarbruecken 
            V.A.T. ID.: DE211006534
Member of the KEYDRIVE GROUP
            www.keydrive.lu <http://www.keydrive.lu/>
This e-mail and its attachments is intended only for the person to whom it is addressed. Furthermore it is not permitted to publish any content of this email. You must not use, disclose, copy, print or rely on this e-mail. If an addressing or transmission error has misdirected this e-mail, kindly notify the author by replying to this e-mail or contacting us by telephone.
_______________________________________________
            Gnso-ppsai-pdp-wg mailing list
            Gnso-ppsai-pdp-wg@icann.org
            <mailto:Gnso-ppsai-pdp-wg@icann.org>
            https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
_______________________________________________
        Gnso-ppsai-pdp-wg mailing list
        Gnso-ppsai-pdp-wg@icann.org
        <mailto:Gnso-ppsai-pdp-wg@icann.org>
        https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
_______________________________________________
        Gnso-ppsai-pdp-wg mailing list
        Gnso-ppsai-pdp-wg@icann.org
        <mailto:Gnso-ppsai-pdp-wg@icann.org>
        https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
_______________________________________________
    Gnso-ppsai-pdp-wg mailing list
    Gnso-ppsai-pdp-wg@icann.org <mailto:Gnso-ppsai-pdp-wg@icann.org>
    https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
_______________________________________________
Gnso-ppsai-pdp-wg mailing list
Gnso-ppsai-pdp-wg@icann.org <mailto:Gnso-ppsai-pdp-wg@icann.org>
https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg
_______________________________________________
Gnso-ppsai-pdp-wg mailing list
Gnso-ppsai-pdp-wg@icann.org
https://mm.icann.org/mailman/listinfo/gnso-ppsai-pdp-wg

Re: [Gnso-ppsai-pdp-wg] For review - updated templates Cat B, questions 1 and 2

Chris Pelling

tags

participants (1)